Business-to-Business and Employment Exemptions

The CCPA has temporary exemptions for two types of Consumer Groups. The exemptions are set to expire at the end of 2022. If the exemptions below apply to your business, we will notify you before the exemptions expire so that you can create instructions for responding to privacy requests from these Consumer Groups.

Employment Groups

Employment Consumer Groups may consist of: job applicants, employees, owners, directors, officers, medical staff members or contractors who are also California residents.

The CCPA requires that your business provide notice to these Employment Groups when it collects their information. Namely, employees must be told what personal information is being collected about them and for what purpose. However, in most cases your business is not required to make more robust disclosures about how it discloses employee data, and is not required to respond to privacy requests from these groups, as the CCPA does not give these consumers the right to make privacy requests (like a Request to Know) at this time. 

Your business is, however, required to respond to privacy requests from these groups if it uses their information for purposes other than hiring and administering benefits. If your business's Employment Groups appear on the Request Instructions screen, that means you indicated that your business may use these consumers' personal information for purposes other than hiring, employment, and administering benefits.

Business-to-Business Groups

Your business has Business-to-Business Consumer Groups if it collects the personal information of people acting as representatives of an organization, also known as business-to-business (B2B) consumers. 

Like the exemption for Employment Consumer Groups, the CCPA currently exempts most information collection in the B2B context. However, your business is required to respond to certain requests from B2B Groups if it uses the personal information of B2B consumers for purposes other than providing or receiving a product or service, or conducting due diligence about products or services. 

For example, your business should process Requests to Opt-Out if engages in the common practice of purchasing sales leads from a data broker, especially if those sales leads have never communicated with your business to express interest in the goods or services your business sells. If your business's Business-to-Business Groups appear on the Request Instructions screen, that means you indicated that your business may use these consumers' personal information for purposes other than providing or receiving a product or service, or conducting due diligence about products or services.