The California legislature adjourned without extending the two business-friendly exemptions of the California Consumer Privacy Act (CCPA). The two exemptions had limited much of the CCPA from applying to personal information in certain employment and business-to-business contexts. On January 1, 2023, the CCPA requires businesses to do the following in relation to this employment and business data, among other requirements:
Provide detailed and prescriptive notices at collection and privacy notices;
honor consumers’ rights, including the right to know, right to delete, right to correct, right to limit use and disclosure of sensitive personal information, and right to opt out of sale and sharing of personal information for purposes of cross-contextual advertising;
ensure that service providers that handle personal information adhere to contractual obligations;
sell personal data under contract;
pass on deletion requests to third parties to which the business has sold personal information; and
comply with data security requirements.