It's the end of the year and while everyone is busy, employers in California should be aware of new laws and regulations that go into effect on January 1, 2020. In the spirit of the season, we are using the "12 days of the holidays" to blog about one California law daily and its impact on California employers. On the twelfth day of the holidays, my labor and employment attorney gave to me: twelve lords a leaping and AB 25.
The California Consumer Privacy Act (CCPA) goes into effect on January 1, 2020. This law provides consumers with various rights with regard to their personal information which is held by businesses, including the right to request a business to disclose specific pieces of personal information it has collected and to have information held by that business deleted, as specified.
The CCPA requires a business to disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer (this may be extended to 90 days). A consumer may bring a private right of action against a business that violates its duty to implement reasonable security procedures and practices if that failure results in a consumer's personal information being subject to unauthorized access and exfiltration, theft, or disclosure. At or before the point of collection, a business that collect a consumer's personal information must inform them as to the categories of personal information to be collected and the purposes for which the personal information shall be used.
One of the issues created by the CCPA is the definition of "consumer." It is a very broad definition that arguably includes employees and job applicants. Under AB 25, information collected from a natural person by a business if said person is acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business, as specified, is exempt from CCPA compliance until January 1, 2021. AB 25 also excludes emergency contact information and information collected in order for the business to administer benefits. In essence, any personal information of an employee or job applicant collected for employment purposes only, is exempt from the CCPA until January 1, 2021.
During the one year extension period, it is presumed that the legislature will determine whether to make this exemption permanent. However, if they do not, employers will need to be ready to comply by January 1, 2021. This includes developing and implementing a system mapping employee data such as usual onboarding information (social security number, address, etc.), any biometric data, browser history, or financial information necessary for payroll.
AB 25 does not prevent an employer from being in compliance with the CCPA as of January 1, 2020 for all other consumers. Employers still need to have a privacy policy as it relates to consumers, other than employees and job applicants. This needs to be provided within 45 days of a consumer's request.
Employers need to be ready and prepared to detail what information is collected as well as how it is used and disclosed. The CCPA will require revisions to an employer's employment agreement, job application, and handbook. The most important thing for employers to remember is that this one year reprieve may not be permanent and they need to continue their preparations for CCPA compliance.
