As many know, California recently enacted the California Consumer Privacy Act. On its face and by its name, this Act is intended to protect the privacy of consumers with respect to various personal information. The California Consumer Privacy Act comes into full force on January 1, 2020. It provides consumers with various rights to consent and to have notice of what personal information is collected, how it is manipulated and used, and with whom the information is shared. The Act also gives certain rights about how a consumer can opt out of sharing personal information and how a consumer can demand that information be deleted. The Act also has guidelines for what methods and processes are used for deleting information.

One of the pressing questions for San Diego employers is whether the California Consumer Privacy Act applies to employees.

While, it is true that the name of the Act implies that the it only covers individuals in their capacity as consumers, it is likely that California courts will take an expansive view of the Act. For example, the definition of consumers under the California Consumer Privacy Act is not limited to what we might normally define as a consumer. The definition is this: “A natural person who is a California resident.” See Cal. Civ. Code, §1798.140(g). Furthermore, the definition of what constitutes personal information is also expansive and specifically mentions biometric data and professional or employment-related information. See sections 1798.140(o)(1)(E) and (I). Nothing in the legislative history of the Act suggests that employee personal data is excluded. When interpreting statutes, courts sometimes refer to the legislative history — what the lawmakers said about the particular statute while it was being debated — to glean what the lawmakers intended when they enacted the statute. At this point, nothing exists in the legislative history to suggest that the State Assembly meant to exclude employees from the protections of the Act.

For these reasons, the California Consumer Privacy Act may be interpreted to cover employees and not just consumers and, once your San Diego business establishes the policies and procedures to protect consumers, those same policies and procedures may easily and quickly be applied to employees. When interpreting the expansiveness of a statute, sometimes courts will take into consideration the expected costs and burdens of compliance. If there is a foreseeable large compliance cost imposed, often courts will tread more carefully and wait for the Legislature to act. Here, a burdensome argument will be difficult to make with this Act applying to employees.

What Does This Mean Practically?

As a practical matter, as your business creates and establishes data privacy protections for consumers, your company should make those applicable to employees, as well. Moreover, the concept of employee may not be limited to persons who are actually hired. Rather, the privacy of personal information should be maintained for those seeking employment, past employees, contractors, and more.

Here is an example: Let us assume that your business has a written application that must be completed for anyone applying for a job. The job applicant lists their social security number, date of birth, address, name, and other personal information. Going forward, on the application, you should provide notice to the applicant with respect to how you store the information (paper, e-format, other), with whom that information is shared, how long the information is retained, how and when the information is destroyed, and more. You will need to create and establish company policies and procedures that comply with the California Consumer Privacy Act. You must also comply with what you promise in your notices. An experienced San Diego corporate attorney can help draft and review those policies.

Contact San Diego Corporate Law

For more information, contact Michael Leonard of San Diego Corporate Law. Mr. Leonard has the legal skills and experience to keep you and your business abreast of changes to California law.  Mr. Leonard provides legal services related to business law, contracts, corporate entity formations and maintenance, private securities offerings/sales, the sale/purchase of a business, and mergers and acquisitions. To schedule a consultation, contact Mr. Leonard via email or call (858) 483-9200. Like us on Facebook.

You Might Also Like:

Update: 2018 California Consumer Privacy Act is Amended

What the California Consumer Privacy Act of 2018 Means for San Diego Businesses

Data Security Compliance in M&A

Data Breaches and Data Protection for San Diego Businesses

Can I Use GPS or Phone Apps to Track My San Diego Worker’s Movements?