EMPLOYEE PERSONAL INFORMATION UNDER CCPA
Governor Gavin Newsom signed into law two amendments to the CCPA that have a direct impact on the employers doing business in the State on October 11, 2019.
- The first amendment AB 25 postpones one year all CCPA requirements pertaining to employee personal information i.e. until January 1, 2021.
There are two exceptions under this amendment,
(1) reasonable security measures to safeguard the data, and
(2) disclose the categories of personal information collected about employees and job applicants and the business purposes for which the information is used. - The second amendment AB 1355 excludes specified ‘business-to-business’ communications or transactions from CCPA coverage until January 1, 2021.
What Employee Information is covered under CCPA
The CCPA does not map out the distinction between consumers and employees. Personal information has such a broad definition that it potentially covers all the information a business collects, stores, maintains or shares of employees and job applicants.
Effect of AB 25
It does not exempt employers from any of the CCPA requirements but rather gives the employers an additional one year to comply with all the requirements except for the two mentioned above.
Covered business at present must ensure that they have implemented reasonable security measures to safeguard personal information of employees and job applicants. In a situation where data breach resulted from the failure of implementing reasonable security measures, an affected employee or job applicant can file a class action suit or an individual lawsuit to recover damages.
Further, the deadline was January 1, 2020 for the requirement of disclosing to the employees and the job applicants the categories of personal information that the businesses collect about them and the purpose for which they are being used. The disclosure is to be made at or before the time personal information of an employee/job applicant has been received. For current employees the disclosure can also be made to them as a group in the form of an employee handbook or a memo to all the employees. However, there is no technical requirement for employees to acknowledge the receipt of such disclosure.
Please note that the exemption under AB 25 is limited to one year at the request of privacy advocates and organized labor who wanted to engage in discussions throughout 2020 regarding their concerns on ‘workplace surveillance’ and ‘workplace privacy’.
Effect of AB 1355
It specifies that until January 1, 2021 certain CCPA obligations will not apply to personal information reflecting specified ‘business-to-business’ communications or transactions.
Specifically, it excludes communication or a transaction between a business and a consumer (including another business) where the communication occurs solely within the context of the business conducting due diligence or providing or receiving a product or service from that business.
If you have any questions about this Memo, please email us at privacy@inventuslaw.com.
Disclaimer: The information on this page is being provided for information purposes only and is drafted entirely on the basis of public resources. Information contained on or made available herein is not intended to and does not constitute legal advice, recommendations, mediation or counseling under any circumstance. This information and your use thereof do not create an attorney-client relationship. You should not act or rely on any information provided herein without seeking the advice of a competent attorney licensed to practice in your jurisdiction for your particular business.
