California: CCPA Employment and B2B Moratoria Extended; Genetic-Testing Bill Vetoed

The changes in California’s privacy laws continue. On Tuesday, September 29, 2020, California Governor Gavin Newsom signed Assembly Bill 1281, which extends the CCPA’s partial moratoria on employment and business-to-business personal information until January 1, 2022. As those following the CCPA’s development last year likely recall, amendments to the CCPA exempted California residents’ employment and business-to-business personal information from some of the statute’s requirements. Specifically, California Civil Code Section 1798.145 states that these categories of California residents’ personal information, so long as they are used within their defined contexts, are exempt from certain consumer rights requests and notice obligations; although, notably, neither category is exempt from the CCPA’s private right of action for data breaches.

Both Section 1798.145’s exemptions for employment and business-to-business personal information were set to expire on January 1, 2021, meaning the CCPA’s scope could have potentially expanded in 2021 and required businesses to start, for example, honoring data subject requests from current and former California employees and business customers.

In November, California will vote on the California Privacy Rights and Enforcement Act, which, if passed, will extend the employment and business-to-business moratoria until January 1, 2023. Now, however, with the Governor’s signature of Assembly Bill 1281, business will not have to wait until November to find out about the CCPA’s scope come January 2021.

The signing of Assembly Bill 1281 is not the only recent California privacy news—the Governor also vetoed SB 980 (the Genetic Information Privacy Act). This bill required direct-to-consumer genetic testing companies to provide consumers with certain information regarding the companies’ procedures for the use and disclosure of genetic data, as well as required these companies to obtain express consent for the collection, use, or disclosure of consumers’ genetic data. In his veto message, Governor Newsom stated that, although he “share[s] the perspective that the sensitive nature of human genetic data warrants strong privacy rights and protections,” the bill’s broad language “risks unintended consequences,” related to restricting the mandatory reporting of COVID-19 test results. The Governor also noted that, because of his support for the goal of the bill, he is directing the Legislature to work with the appropriate agencies to craft a revised bill. Stay tuned.

For further information, please contact Jeff DeGroot (Associate, Seattle) or your usual DLA Piper contact.