The passage of Prop 24, the California Privacy Rights Act of 2020 (“CPRA”), has caused a bit of confusion among businesses in California.  The confusion stems from the fact that the CPRA has an effective date of January 1, 2023, amending the existing California Consumer Privacy Act (CCPA) when it takes effect, but also immediately extending the current limited exemptions under the CCPA for employment-related data, also to January 1, 2023. (Without the CPRA, the limited exemptions would have already expired.)_ It appears that this labyrinth of amendments, extensions, and exemptions has misled some businesses subject to CCPA (the rules for which will change a little under the CPRA) into believing that they are completely exempt from privacy obligations until 2023 with respect to job applicants, employees, owners, directors, officers, medical staff, and contractors (collectively “employees and applicants”).  This is not the case!  In short, businesses have existing obligations under the CCPA concerning the personal information of their employees and applicants, which became effective on January 1, 2020.

To understand the current employment-related obligations of businesses in California, a brief history lesson is needed.  The CCPA was signed into law in 2018 by then Governor Jerry Brown.  Immediately, it became clear that there were major problems with the law, including, but not limited to, the definition of “consumer” (the second C in CCPA), which is defined to be any resident of California.  Lawmakers recognized the potential issues that would come from granting employment-related data subjects (i.e., job applicants, employees, independent contractors) all the rights a traditional consumer would have under the CCPA.  Thus, the California State Assembly introduced AB25, which originally tried to completely exempt business from having to comply with the CCPA for employees and applicants.

Unfortunately for employers, AB25 was amended in the State Senate and the version that was eventually passed and signed into law by Governor Gavin Newsom in October 2019 (just weeks before the CCPA became effective) exempted businesses in their role as employers from most but not all of the CCPA’s requirements with respect to employment-related data (i.e., limited exemptions mentioned above).

Under the CCPA (as amended by AB25), employers have the following current obligations:

• Provide notices to employment-related data subjects (job applicants, employees, owners, directors, officers, medical staff, and contractors) of the categories of personal information being collected and the purposes for which the personal information will be used
• Implement “reasonable security” over certain categories of personal information to avoid a private right of action following a data breach. To this end, it may be prudent to review and augment vendor contracts to ensure that employment-related personal information is handled properly.

Companies should continue to monitor CCPA/CPRA developments, and ensure their privacy programs and procedures remain aligned with current compliance requirements.