iThe California Consumer Privacy Act (“CCPA”) has only been in effect since January, but amendments are already on the horizon. Personal information in the employment context was highly contested during the CCPA’s amendment process prior to enactment and has continued to be a point of deliberation even after the CCPA’s effective date.
In its current version, the CCPA excludes certain employment-related personal information from most of the act’s requirements until January 1, 2021, leaving employees and applicants, in effect, as second-class “consumers.” The exclusion applies to personal information:
“collected by a business about a natural person in the course of such person acting as a job applicant to or an employee, owner, director, officer, medical staff member, or contractor of that business, and to the extent the person’s personal information is collected and used by the business solely within the context of the natural person’s role or former role as a job applicant to or an employee, owner, director, officer, medical staff member, or contractor of that business.”
Thus, unlike consumers generally, employees and applicants currently may not request under the CCPA: the deletion of their personal information; the categories of personal information collected; the sources from which personal information is collected; the purpose for collecting or selling personal information; and the categories of third parties with whom the business shares their personal information.
It is important to highlight that under the current exemption, while employees are temporarily excluded from most of the CCPA’s protections, two areas of compliance remain: (i) providing a notice at collection, and (ii) maintaining reasonable safeguards for a subset of personal information driven by a private right of action now permissible for individuals affected by a data breach caused by a business’s failure to do so.
The California Assembly has now passed AB1281, which would extend the exemption until January 1, 2022. The bill moves on to Governor Gavin Newsom’s desk for signing. Notably, the operation of the extension is contingent upon voters not approving ballot proposition 24 in November, the California Privacy Rights Act (“CPRA”), which would amend the CCPA to include more expansive and stringent compliance obligations and inter alia, would extend the employment personal information exemption until January 1, 2023.
In light of AB1281 and/or the CPRA, it appears likely that the CCPA’s exemption for employee personal information will, at a minimum, be extended until 2022. We will continue to update the status of this amendment, and other related CCPA developments as they unfold.
