CCPA Amendment Extends Exemptions for B2B and HR Data

A recent amendment extends the California Consumer Privacy Act ( “CCPA”) partial exemptions[1] for business-to-business (“B2B”)-related and certain human resources (“HR”) information from Jan. 1, 2021, to Jan. 1, 2022. The outcome of a ballot initiative on election day could extend the exemptions one additional year, i.e., until Jan. 1, 2023.[2] Either outcome should come as welcome news to fund managers because it preserves the status quo for portions of the CCPA for which implementation would otherwise be difficult.[3]

B2B Contacts

Until Jan. 1, 2022, the CCPA will remain largely inapplicable to information collected in a purely B2B context, such as the name and email address of a California resident acting on behalf of an institutional investor or a vendor.[4] The amendment provides more time for the California legislature to potentially address the burdensome challenges presented by applying the CCPA’s requirements — in particular the requirements of making disclosure to consumers at the “point of collection” and responding to individual consumer requests[5] — to a B2B relationship.

HR-Related Information

The CCPA contains a partial exemption from its extensive disclosure requirements for information about employees, job applicants and contractors and permits employers to use more limited privacy disclosures with respect to these groups. Employers may continue to provide abbreviated disclosures until Jan. 1, 2022, after which the CCPA’s full requirements will apply to this HR-related information absent further legislative action.

The amendment, however, does not lessen the current CCPA requirements. Private fund managers are reminded to continue to provide abbreviated notice requirements to California employees, job applicants and independent contractors as required under the CCPA.

This article appeared in the November 2020 edition of SRZ’s Private Funds Regulatory Update. To read the full Update, click here.

---

[1] The exemptions do not extend to the CCPA’s private right of action for consumers whose sensitive personal information has been subject to unauthorized access or disclosure as a result of the covered business’ failure to maintain “reasonable” security procedures.

[2] On Sept. 29, 2020, California Governor Gavin Newsom signed AB-1281 into law. AB-1281 will only take effect if California voters do not approve the California Privacy Rights Act (CPRA) ballot initiative on Nov. 3, 2020. If voters approve the initiative, the CPRA would extend the exemptions for another year, until Jan. 1, 2023.

[3] The CCPA applies to private fund managers that collect certain personal information from natural persons who reside in California. Our Dec. 6, 2019 Alert discusses the CCPA’s requirements with respect to different types of information, including HR- and B2B-related data.

[4] The exemption is not complete as it applies to B2B data only if the personal information is collected in the context of conducting due diligence or providing or receiving a product or service.

[5] Where no exemption applies, the CCPA requires businesses to respond to requests from individual consumers for information such as the categories of personal information collected and how that information is used, as well requests to delete personal information (subject to regulatory limitations).

---

This communication is issued by Schulte Roth & Zabel LLP and Schulte Roth & Zabel International LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2020 Schulte Roth & Zabel LLP and Schulte Roth & Zabel International LLP. All rights reserved. SCHULTE ROTH & ZABEL is the registered trademark of Schulte Roth & Zabel LLP.