The CCPA/CPRA's "Business to Business" Exemption: AB 1355

The California Consumer Privacy Act (CCPA (CPRA)) has attracted some criticism from businesses due to its extensive definition of personal information. The broad definition of "consumer" covers all California residents, including those acting as representatives of their employers.

This has significant implications for businesses that provide products and services to other businesses. To give businesses a little breathing space as the CCPA (CPRA) went into force, the California Assembly passed AB 1355.

AB 1355 means that the CCPA (CPRA) will temporarily exclude certain types of B2B communications. However, the amendment is quite specific. We're going to explain exactly what AB 1355 means and does not mean for your business.

(Note that the CPRA amended and expanded the CCPA, with the amendments taking effect on January 1, 2023.)

How Does the CCPA (CPRA) Apply to B2B Communications?

It is sometimes said that the CCPA (CPRA) does not apply to business-related information. This is actually a misunderstanding of the law.

The reason for this misunderstanding is that the CCPA (CPRA) only protects the personal information of "consumers." The definition of "consumer" extends to "natural persons" who are California residents. "Legal persons" are not consumers.

This is an important distinction:

• A legal person is any entity with legal rights, including corporations, charities, etc.
• A natural person is a living individual

So, "Calvin Klein Inc.," the corporation, is a legal person. The words "Calvin Klein" do not constitute personal information insofar as they refer to the corporation. So, the email address [email protected] does not contain personal information.

Calvin Klein, the fashion designer, is a natural person. The words "Calvin Klein" do constitute personal information insofar as they refer to this particular individual. So, the email address [email protected] does contain personal information.

The exclusion of "legal persons" from the definition of "consumer" has led some people to conclude that business-related communications are not covered by the CCPA (CPRA). However, this is incorrect.

The term "consumer" includes any California residents, and so it is not limited to your customers. It includes any California residents whose personal information you collect, including representatives of other companies (and even your own Californian employees and contractors).

What is AB 1355?

AB 1355 is an amendment to the CCPA (CPRA) that passed in October of 2019.

AB 1355 makes several changes to the CCPA (CPRA), including the following:

• It excludes de-identified and aggregate information about consumers from the definition of "personal information"
• Amends the "right to non-discrimination" so as to allow businesses to offer price differences reasonably related to the value the business derives from a consumer's personal information (effectively permitting loyalty programs)
• Clarifies some of the rules around "the right to know"
• Expands on the CCPA (CPRA) Privacy Policy requirements

Most importantly, however, AB 1355 exempts businesses from certain CCPA (CPRA) obligations in respect of certain types of B2B communications.

It's important to note that this exemption expires on January 1st, 2021.

Here's the section of AB 1355 that relates to B2B communications:

Let's break this section down and examine the implications for your business.

Who is Covered By AB 1355?

The B2B exemption in AB 1355 applies to all businesses covered by the CCPA (CPRA).

The exemption covers verbal or written communication with a consumer "who is acting as an employee, owner, director, officer, or contractor of a company [...]"

AB 1355 defines each of these terms (except "employee," which should be obvious enough):

This covers just about anybody who is likely to engage in B2B communications, either on behalf of your business or on behalf of another company.

Bear in mind that the other company with whom you are communicating does not have to be covered by the CCPA (CPRA) in order for this exemption to apply. AB 1355 applies to communications with any "company, partnership, sole proprietorship, nonprofit, or government agency."

What Types of Communications are Exempted?

AB 1355 covers any verbal or written communication solely concerning:

• Conducting due diligence regarding a product or service
• Providing a product or service
• Receiving a product or service

This exemption does not apply to all B2B communications. For example, consider whether cold marketing communications or negotiations fall into the categories above.

Which Sections of the CCPA (CPRA) are Exempted?

Where a verbal or written communication is covered by the B2B exemption, a business is exempt from the following sections of the CCPA (CPRA) in respect of any personal information contained within that communication:

• 1798.105
• 1798.110
• 1798.115
• 1798.130
• 1798.135

These sections cover most of the CCPA (CPRA) consumer rights and notice obligations.

The Right to Notice

AB 1355 exempts businesses from their obligations under Sections 1798.100 and 1798.130. These sections the CCPA's notice obligations.

Section 1798.100 (b) of the CCPA (CPRA) requires businesses to:

"inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used."

This is known as "notice at collection." AB 1355 means that businesses are not required to provide notice at collection when engaging in relevant B2B communications.

