Background
The California Consumer Privacy Act 2018 (‘CCPA 2018’) has been under discussion ever since its initial draft for comments was released on October 10, 2019. The CCPA has gone various changes and while the implementation date for businesses was set to be January 1, 2020, there was a lack of clarity in key areas. Considering this the California Attorney General, Xavier Becerra (‘AG’) released an addendum to the final statement of reasons on July 29, 2020, providing for final implementations to be made. These included key modifications such as the right to opt-out clauses, explicit consent clauses, and written permission clauses. The AG released final implementing regulations for the CCPA on August 14, 2020, which are in force now.
HR and B2B Data
Currently, the CCPA exempts most of its requirements in the context of the data collected under the human resource (‘HR’) requirement and information collected by the Business to Business (‘B2B’) personnel. In lieu of expanding the same, the California legislature passed AB-1281 on August 30, 2020. The CCPA provides for exemptions to businesses that are collecting information about job applicants, employee, owner, director, medical personnel, or contractor, till January 1, 2021. CCPA has also provided for exemptions to personal information which may accrue due to a transaction between a consumer and a business provided that the consumer is acting as an employee, owner, director, officer, or contractor, partnership, sole-proprietorship, non-profit, or government agency, and whose transaction with the business occurs within the context of conducting due diligence regarding providing or receiving a specific product to or from the above-mentioned people(s). AB-1281 has proposed to extend both such exemptions till January 2022.
However, Section 2 of the AB-1281 states that “This act shall become operative only if the voters do not approve any ballot proposition that amends Section 1798.145 of the Civil Code at November 3, 2020, statewide general election”, which brings us to the point of ballot initiative taken under California privacy laws.
Additional requirements for companies to adhere to CCPA 2018 can be found here.
Ballot Initiative for California Privacy Laws
The California Secretary of State, Alex Padilla, issued a memorandum on June 24, 2020, stating that the California Privacy Rights Act of 2020 (‘CPRA’) has gathered 623,212 (six hundred twenty-three thousand two hundred and twelve) valid signatures which are sufficient for the CPRA to be placed on the State’s General Election ballot this November 3, 2020. The CPRA shall amend certain provisions of the CCPA providing additional safeguards. If approved by the California voters, the CPRA shall become operative on January 1, 2023, and shall apply to information collected after January 1, 2022. Some of the additional rights and obligations that the CPRA would amend are as follows:
Sensitive Personal Information
The CPRA has proposed to provide a new category under ‘sensitive personal information’ which shall be defined to include facets such as Social Security Number, driver’s license number, religion, race, ethnicity, union membership.
The Right to Correction
If any personal information collected by businesses is incorrect or inaccurate, then in such a circumstance the CPRA proposes for the California citizens to request a correction of such information. Currently, the CCPA 2018 provides for the right to deletion.
Data Breach Liability
The CPRA has proposed that any breach of information which results in the compromise of a consumer’s email address in a combination of their passwords shall be subject to the relevant provisions to impose liability.
Enforcement Agency
While the CCPA 2018 is governed and enforced by the California Attorney General’s Office, the CPRA has proposed to establish the California Protection Agency to enforce the law.
HR & B2B Exemptions and CPRA
The CPRA, as provided under Section 15, has proposed for certain HR and B2B exemptions. This essentially means that the temporary exemptions provided for HR and B2B shall be extended till January 1, 2023, if the CPRA is passed during the November 3, 2020 ballot. Alternatively, if the California Governor approves the AB-1281, then such exemptions shall be extended till January 1, 2022, provided that the CPRA does not pass.
Authored by Shivani Agarwal, Founder, and Samaksh Khanna, Co-founder.
Comments