A new law signed on September 29 by California Governor Gavin Newsom (D) postpones the compliance deadline for many of the California Consumer Privacy Act’s (CCPA) employer privacy requirements until January 1, 2022. Effectively, the Act, AB 1281, doubles the 1-year extension already added to these provisions by a previous amendment to the CCPA.
About the CCPA
The bulk of the CCPA, enacted in June 2018, took effect January 1, 2020, and enforcement began on July 1, 2020. Basically, the CCPA (Cal. Civ. Code §1798.100 et seq.) applies to all personal information that a business collects from California residents. “Personal information” is defined more broadly than terms like “personally identifiable information” that we typically see in state data breach laws, for example.
Businesses must inform individuals, at or before the point of collection, what categories of personal information they collect and why. Individuals have the right to know, if they ask, what information a company holds on them, where and why it was obtained, and how it is being used. Other individual rights include purpose limitation, deletion, opt-out of sale, and nondiscrimination.
CCPA violations may bring civil penalties of up to $7,500 per violation, and affected individuals may also sue for up to $750 per consumer per incident. Regulations to implement the CCPA were finalized on August 14 by California Attorney General Xavier Becerra.
Two CCPA requirements did take effect January 1, 2020, with respect to employee data: reasonable security measures to protect employee data (both physical and electronic), and disclosure of the categories of personal information collected and the business purposes for which it is collected.
Employer Takeaways
A separate measure, the California Privacy Rights Act (CPRA), is on this November’s ballot in the state as Proposition 24. Among other changes to the CCPA, the CPRA would extend the exemption for employee, job applicant, and independent contractor data, as well as for business-to-business communications, until January 1, 2023.
While the CPRA seems likely to pass, AB 1281 was enacted as a “backstop” to ensure that employers get at least a 1-year extension, according to Fisher Phillips attorneys Benjamin Ebbink and Usama Kahf. It takes effect only if the CPRA does not.
“The bottom line for California employers? There will be at least an additional one-year reprieve from the CCPA applying to employee, job applicant, and independent contractor data,” Ebbink and Kahf explained in a blog post. “AB 1281 guarantees that by extending the exemption until 2022. If Proposition 24 passes, this exemption will be extended an additional year until 2023.”