Three proposed amendments to the California Consumer Privacy Act were themselves amended on September 6. Here is a summary of the major changes, with links to the current version of each proposed amendment:

• Until 1/1/2021 personal information collected about employees in their role as such is carved out. New addition: emergency contact information and benefits information for employee’s dependents, also carved out. (AB25)
• Consumer authentication should be reasonable in light of the nature of the personal information requested. If there is a user account – can use that (AB25) – Business not required to collect or retain personal information it would not normally collect/retain (AB25)
• “Publicly available” is information lawfully made available from federal, state, or local government regardless of purpose of use.
• Until 1/1/2021: personal information used in communication between a business and an employee of another business in the course of conducting due diligence regarding, or providing or receiving a product or service to or from a business (AB1355)
• Fair Credit Reporting Act (FCRA) exemption revised (AB1355)
• Sale of personal information to a third party in connection with a rewards or loyalty program allowed subject notice + express consent + third party using the info for identifying consumer eligibility (AB846)

[View source.]