Amy Park, left, and Aylin Kuzucan, right, with Skadden.

On Oct. 11, 2019, California Governor Gavin Newsom signed into law AB 1355, an amendment to the landmark California Consumer Privacy Act that will take effect on Jan. 1, 2020. AB 1355 provides a one-year reprieve from compliance with most provisions of the Act for a business' business-to-business (B2B) transactions. The reprieve is a welcome break from the heavy compliance burden that businesses will face, especially for those whose only California personal data relates to business contacts. But is the B2B amendment to be or not to be long term? That is the question.

Under the Act, for-profit businesses, wherever located, that collect the personal information of California consumers and meet certain revenue or information collection thresholds must: disclose to consumers what personal information is collected about them and the purposes for which it is used, disclose what personal information is sold or shared and to whom, delete a consumer's personal information if requested, allow consumers to opt out of the sale of their personal information, and not discriminate against a consumer for exercising any of their rights under the Act. The Act also imposes strict notice obligations on businesses, requiring them to notify consumers, on their websites and in their privacy policies, of consumers' access, disclosure, deletion, opt-out, and other rights. In addition, businesses that fail to maintain reasonable security over the personal information they collect are subject to private lawsuits by consumers if their failure results in a data breach.

The California Attorney General estimates that 15,000 to 400,000 businesses will be affected by the Act. Economists estimate that from 2020 to 2030, businesses will spend $467 million to $16.4 billion collectively complying with the Act.

AB 1355: Temporary Relief From Many CCPA Obligations

AB 1355 offers temporary relief from the Act's onerous demands and associated costs by specifying that, until Jan. 1, 2021, many of the statute's obligations do not apply to otherwise covered personal information that is collected as part of a communication or transaction between the business and a representative of a government agency or other business, where the transaction is made for the purpose of the business conducting due diligence about a product or service, or providing or receiving a product or service to or from the government agency or other business. Businesses whose B2B transactions fall within the amendment's scope will be relieved of all but two of the foregoing obligations: the obligation to allow consumers to opt out of the sale of their personal information, and the obligation not to discriminate. Importantly, AB 1355 does not immunize businesses against private rights of action arising out of data breaches caused by the businesses' failure to maintain reasonable security over consumers' personal information.

AB 1355 was enacted in response to businesses' concerns about the consequences of responding to consumer requests for access to, and disclosure and deletion of, information while attempting to conduct B2B due diligence. As the Senate Rules Committee observed, before deciding to invest in or do business with another business, companies routinely investigate whether that other business is reputable. The individuals whose information is examined during due diligence rarely communicate with the business conducting the diligence. Deletion, disclosure or access rights to this diligence could compromise the effectiveness of the diligence and potentially lead to retaliation against the collecting business for its use of the data. AB 1355 is intended to prevent these and other unintended consequences of compliance with the Act.

Opt-Out Obligations

Under the Act, a consumer has the right, at any time, to opt out of a business's sale of their personal information to third parties. The Act requires businesses to provide at least two designated methods for submitting opt-out requests, including, at a minimum, a link on their homepage titled "Do Not Sell My Personal Information," which links to an opt-out page. AB 1355 removed this notice requirement for B2B businesses, but still requires B2B businesses that sell consumers' personal information to accept and respond to opt-out requests.  Even if your business does not provide consumers' personal information to third parties in exchange for money, it may still be engaged in a "sale" and the opt-out obligation may thus still apply. . The Act defines "sale" extremely broadly. It means "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means" the personal information of a consumer to another business or a third party "for monetary or other valuable consideration." The broad definition suggests that if personal information is provided as part of a larger business relationship, a "sale" may have occurred even if no amounts are paid directly for the data.

So what does responding to opt-out requests entail? The Act provides some direction, and on Oct. 10, 2019, the California Attorney General issued draft regulations providing additional guidance. Under the Act, a consumer can authorize someone to opt out on their behalf. Once a consumer has opted out, the business cannot request authorization to sell the consumer's personal information for a year. Under the draft regulations, which remain subject to public comment and revision, in response to an opt-out request, businesses may present consumers with the choice to opt-out of the sale of all of their personal information or only certain categories of their information, so long as the global opt-out option is more prominently presented than the alternative. Businesses that collect personal information from consumers online must also treat user-enabled privacy controls (such as browser plug-ins or privacy settings) that communicate or signal the consumer's choice to opt out as a valid request to do so. The draft regulations also provide that a request to opt-out, including in the B2B context, need not meet the onerous standards the Act imposes with respect to other consumer-permitted requests, like a request to disclose or delete their personal information.

Anti-Discrimination Obligations

Businesses whose B2B transactions fall within the scope of AB 1355 must also comply with the Act's non-discrimination provisions. While those provisions prohibit businesses from treating consumers who exercise their statutory rights differently from those who do not, the Act does permit businesses to offer different prices or services to consumers if those differences are reasonably related to the value of the consumers' data. The draft regulations explain that the value of consumers' data can be measured by the (1) marginal or average value to the business of the sale, collection, or deletion of a consumer's data or a typical consumer's data; (2) revenue or profit generated by the business from separate tiers, categories, or classes of consumers or typical consumers whose data provides differing value; (3) revenue or profit generated by the business from sale, collection, or retention of consumers' personal information; (4) expenses related to the sale, collection, or retention of consumers' personal information; (5) expenses related to the offer, provision, or imposition of any financial incentive or price or service difference; and (6) any other practical and reliable method of calculation used in good-faith.

It is unclear how the exception permitting businesses to charge different pricing or provide different services will actually work in the B2B context given the lack of identity between the consumers whose data is at issue and the recipients of the benefits (or detriments) of any differential treatment. The consumers themselves would not be the recipients of any differential pricing or services; the counter-party businesses with whom those consumers are associated would be. It remains to be seen how and if this will actually work in practice.

What's Next?

While AB 1355 provides significant relief to businesses engaged in B2B transactions, the relief is, for now, short-lived. Businesses that fall within the amendment's scope are still required to respond to opt-out requests and refrain from discrimination, including ensuring appropriate justification if they choose to offer varying prices or services for consumers that choose to forgo exercising their rights under the Act. In the long term, the amendment may not provide much relief or cost savings for businesses primarily engaged in B2B transactions. But the one-year respite will allow time for B2B businesses to plan how they will comply with the Act and enable the legislature and other interested constituents to consider whether the relief provided by AB 1355 should be extended or further amended. B2B businesses should use the year to determine how they will implement a compliance structure if the legislature decides not to extend the exemption.

Amy S. Park is a partner in Skadden Arps Slate Meagher & Flom's Palo Alto office. She focuses her practice on high-stakes commercial disputes in federal and state courts, including complex business disputes, M&A litigation, shareholder derivative suits, corporate governance disputes, internal investigations and securities class actions. Aylin Kuzucan is an associate in the firm's complex commercial litigation department.