Episode 160: California Consumer Privacy Act Will Apply to Employers in 2023

Foreign.

Welcome to the Workplace, a podcast by Cal Chamber I'm Matthew Roberts, the Labor Law helpline manager and Employment Law council with the California Chamber of Commerce. Hello everybody. The summer is winding down, although you wouldn't know it by the desert level temperatures we've been seeing across the state and the calendar slipped to September. So for those of us here in the Capitol, that means that the legislative session has ended and and it is time for Governor Newsom to decide which bills he signs and which bills he vetoes. As with most years, there are several employment law bills awaiting his signature that if signed, will alter our employment practices. But while we wait, we are going to discuss some legislation today that did not get passed related to the California Consumer Privacy act or the CCPA as I'll call it, that may create some compliant issues for many businesses in California beginning January 1st. So to discuss the current state of the CPA and how this will impact our employers, we welcome back to the podcast Cal Chambers policy advocate for employment law issues, Ashley Hoffman. Thank you for joining me today, Ashley.

Thanks for having me, Matt.

So the CCPA was initially created in 2018 and went into effect January 1, 2020, was subsequently amended by Proposition 24 later in 2020 and continues to make news as enforcement actions are starting to be made public recently. But it feels kind of strange that we're talking about a consumer protection law here on the Workplace podcast. So Ashley, maybe you can help square this issue for us by briefly describing what the CCPA actually is and how this would relate to employers.

So as you mentioned, the CCPA was passed originally in 2018 and the intention of the law is a data protection law. It provides rights to California consumers. So for example, the right to know what data about them is being collected, right to certain protections of their personal data, you know, right to some remedies. If there is, for example, a data breach, there is a right to, you know, inspect what records certain companies have of you. Rights, for example to opt out of some selling of information, right to request deletion of information, et cetera. It does not apply to every business in California, but does apply to three categories of for profit businesses. So the first is if you have a gross annual revenue of 25 million or more. The next is if you buy, receive or sell personal information of a hundred thousand. Well, it will be a hundred, it's currently 50,000. I believe it will be a hundred thousand or more California residents, household or devices or if you derive 50% or more of your annual revenue from selling, you know, California resident personal So I.

Think the first question for employers then should be, am I even covered? And you kind of described in what situations we're going to look at if you're covered. So once an employer determines that they're uncovered, then which consumers and which data is subject to the law? There's a lot of definitions in this law that I think are important for employers to grab a hold of and understand what it is that they're trying to protect and who it is that might talk to them about the ccpa.

So, so the way consumer is defined, it means a California resident. I will note, though, you know, a lot of law firms have started putting out guidance on this because of the sunsets, which we'll talk about in a few minutes regarding employees. But they did note you want to be very careful when you're crafting these policies to make it clear that, you know, these policies that you're going to be applying as required under the CCPA truly only apply to California residents. If your policy is written too broadly. You could kind of find yourself in a bind where maybe you kind of express that you are willing to apply these kinds of rights to people even outside of California. You know, as far as the types of information, it's, it's, it's really anything. I mean, the way that personalized information is identified, it's anything that identifies, relates to or quote, could reasonably be linked with a consumer or their household. So it's, it's everything under the sun. And then you know, something worth noting again, and I'll talk about in a second when we get to the employee piece of this and the sunsets that are about to expire is even if you aren't covered, the law will now apply to business, to business information. So if you are a submariner company, for example, or like a nonprofit who's doing business, you know, with someone who is covered by the ccpa, you're going to want, or cpra, you're going to want to really start to familiarize yourself with this law because you are going to start, you're going to get wrapped up in it a little bit.

So then I think that begs the question for us as we're listening to this podcast. You're telling me, you know, personal information is everything under the sun that's covered by the CCPA and the cpra, as you mentioned. You know, things like name, date of birth, Social Security number. These are all things employers get from everybody. Then that all of this data is subject to all of these different rules or what has been in place for us as employers, where we don't have to worry about this so much.

Yeah. So I want to be very clear. The CCPA was never intended to apply to employees. That was very clear from the authors. That was never the intent at all. You know, the legislative history supports that. But what happened was when they were doing some cleanup, there was some concern from folks that consumer was written so broadly that it could include employees. And so they wrote, you know, what they did is they ran a bill and amended it to say, you know, employees are not included. It's what we call the employee exemption. There was also an exemption added to the be clear that it's not supposed to apply to business, to business transactions. And so what happened was, is that bill was going through the legislature. There were some groups that wanted to force a discussion on worker privacy. And so they did. They put a sunset on there to really force, you know, business and mostly labor groups, also attorney groups, to come to the table to talk about worker privacy. You know, Covid hit shortly after that, and the sunset was also then extended through Prop 24 to January 1, 2023. We had been, you know, raising this for a very long time. You know, a lot of our members were very concerned about the fact that these were about to expire and had had some negotiations, you know, with folks on the other side over the course of the year. But those negotiations ended up kind of breaking down very close to the end of session. And so, you know, no bill was formally passed to extend the sunset. So, you know, as of now, absent, you know, maybe another bill or an EO or you know what, or, you know, what have you, these sunsets will expire January 1, 2023, but notably, enforcement does not begin until July 1, 2023.

Okay, so what this sounds like to me then is with the sunsets going away, all that data that we collect as employers, if we're covered by the ccpa, you know, based on those factors that you mentioned at the outset, that means employees are going to have all these different rights under this. So what does that mean for us as we head towards January 1, July 1 of 2023? What should employers be looking at doing at this point?

Yeah, so I would say, you know, you definitely want to consult legal counsel about what this means. You want to make sure that you are creating policies surrounding, as far as how, you know, you're going to be treating employee data. You need to know what data you collect. You need to know what purposes that is used for. You need to also know, you know, how long Is that data retained? You also need to evaluate, you know, what other laws, for example, exist that have certain retention requirements and how does this fit in with that? Because you're going to need to make these disclosures to your employees about what data you have. You're also going to need to develop, you know, a system for them to make certain requests that they will have the right to do under the law, which can include, you know, right to accessing some of this. This. It could potentially include, you know, a certain right to correct, which some employers are concerned about. Right. Does that mean you can try and correct kind of subjective information? There's also a right to delete, which is of course extremely concerning in the employment context, especially when you think about maybe if an employee is engaging in discriminatory or harassing behavior and they may want to try and cover that up. You want to also be sure that you're familiarizing yourself with the other exemptions that will still apply. You know, there's an exemption for legal claims, right. Things like that. So you want to make sure that you're having a system set up for employees, you know, if, if they are seeking to exercise any of these rights, but then also knowing kind of the bounds of those rights to make sure that, you know, especially that maybe if there's a document or something that could be very key in a workplace investigation or something that's going on, you know, maybe there's an exemption that applies to ensure the integrity of that, that investigation.

Yeah, Ashley, I mean, what you described for me is really, you know, it's quite complex. Sounds like a very labor intensive process here. So I think you really help distill this down for employers. Right. Figure out if you're even covered at first and, and then kind of start to develop a plan with legal counsel. So thank you very much for joining me today to kind of go through where we are at with the CCPA and the cpra.

Yeah, thank you for having me.

And thank you listeners for joining this discussion on the workplace. Please comment, share and subscribe to Cal Chambers podcast by visiting calchamber.com.