The CCPA Enforcement date may be pushed back to January 1, 2022 when it comes to employment and business-to-business data, rather than the initially scheduled January 1, 2021.

The California Consumer Privacy Act of 2018 or CCPA, originally enacted in 2018, was set to be enforced as of July 1, 2020, after the required regulations from the California Attorney General were issued in October 2019. While officials stated that the legislation was set to be enacted despite the crisis brought on by the coronavirus pandemic and therefore the enforcement has already begun, employment and business-to-business data may not be fully subject to the CCPA until January 1,, 2022.

Is there any possibility for further changes to this act?

The initial proposed regulations were first published on October 11, 2019 and since then, two sets of modifications (on February 10, 2020 and March 11, 2020), have been released. California Attorney General Xavier Becerra, in June, submitted the final CCPA regulations to the Office of Administrative Law (OAL) for review. These final submissions were substantively identical to the second set of modified regulations proposed in March. While the general CCPA enforcement date remains the same, on June 25, the California state Senate amended Assembly Bill 1281 (“AB 1281”) to extend until January 1, 2022 exemptions from the CCPA for certain employment information and personal information involved in business-to-business communications and transactions. This act will likely come into effect only if it is enacted and the California Privacy Rights Act of 2020 (the “CPRA”) is not approved in the statewide general election on November 3.

What does this mean?

Currently, there are two exemptions in the CCPA which were supposed to become ineffective on January 1, 2021: employment-related information and information involved in business-to-business communications and transactions. This date may change though, depending on whether AB 1281 is enacted and the CPRA is approved.

Based on this, there are several potential scenarios:

Who will be affected by CCPA?

This piece of legislation will apply to all organisations which conduct business in California, whether or not they are based outside of the state, once they collect, sell or disclose California consumers personal information. In this way, it is similar to the GDPR, however there are some clear differences between the two, which can be fully explored via our previously published blog comparing GDPR and CCPA.

Aphaia can help you comply with CCPA. We offer CCPA implementation as a stand-alone service or together with GDPR, plus other related services such as data protection impact assessments and Data Protection Officer outsourcing.