Beginning on January 1, 2020, the California Consumer Privacy Act of 2018 (“CCPA”) will impose new privacy obligations on certain businesses that collect personal information of California consumers. Employers with employees in California are trying to navigate how the CCPA applies to the employment relationship, including information related to employee benefit plans. Below is a summary of the potential implications for employers that are a “business” covered by the CCPA. To determine if your business is subject to the CCPA, please see our prior article (Are We Covered by the CCPA?).
Are my employees considered “consumers”?
The definition of “consumer” is very broad, providing that any natural person who is a California resident is a “consumer” for purposes of the CCPA. This broad definition extends to cover employees who are resident in California. The fact that their relationship with the business is as an employee, and not a consumer of the goods and services of the business, is irrelevant for this purpose. Residency is determined using an analysis of whether an individual is (i) in California for other than a temporary or transitory purpose; or (ii) domiciled in California but temporarily or transitorily outside of California.1 Therefore, your employees who are domiciled in California, including those who are temporarily outside of California on business, are consumers under the CCPA. However, your employees who travel to California to do business periodically, but are not considered resident there, are not “consumers” under the CCPA.
Is employment-related data considered “personal information”?
Yes. As the definition of “consumer” is very broad, so is the definition of “personal information.” Employment-related information is clearly “personal information” under the CCPA.2 There is no exemption for employment-related personal information stored and maintained by an employer, unlike the privacy laws of other states, such as Texas.3
“Personal information” means “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.4” Various examples applicable to the employment relationship are listed in the definition, including: name (real or alias), address, email address, SSN, driver’s license number, insurance policy number, education, employment, employment history, bank account number, credit card number, or any other financial information, medical information, health insurance information, biometric information, Internet or other electronic network activity information.
Notwithstanding this definition, to the extent employment-related information is collected or used in connection with an ERISA-covered employee benefit plan, such data may be exempted from the CCPA due to ERISA preemption, as discussed below under “Is employee benefit plan data covered by the CCPA?”.
From an employer perspective, consider the following common types of data that would be “personal information” for purposes of the CCPA:
-
New hire/onboarding paperwork, including resumes, employee applications (typically including Social Security Number, drivers’ license, mailing address, and other personal information), background checks, IRS Forms W-4 (withholding), etc.
-
Payroll information, including employee bank account numbers for direct deposit.
-
Credit card information provided in connection with expense reports.
-
Random drug testing paperwork and results.
-
Documenting of various types of leave, such as sick leave, vacation, paid time off, FMLA leave, USERRA leave, maternity/paternity leave, etc.
-
Employee benefit plans (to the extent not exempt from the CCPA).
-
Employee’s online activity on a work computer/system, such as browsing history, search history, and information regarding the employee’s interaction with an Internet Web site, application, or advertisement.
Is employee benefit plan data covered by the CCPA?
Generally, yes. Employee benefit plans collect and use personal information as the plans require various types of personal information in operation, such as name, address, Social Security Number, and insurance policy information. However, compliance obligations of certain benefit plans may be : (1) limited by the CCPA’s HIPAA exemption; and (2) potentially preempted by ERISA.
-
HIPAA Exemption. The CCPA does not apply to “protected health information” (“PHI”) of a group health plan that is a “covered entity” subject to HIPAA or to other personal information maintained by the covered entity in the same fashion as PHI. Employer sponsored HIPAA-covered benefit plans typically include a major medical plan, dental, vision, health flexible spending account, and certain wellness or employee assistance programs. It is important to note that some information collected by a plan may be personal information under the CCPA, but not PHI under HIPAA, and there may be compliance obligations with respect to that information.
-
ERISA Preemption. ERISA-covered benefit plans that are not HIPAA-covered (such as retirement, long term disability, life and AD&D) may be able to successfully argue that personal information collected and used in connection with such plans are not subject to the requirements of the CCPA. ERISA supersedes all “state laws” (including state law causes of action) that “relate to” employee benefit plans that are covered by Title I of ERISA.6 ERISA preempts a state law if (1) the state law imposes requirements explicitly with reference to ERISA plans, or (2) if the state law governs central matters of plan administration or that interferes with nationally uniform plan administration.7 Although the CCPA does not explicitly reference ERISA plans, the CCPA is likely to have a direct impact on the ability of an employer to have a nationally uniform plan administration for its benefits when operating in multiple states. The CCPA would require the employer to subject the ERISA plan to employee/participant requests for access and deletion that would be likely to significantly increase the cost of operating plans with respect to California employees/participants. Unfortunately, absent guidance that may be provided by the California Attorney General, in order to find out if the CCPA is in fact preempted so compliance is not required a company may need to bear enforcement risk, and be willing to spend time and money to litigate the issue.
