Does the CCPA apply to information about businesses?

The CCPA only applies to personal information about “consumers,” a term which is defined as “a natural person who is a California resident.”¹  As corporations or other legal entities are not people, the CCPA does not apply to information that relates to them.  That said, to the extent that information that relates to a business also relates to a real person, and either identifies them or makes the person identifiable, it would be within the scope of the CCPA.  As an example, an online rating of a company called Best Dentist would not be governed by the CCPA.  An online rating of an office named John Smith DDS (after the dentist that practices there) would (or will) be governed by the CCPA. 

It is worth noting, however, that to the extent that information relates to an “employee, owner, director, officer, or contractor” of a company, the obligations of the CCPA phase in over time.  Specifically, some provisions went into effect on January 1, 2020, such as possible liability following a data security breach that includes sensitive category information.  Other provisions become effective on January 1, 2021, such as the ability of the employee, owner, director, officer, or contractor to request access to their personal information.²

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide.

1. Cal. Civil Code 1798.140(g).

2. See Assembly Bill No. 1355 (Oct. 14, 2019).