There is a lot of confusion about how the California Consumer Privacy Act (CCPA) will impact California employers. The California legislature is considering AB25, which has been interpreted as eliminating CCPA’s requirements for California employers. But that is too simple of an interpretation because of the requirements of AB25 in its current iteration, as well as existing California labor laws.
Right of Access:
In general, the CCPA regulates the right of California residents to access, delete and opt out of sharing their personal data. However, California employees already have a right to access some of their private employment data. Under the California Labor Code, employees have the right to access and receive copies of their pay records and their personnel files upon request. In fact, these requests are commonplace for California employers. So that right to access won’t change.
In addition, AB25 sunsets in one year. As of January 1, 2021, unless another arrangement has been reached, the full legal rights CCPA grants all residents will also be granted to employees.
Right of Information:
In its current iteration, AB25 reinstates the requirement to provide employees the privacy information that California businesses are required to provide all residents. Once the final version of the CCPA passes, chances are that in addition to an online privacy notice on their websites, California employers will need to provide applicants and employees some sort of privacy notice. This will likely include information about what personal information is collected about them, the purpose, with whom it is shared, and what the employee/applicant’s rights are about it.
What is Data In the Scope of the Employment Relationship?
As drafted, AB25 only exempts personal information collected from an individual by a business in the course of the individual acting as a job applicant to, or an employee or contractor of that business. Depending on how it is interpreted by the California Attorney General, certain personal information collected about (not from) employees, and certain information collected from the employees but not necessarily in connection with the employment relationship, would remain within CCPA’s scope. This could include extra-curricular employee data, such as biometric data, or health information through a 3rd party service or app which is provided as a perk and not required for the employment relationship.
In this current climate, it is important to be careful with any information that seems “big brother-esque” or where, if discovered, an employee might ask “why would my employer have this information about me?”
If you are reading blog posts and think the CCPA is not your issue as a California employer, think again. Privacy issues are not going away, they are only expanding….
[View source.]
