Watch Out B-to-B Companies, Your CCPA Data Exemption Has an Expiration Date

For the last few years, California’s robust privacy law—the California Consumer Privacy Act (CCPA)—contained a partial exemption for business-to-business firms or companies that offer enterprise-level services to other companies, such as Salesforce or Microsoft. That means the data shared by employees, with companies and information distributed between b-to-b contacts in California—such as a company's database of sales contacts with information like email addresses and phone numbers—is largely exempted under the CCPA from offering the privacy rights and disclosures that are required under the law for consumers. These include the right to delete their personal information collected, or the right to opt-out of the sale of their personal information, potentially limiting the services certain b-to-b companies can offer and hitting their bottom line. While many privacy advocates and businesses expected the exemption to be extended, instead, the current California legislative session that ended on August 31, 2022, did not pass any such bill. The sunset of this exemption, starting January 1, 2023, will bring with it significant privacy compliance, especially between b-to-b services or companies offering enterprise-level services, according to sources. “Any personal information collected while providing enterprise services will no longer be exempt, starting next year, “said Brandon Reilly, a privacy and data security lawyer and partner at Manatt. Adweek dives into what this exemption means and how companies can comply. Ad Tech Granted Some Relief With Federal Privacy Bill 'Dead' in This Congress How did we get here? When lawmakers initially drafted the CCPA in 2018, the law did not have any exemptions in place that catered to b-to-b entities or company employees. It was only applicable to “consumers,” which were defined as California residents. “Then, industry commentators and privacy professionals started pointing out whether the law extends to employees or to b-to-b contacts,” said Reilly. After which, the lawmakers passed an amendment that exempted employees and b-to-b entities under the CCPA. Lawmakers, however, did not specify the reason for the exemptions. Ok, what's the issue now? California lawmakers made efforts to negotiate a permanent exemption or extend the sunset further in exchange for workplace privacy regulations, but have so far failed. “The problem is the exemption has a sunset,” said Reilly, adding that lawmakers have "been completely unsuccessful in reaching a compromise. I'd characterize the impact [of this sunset] as significant.” It is worth noting that other state privacy laws that go into effect in 2023, like Utah's and Connecticut's, apply only to consumer data and not to commercial or employee-related information. So, what does this mean? Europe's General Data Protection Regulation applies to consumers as well as b-to-b services and employee data. Those U.S. companies that are already GDPR compliant may already have a leg up, said Reilly. Nonetheless, starting next year, vendors, partners and staffers of b-to-b services will have the right to access or request to delete personal information that is collected from their relationship with the CCPA-covered business. To that end, businesses will have the right to opt out of the sale of the b-to-b data or the disclosure of such information for behavioral advertising. Meanwhile, businesses that collect such data will be required to exercise data hygiene practices, including data mapping and inventorying, said Reilly. This includes disclosing sources of data collected, types of personal information harvested, the purpose of doing so—and naming the categories of third parties that can have access to it. “All of those disclosures will now need to go in the company's privacy policy,” said Reilly. What does the compliance include? The key compliance steps for companies, apart from data mapping, involve understanding the type of personal information collected, used, retained and disclosed. To that end, companies will be required to update their internal policies and procedures for processing requests from businesses to exercise their access, deletion and correction rights, according to the National Law Review. Businesses must also update their privacy policies while renewing their agreements with service providers. That sounds lengthy? Although Reilly did not disclose the exact compliance cost, “it’s significant and non-trivial,” he said. “It [will] take staff hours—and in most cases [will] require the involvement of legal and privacy professionals.” However, Reilly noted that many aspects of the current privacy regulatory regime already have special relevance for advertisers, lead generators, and publishers—and in many cases restrict how they can collect, use and share consumer leads. As such, the pending expiration of the CCPA’s b-to-b exemption may expand those restrictions to leads for business contacts, as well. This means the exemption expiration is likely to only impact those companies that deal with enterprise or commercial-oriented products for businesses—think a company that's offering a software platform, or financial products, like mall business loans to a corporation. These companies will now need to provide access and remove users from their databases if requested to do so, according to Jules Polonetsky, CEO of advocacy group, The Future of Privacy Forum. As a consequence, marketing teams on b-to-b brands, which rely on such data for products and service ads targeted toward commercial or enterprise customers, will feel the impact of this sunset, according to Reilly. Are there any penalties? Any violations under CCPA risk substantial fines that are enforced by the state Attorney General (AG), who gives companies a 30-day cure period to fix them. In August, Sephora was fined $1.2 million for doing so. However, the CPRA (effective January 1, 2023), eliminates a mandatory 30-day cure period and instead grants the AG discretion to offer it or not. This means, there’s a good chance a company may not get the cure period for remedying any violation and may end up paying significant penalties, according to Polonetsky. California Advances Stronger Children's Online Safety Bill