Privacy & Cybersecurity Law Blog

On February 18, 2022, California Assembly Member Evan Low (D) introduced a pair of bills – AB 2871 and AB 2891 – that would extend the duration of the current exemptions in the California Consumer Privacy Act (“CCPA”) (as amended by the California Privacy Rights Act (“CPRA”)) for certain HR data and business-to-business (“B2B”) customer representative personnel data from most of the law’s requirements. The existing temporary “HR” and “B2B” exemptions were first introduced through amendments to the CCPA, and were extended by the CPRA, under which the exemptions will sunset on the CPRA’s compliance deadline, January 1, 2023.

AB 2871 would extend the HR and B2B exemptions indefinitely, while AB 2891 would extend the exemptions only until 2026.

If passed, the bills may face challenges under the California Constitution, given their legislative posture as amendments to a ballot initiative, which is the mechanism by which the CPRA was approved by California voters. In light of these considerations, AB 2871 and AB 2891 both state that the amendments “further the purpose and intent of the California Privacy Rights act of 2020, enacted by Proposition 24 at the November 3, 2020, statewide election, within the meaning of Section 25 of Proposition 24.”

The bills may be heard in committee on March 21, 2022.