For months, companies doing business in California have awaited clarity on the final contours of the California Consumer Privacy Act (CCPA), which goes into effect on Jan. 1, 2020. Some employer questions were recently answered when California Attorney General Xavier Becerra released proposed regulations for the CCPA and Gov. Gavin Newsom signed several CCPA amendments into law. One of those amendments, AB-25, exempts certain types of employee data from coverage under the CCPA.
The CCPA is a broad privacy law intended to give California consumers more control over their personal data by placing restrictions on how companies use and sell personal information. Under the CCPA, certain companies that collect information from California residents are subject to notice and disclosure requirements; consumers are provided certain rights over their information, such as the ability to opt out of information sharing and to request that their data be deleted.
AB-25 will exempt employers for one year from the act’s requirements with respect to personal employee information collected and used by a business “solely within the context of” an individual’s role as a “job applicant to, an employee of, director of, officer of, medical staff member of, or contractor of that business.” In other words, employers are not bound by the CCPA’s requirements to the extent that they collect personal employee information for employment purposes. The exemption extends to emergency contact information and information used to administer benefits when also collected in the context of an employment relationship. The employee exemption sunsets after a year, giving the California legislature the opportunity to consider privacy legislation more targeted to employee data.
The employee exemption will lessen compliance concerns for employers, but companies must still comply with the CCPA with respect to any personal data collected that does not relate to the employer-employee relationship. Employers must still inform employees of the categories of any personal information they collect and how that information is used. Also, the amendment does not exempt personal employee data from the private right of action available under the CCPA. So employees may still bring suits against their employers if their information is subject to a data breach or is not protected by reasonable safeguards.