October 18, 2022
B2B exemptions under the California Consumer Privacy Act (CCPA) excluded personal information collected in a business-to-business (B2B) context from the scope of the CCPA. However, these exemptions will cease to apply starting January 1, 2023, with the CPRA going into effect.
This means companies collecting personal information (PI) of business contacts for providing or receiving a product or service to and from another business will have to comply with the requirements under the CPRA. This goes on to include the PI of workforce members, independent contractors, service providers and other business contacts that was collected to aid in providing or receiving a product or service to and from another business.
Points of Discussion
What constitutes B2B data
Difference in CCPA and GDPR compliance
Importance of privacy disclosures, third-party and service provider agreements
Impact on different types of businesses
Provisions regarding the collection of tracking cookies data
What to delete and when
Information being used for validation
Challenges for organizations
Dealing with unstructured data (emails, messenger services, etc.)
Arguments that can be made for not providing data