On August 31, 2022, the California legislature adjourned without extending certain exemptions set to expire on January 1, 2023, the effective date of the California Privacy Rights Act (CPRA). The limited expiring exemptions include those for employee and B2B data as associated with the CCPA. Such information may include personal information collected by a business about a person who was either a job applicant or past/current employee or in an otherwise related position, including owners, directors, officers, contractors and beneficiaries/dependents. The exemption is limited to when the business used the information provided "solely" for employment-related actions. As a result, employee and B2B data will be handled the same as consumer data.
The expiration of these exemptions means that covered businesses will be required to extend their CCPA compliance programs to also include personal information for employees and B2B contacts. This includes the requirement to supply California employees, contractors, applicants and business contacts with a complete set of disclosures and rights available to California consumers per the CPRA, such as: access, correction, portability and deletion of personal information.
It is important to note that while some of these exemptions are expiring, the CPRA still provides for the same federal Fair Credit Reporting Act (FCRA) exemption set forth under the CCPA, excluding personal information used by a consumer reporting agency to generate a consumer report under the FCRA. Sec. 1798.145(d)(1) of the CPRA states: "[t]his title shall not apply to activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's [...] personal characteristics [...] by a consumer reporting agency, as defined in subdivision (f) of Section 1681 a of Title 15 of the United States Code, [...] who provides information for use in a consumer report as defined by subdivision (d) of Section 1681a of Title 15 of the United States Code."
Truescreen's legal counsel has reviewed the expiring exemption and has determined that even after becoming effective January 1, 2023, the CPRA will still provide for an FCRA exemption for use of information contained in consumer reports issued by Truescreen. Additionally, while information provided by Truescreen remains exempt, given the stringent requirements of the FCRA, Truescreen continues to comply with requirements for Service Providers under applicable California law.
Clients are well advised to consult with legal counsel to determine whether their use of employee and/or B2B data is subject to requirements under California law.
Updated: July 14, 2023