While it was widely expected that the California Consumer Privacy Act (“CCPA”) would be revised to generally exempt employee personal information from the law’s requirements, on July 11, 2019, the legislature altered a pending amendment to bring such information more firmly under the law’s purview. The CCPA goes into effect on January 1, 2020, although its exact requirements are still in flux. One of the law’s highest-profile amendments, AB 25, would have significantly narrowed the CCPA’s scope by removing employees from the definition of “consumer” and excusing employers from many of the law’s requirements.
Most observers assumed that this amendment would pass, however, the recent modification to AB 25 significantly weakened this exemption. In particular, with these proposed changes, as of January 1, 2020, employers would be required to comply with CCPA’s requirement to disclose to individuals any previously collected personal information and to notify individuals of the categories of personal information collected by the employer, along with the purposes for such collection. Per the law, this disclosure must be made either at or before the time of collection. In addition, while AB 25 still provides an exemption of the CCPA’s other provisions (e.g., responding to requests to delete stored personal data or opt-out of the sale of personal data), the proposed amendment contains a sunset provision so the rest of the employee information exemption expires one year after CCPA goes into effect, presumably to allow time for the creation of additional legislation specific to employer’s use of employee personal information.
In addition, the current version of the amendment also specifically states that any exception related to employee information will not apply to the CCPA’s private right of action for security breaches. This means that California employers may face class action liability following incidents affecting the security of the types of personal information covered by California’s breach notification law.
Additionally, several other amendments remain pending before the California senate. These include an exemption for loyalty programs, a modification to the required method of submitting consumer requests under the CCPA, and various technical and clean-up amendments.
TIP: While the current version of AB 25 weakens the potential employee personal information exemption, unless this amendment is passed in some form, employers may face stricter CCPA obligations with regards to their employee information. Proactive companies may wish to start addressing the CCPA requirements by identifying the employee personal information under their purview and assessing how such information is safeguarded, collected, internally used and externally shared.