Employers Likely to Receive One-Year Reprieve from Full California Consumer Privacy Act | LittlerSeptember 4, 2020
California’s governor may soon sign into law a one-year delay of the California Consumer Privacy Act’s (CCPA) full application to human resources data. On August 28, 2020, California’s legislature passed A.B. 1281, which extends the exemption for human resources data from most CCPA obligations to January 1, 2022. The exemption was previously set to expire on January 1, 2021. Governor Newsom is expected to sign the bill by September 30. If A.B. 1281 becomes law, employers subject to the CCPA can breathe a sigh of relief. With administrative staff already stretched handling issues related to the COVID-19 pandemic, expanding current compliance efforts to address all of the CCPA’s burdensome requirements would have been daunting for most employers.
CCPA’s Exemption for Human Resources Data
The CCPA now exempts human resources data from all but two of its provisions. First, employers must provide HR Individuals (defined below) with a “Notice at Collection” when or before collecting their individually identifiable information (“personal information”). This notice must describe 1) the personal information the company will collect about these individuals, and 2) the purposes for which the company will use that information. HR Individuals means California residents in their capacity as applicants, employees, contractors, owners, directors, medical staff members, emergency contacts of the foregoing, and employees’ dependents or beneficiaries who receive company benefits.
Second, the CCPA grants HR Individuals, like other California residents, the right to recover up to $750 in statutory damages, on an individual or class-wide basis, from a company that breaches its human resources personal information due to a failure to implement reasonable safeguards.
The exemption for HR Individuals was originally set to expire on January 1, 2021, at which point HR Individuals would enjoy the rest of the rights that the CCPA provides to California residents.1
Full Obligations of the CCPA
The full CCPA would impose heavy burdens on employers with respect to human resources data. In addition, for the notice at collection and private right of action, the CCPA imposes two key sets of obligations on covered businesses.
- The categories of personal information the business has collected about California residents in the preceding 12 months;
- The categories of sources from which the personal information was collected;
- The business or commercial purpose for collecting or selling personal information;
- The categories of personal information, if any, that the business has disclosed for a business purpose or sold to any third party in the preceding 12 months; and
- For each category of personal information identified, the categories of…