In an effort to give consumers more control over the data businesses collect from and about them, the California legislature passed the California Consumer Privacy Act (CCPA) in 2018 (and amended it a few months later). The CCPA gives consumers the right to know about and have deleted the data businesses have gathered about them, among other rights. However, the CCPA applies to “consumers” and defines “consumers” so widely that it would cover employees and job applicants, which are not ordinarily understood to be consumers.
Recognizing this problem, the legislature introduced Assembly Bill 25. AB-25 exempts employers for one year from abiding by the CCPA with respect to information collected “by a business in the course of the natural person acting as a job applicant to, an employee of, director of, officer of, medical staff member of, or contractor of that business.”
In other words, as long as employers are collecting the data of its employees and job applicants for purposes solely relating to employment, the CCPA generally does not apply to the collection of that information. However, this exemption would remain in effect only until January 1, 2021. AB-25 has passed both the Assembly and the Senate and will go to Governor Newsom for him to sign the bill into law.
While the passage of AB-25 would be good news for most companies, they still need to be in compliance with the CCPA by January 1, 2020 with respect to information about non-employees and with respect to the non-exempt requirements about employee and prospective employee data. Such companies would still need to inform employees, potential employees, and other consumers what information is collected and why, and how such information is used and disclosed, and they are also subject to certain data breach provisions, among other requirements. Companies should adopt best practices in order to comply with the amended CCPA with respect to both non-employees and employees by January 1, 2021, when AB-25 times out.
According to the amendments, the Attorney General will adopt regulations by July 1, 2020 that “further the purposes” of the CCPA. After that, there will be a public comment period and public hearings. We will keep you informed of any such guidance, and you can read more about the CCPA amendments awaiting signature of the Governor of California here.