Employers and the California Consumer Protection Act (CCPA)
DOES IT AFFECT YOU?
By now, many of you have seen the pop-ups on websites you visit alerting consumers to the type of data being collected and the individual’s right to data protections and privacy. These protections include preventing the sale or collection of such personal data, as well as the right to request deletion of such data. This is due to the California Consumer Privacy Act (CCPA), which went into effect in 2020 and applies to the following for-profit companies: (1) businesses with a gross annual revenue of $25 million or more; (2) businesses that buy, receive, sell, personal information of 50,000 California household residents; and (3) businesses that derive 50% or more of their annual revenue from selling consumers’ personal information. It’s important to note that this law applies to all California residents, and specifically covers any information that identifies a consumer, i.e., names, birthdays, etc.
However, CCPA’s successor, the California Privacy Rights Act (CPRA) is the strongest consumer privacy law in the Unites States to date. The CPRA goes into effect on January 1, 2023 and imposes specific obligations on employers. Employers who meet the threshold qualifications (see (1) through (3) above) will need to start working with legal counsel ASAP to determine how this law will impact them. Specifically, covered employers will need to create privacy policies to address the requirements of this new law, which further requires the policy to be updated “at least once” every 12 months. Employers will also need to notify employees and applicants what data is being retained; the right to delete, correct, and limit the use/disclosure of sensitive personal information; and must notify them of their right to opt-out of selling/sharing personal information. Employers will also need to institute processes to manage each of these requests, particularly with respect to the right to deletion.
This is sure to open the floodgates for more litigation, so the sooner employers act with counsel on this extensive and confusing law, the better.