Starting January 1, 2020, the California Consumer Privacy Act (CCPA) significantly changes California’s consumer data collection rules and give consumers more control over how businesses use their personal information. However, the broad language of the CCPA arguably encompasses employees and job applicants, including employment data. Although employment data has a one-year exemption, employers covered by the act still need to comply with certain requirements starting January 1.
Originally passed in 2018, the CCPA is primarily intended to limit disclosure of personal information collected for commercial/marketing purposes. Businesses subject to the CCPA are required to, among other things, give notice to consumers about the kinds of personal information collected about them and what it will be used for. Under a consumer’s request, businesses must disclose and deliver or even delete such information.
“Personal information” is defined very broadly by the CCPA as “any information that identifies, relates to, describes, or is capable of being associated with, a particular individual,” with some exceptions for certain types of data.
Using this broad definition, employees may be able to go beyond requesting personnel files and payroll records, which they are entitled to request under existing laws, and potentially ask for all personal information employers have about them, including internal company documents/information to which employees are not otherwise entitled. Employees could also ask to have any of their personal information deleted.
To address this problem, the Legislature passed AB 25, which amends the CCPA, exempting employee data, i.e., information collected and used within the context of a person’s employment or application for employment, from most, but not all, of the provisions of the CCPA for one year.
Don’t breathe a sigh of relief yet! Employers subject to CCPA still must comply with some requirements starting January 1 — they still must disclose, at or before the time of collection, the categories of personal information collected about an applicant or employee and the purposes for which the information will be used.
Additionally, covered employers are still obligated to comply with the other CCPA provisions for non-employee/applicant consumers from whom they collect data (customers, clients, website visitors, etc).
The CCPA does not apply to all employers. Covered employers are any for-profit business entity doing business in California that meets one of the following:
- Gross Revenue greater than $25 million;
- Annually buys, receives, sells or shares the personal information of more than 50,000 consumers, households or devices for commercial purposes; or
- Derives 50 percent or more of its annual revenues from selling consumers’ personal information.
Employers should consult with legal counsel to determine whether they are covered by the CCPA and, if so, how to amend employee privacy notices or otherwise comply with their obligations under the CCPA.
James W. Ward, Employment Law Subject Matter Expert/Legal Writer and Editor
CalChamber members can read about New 2020 Labor Laws Affecting California Employers in the HR Library. Nonmembers can request a free copy of this white paper. Not a member? See what CalChamber can do for you.