AB 1355 exempts businesses from Section 1798.130, which contains the CCPA (CPRA) Privacy Policy obligations. Of course, this doesn't mean that you're no longer required to publish a Privacy Policy. But it does mean that you won't have to disclose information relating to relevant B2B communications in your Privacy Policy.

So, you won't need to provide the following information in your Privacy Policy insofar as it relates to your B2B communications over the past 12 months:

• The categories of personal information you have collected
• The categories of sources from which you collected personal information
• Your business or commercial purposes for collecting personal information
• The categories of third parties to whom you have disclosed personal information
• Notice of whether you sold personal information or disclosed personal information
• The categories of any personal information you have sold and/or disclosed for a business purpose

This is likely to be relevant to the extent that you will collect personal information from certain sources, such as employees of other businesses, and for certain business purposes, such as providing a service to other businesses.

Of course, you will still need to declare the information above insofar as it relates to all other contexts that are not covered by AB 1355.

The Right to Know

AB 1355 exempts businesses from their obligations under Sections 1798.100, 1798.110, and 1798.115 of the CCPA (CPRA). The right to know is set out across these sections.

This means that you will not have to reveal the categories of information you have collected, disclosed, or sold about employees of other businesses insofar as they relate to the B2B communications covered by AB 1355.

You also don't need to provide the "specific pieces" of personal information you have collected in the course of relevant B2B communications.

Section 1798.30, which sets the conditions for providing a consumer's information (for example, the business must provide the information within 45 days, up to twice per year, etc.), is also exempted.

Bear in mind, however, that not all business-related personal information is covered by AB 1355. For example, there is no indication that AB 1355 covers business-related personal information obtained from third parties.

Be prepared to provide any information that was not collected in the context of conducting due diligence, or providing or receiving a service.

The Right to Delete

AB 1355 exempts businesses from their obligations under Section 1798.105, which sets out the right to delete.

This means that you will not be required to comply with requests to delete personal information collected via relevant B2B communications.

The same caveats apply as with the right to know (above): you must delete personal information obtained in the course of business communications that are not covered by AB 1355.

Section 1798.135

AB 1355 exempts businesses from their obligations under Section 1798.135 of the CCPA (CPRA). The implications of this are unclear.

The California Assembly included Section 1798.135 among AB 1355's exempted provisions but did not include Section 1798.120. This is problematic, as neither section can be read in isolation.

For example, Section 1798.120, which is not exempted in AB 1355, contains the right to opt out. However, where a consumer submits a request to opt out, the business must comply "persuant to [...] Section 1789.135," which is exempted.

Section 1798.135 requires businesses that sell personal information to create a "Do Not Sell My Personal Information" page. AB 1355 might, therefore, exempt businesses from creating a "Do Not Sell" page if they exclusively sell business-related personal information that is covered by AB 1355.

Ultimately, the inclusion of Section 1798..135 of the CCPA (CPRA) is unlikely to affect most businesses.

Which CCPA (CPRA) Obligations are Not Exempted?

Certain CCPA (CPRA) obligations are notably absent from AB 1355 and so businesses must still comply with these, even in respect of relevant B2B communications.

The Right to Opt Out

Section 1798.120 of the CCPA (CPRA) is not among AB 1355's exempted sections. This section contains the right to opt out.

Therefore, if another company's representative requests that you do not sell their personal information, you must comply with this request.

The Right to Non-Discrimination

Section 1798.125 of the CCPA (CPRA) is not included among AB1355's exempted sections. This section contains the right to non-discrimination.

Therefore, you must not provide a reduced quality of service or increase the price of your services if another company's representative exercises their rights under the CCPA.

What Happens After AB 1355 Expires?

AB 1355 expires on January 1st, 2021. Unless this deadline is extended, you must be prepared to treat communications with representatives of companies who are California residents in the same way as you treat the personal information of other California residents.

This may require you to audit your databases, inboxes, and other repositories of personal information to determine which of your B2B communications contain the personal information of California residents.

Remember that you must respond to requests under the California consumer rights within 45 days, so it's important to be prepared.

Summary

AB 1355 means that you don't have to comply with certain obligations under the CCPA (CPRA) in respect of communications with representatives from other organizations that solely concern:

• Conducting due diligence about a product or service
• Providing a product or service
• Receiving a product or service

You don't have to comply with requests under the right to know or the right to delete in respect of personal information collected during relevant B2B communications.

You also don't have to provide CCPA/CPRA-compliant notice that you will be collecting personal information before engaging in these communications. You can exclude the personal information collected from such communications from the disclosures included in your Privacy Policy.

Remember: AB 1355 expires on January 1st, 2021.