November 30, 2022

Volume XII, Number 334


November 29, 2022

Subscribe to Latest Legal News and Analysis

November 28, 2022

Subscribe to Latest Legal News and Analysis

Employers Get Ready – CCPA Employee and B2B Exemptions End, Expanded Privacy Compliance Begins in 2023

For the past few years, California’s comprehensive privacy law known as the California Consumer Privacy Act (“CCPA”) included an important partial exemption for employees, applicants, and independent contractors (collectively, “workforce members”). The California Privacy Rights Act, which amended the CCPA, extended the exemption through December 31, 2022. While many expected the exemption would be extended, the current California legislative session ended on August 31, 2022, without a bill to do so.

The failure to get an extension across the legislative finish line leaves CCPA-covered businesses with not much time to begin expanding their CCPA compliance efforts. Currently, compliance with respect to workforce members, and certain others, is limited. It includes, in general, providing a notice at or before the time of collection of personal information and maintaining reasonable safeguards to protect certain personal information. By comparison, employers will need to, among other things, expand their privacy policy to address workforce members and be ready to respond to the requests of workforce members concerning their rights under the CCPA, including the right to delete their personal information.

Another exemption, known by some as the “B2B” exemption, generally excluded the personal information of individuals in their capacities as representatives of entities doing business with CCPA-covered businesses. It appears that exemption also will cease to apply in California on January 1, 2023.

For employers wondering if this applies to them and what needs to be done next, our CCPA/CPRA FAQs provide some helpful information, addressing questions such as:

  • Which businesses does the CCPA/CPRA apply to?

  • What is personal information under the CCPA?

  • Does the CCPA apply to employee/applicant data?

Of course, the last question is modified by this development and we will be updating the FAQs accordingly, as well as for CPRA regulations, which currently are in proposed form.

Key steps for compliance will include, among other things:

  • Getting a better handle on the personal information collected, used, retained, and disclosed about workforce members,

  • Updating the business’ privacy policy,

  • Updating agreements with service providers, and

  • Training staff on responding to requests from workforce members concerning their privacy rights under the CCPA.

It is worth noting that the other four states with comprehensive privacy laws – ColoradoConnecticut, Utah, and Virginia – all have excluded the personal information of individuals when acting in an employment or commercial context.

Jackson Lewis P.C. © 2022National Law Review, Volume XII, Number 245

About this Author


Joseph J. Lazzarotti is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and...

973- 538-6890
Jason C. Gavejian, Employment Attorney, Jackson Lewis, Principal, Restrictive Covenants Lawyer

Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies,...

(973) 538-6890

Sean Paisan is Of Counsel in the Orange County, California, office of Jackson Lewis P.C. His practice focuses on workplace safety and health (OSHA), data privacy, and traditional employment matters, including litigation and counseling.  

Sean’s first exposure to OSHA regulations occurred during his undergraduate studies while working for a construction company that helped build Disney’s California Adventure. After attending law school and working for the Los Angeles County District Attorney’s Office and the United States...


Rob Yang is an associate in the San Francisco, California, office of Jackson Lewis P.C. Rob’s practice focuses on representing employers in workplace law matters, including defending a broad array of litigation claims, such as:

  • Discrimination
  • Harassment
  • Wrongful termination
  • Retaliation
  • Failure to provide reasonable accommodations
  • State and federal wage and hour

Rob has handled cases from inception through resolution, including initial case evaluation. Prior to joining Jackson Lewis, Rob...