For Now, Employee Data is Excluded From the California Consumer Privacy Act

Recently, the California State Assembly passed Assembly Bill 25 (“AB 25”) which amends various provisions of the California Consumer Privacy Act. See Section 1798.145(g); see text of AB 25 here. Most of the amendments are nonsubstantive, in the nature of word changes. However, a new section was added to exclude employment-related data from coverage of the CCPA (subsection (g) of Section 1798.145). This is good for San Diego employers — at least for now. The new provisions excluding employee data is set to expire at the end of 2020. The CCPA is an evolving set of privacy rules and is expected to be amended again. It is essential for San Diego businesses to retain an experienced San Diego corporate attorney to remain compliant with the legal standards.

In general, the CCPA applies to any sort of data — including biometric data — that is collected by a business about its customers. However, the definition of “customer” or “consumer” is very broad and is not limited to those who may be purchasing goods or services. Thus, many have concluded that employee data and the data collected from employees and about job applicants would be covered by the CCPA. California lawmakers seem to agree and, thus, for the next year at least, employee data was removed from coverage of the CCPA.

In particular, the amendment states that the CCPA shall not apply to the following:

(A) Personal information that is collected by a business about a natural person in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor … to the extent that the … information is collected and used … solely within the context of the natural person’s role or former role as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or a contractor of that business.

The amendments also excludes emergency contact information that is generally collected from employees and also information necessary to provide benefits to an employee (such as payment of wages). But these exclusions are based on the information being collected for use solely within the employment context. Thus, any non-employment-related use of the information will bring the employer back within the reach of the CCPA. Further, caution should be exercised with respect to information that an employer collected via devices such as phone apps that might collect non-employment-related data. There is also concern about over-collection of data. Often, quite a bit of information is collected by employers and potential employers. Is all that data really necessary? Is it all employment-related?

The amendments to the CCPA have been sent to Governor Newsom for his signature. He has until October 13 to sign AB 25 and, he has indicated that he will sign.

As noted, this particular amendment to the CCPA is explicitly set to expire on January 1, 2021. Thus, San Diego employers are only given a one year reprieve. It is important for employers to recognize what type of employee data they are gathering. It may surprise many employers to learn how much data is being collected. Commonly, data is collected as part of the following processes:

• Persons applying for jobs — job applications can be very intrusive with respect to the information collected; this is particularly true of online job applications
• Data collected during employee orientation after an employee is hired
• Biometric information that may be used for identification and for time management
• Banking data used for wage and salary payment processing
• Tax information
• Medical information if health insurance is provided or for purposes of employee leave or for other purposes such as accommodation requests under disability statutes
• Internet activity where an employer monitors computer/internet use
• Geolocation data where an employer monitors an employee’s movement
• And more

San Diego employers should be aware of the data being collected and be prepared to provide notices and obtain consents if the amendments to the CCPA are not extended beyond January 1, 2021.

Contact San Diego Corporate Law Today

For more information, contact attorney Michael Leonard, Esq., of San Diego Corporate Law. Mr. Leonard can be reached at (858) 483-9200 or via email. Mr. Leonard provides a full panoply of legal services for businesses including formation of corporate entities of all types. Like us on Facebook.

You Might Also Like:

Consumer Privacy Act: Could the Courts Expand the Private Right of Action Under the CCPA?

Is it Time to Say “No” to Biometrics?

Can “Data Dividends” Make the Consumer Privacy Act Workable

California Consumer Privacy Act Will Apply to Employees and Job Candidates

What the California Consumer Privacy Act of 2018 Means for San Diego Businesses