Most employers likely maintain non-ERISA benefit plans that would be required to comply with the CCPA, such as short-term disability (if designed as a pay practice), various types of leave/vacation/paid time off, dependent care flexible spending accounts, and voluntary insurance (such as Aflac). Therefore, employers will need to consider whether claiming ERISA preemption is worthwhile, given that some of the employer’s plans may and others may not be subject to the preemption argument. In addition, many ERISA plans are administered by third party vendors that may otherwise be preparing to comply with the CCPA, which could reduce some of the challenges with compliance at least with respect to the benefit plan data held by the third party vendor.
What rights do my employees get under the CCPA?
The CCPA gives consumers, including your employees who are residents of California, various rights related to their personal information held by your business if your business is subject to the CCPA. For employees, here is what that currently means:
-
Right to Data Access. Employees may request categories of, and specific pieces of personal information that the employer has collected about them. The employer must promptly provide the employee with that data, upon verification of the employee’s identity.
-
Right to Deletion. Employees may request that an employer delete any personal information the employer has collected about the employee. An employer is not, however, required to comply with the request to delete when it is necessary for the employer to maintain the personal information in certain situations.8
-
Disclosure Requirements: Upon verified request, the employer must provide to an employee the:
categories of personal information collected;
categories of sources from which personal information is collected;
purpose for collecting such information;
categories of third parties with access to the personal information; and
specific pieces of personal information collected about the employee.9
-
Right to Opt-Out. Although a consumer has the right to opt out of a businesses’ sale of the consumer’s personal information to third parties, this is unlikely to come up in the context of the employment relationship as employers typically do not “sell” employees’ personal information.10
What key steps should employers take?
An employer subject to the CCPA should apply the same steps it is applying to “personal information” it collects from customers and other consumers to employee data and employee benefit plan data that may be subject to the CCPA. However, as a practical matter, the notices provided and the processes involved may be communicated and operated differently for the employee population versus external “consumers”. For guidance on developing your CCPA compliance project plan, please see our prior article (We Are Covered, So Now What Do We Do? Create A Project Plan!). A few key issues for employers include:
-
Determine which employees are residents of California or whether to extend the California consumer rights to all employees.
-
Determine whether employee benefit plan data is personal information that is not exempt from the CCPA.
-
If your business is a “covered entity” under HIPAA and/or the CMIA11 , determine whether employee data is subject to the same privacy and security protections as patient information.
-
Determine which systems and third party service providers hold the employee information.
-
Develop a streamlined method by which employees can make personal information access and deletion requests.
-
Develop processes to identify and isolate an individual’s information.
-
Train a team of employees to handle and respond to CCPA requests from employees.
Employers subject to the CCPA should begin compliance efforts immediately in order to be prepared for the onerous requirements in advance of the CCPA effective date of January 1, 2020.
We will be publishing additional Quick Studies on the CCPA to help clients understand the various requirements. For help with developing your business’ compliance program, please contact any member of our CCPA Initiative.
---
1. California Code of Regulations, Title 18, Section 17014.
2. CCPA Section 1798.140(o)(1)(I).
3. For example, in Texas, the medical records privacy law provides an exemption for employers, except with respect to a limited provision on the prohibition on reidentification of PHI. Texas Health and Safety Code Section 181.051.
4. CCPA Section 1798.140(o)(1). Note that “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
5. CCPA Section 1798.145(c)(1)(A) and (B).
6. ERISA Section 514(a).
7. Shaw v. Delta Air Lines, Inc., 463 US 85 (1983).
8. CCPA Section 1798.105.
9. There are additional disclosure requirements if an employer sells employee information for a business purpose; however, a typical employer would not be selling employee information and such disclosure requirements are not discussed herein. CCPA Section 1798.115.
10. CCPA Section 1798.145(c)(1)(B).
11. CCPA Section 1798.120.
