How Changes to California's Data-Privacy Rules Would Affect Employers
The clock is ticking for employers to comply with the new law.
September 14, 2019 at 08:33 AM
5 minute read
State lawmakers have sent to Gov. Gavin Newsom what will likely be the final amendments to the California Consumer Privacy Act before the landmark data-privacy bill goes into effect on Jan. 1.
The proposed changes offer some clarification for businesses and employers, but they also renewed calls from the tech industry for the U.S. Congress to override the new state law that lets consumers know, and in some cases control, what information companies collect about them.
"Actions taken by the Legislature this year will improve the California Consumer Privacy Act, but many clarifications are still necessary before it will work for consumers and businesses," Courtney Jensen, Technet's executive director for California, said in a statement. "The importance of federal action to avoid a patchwork of privacy laws has never been clearer, and we urge Congress to act."
The amendments do not reflect the broadest changes sought by both advocates and critics of the California Consumer Privacy Act, or CCPA. There will be no private right of action. There are no mass exemptions.
"The most significant thing about CCPA amendments is actually that very few changes will take place," said Lydia de la Torre, of counsel at Squire Patton Boggs. "Most bills were defeated and the changes are modest."
The clock is ticking, however, for employers to comply with the new law.
The Consumer Privacy Act applies to companies with gross revenues of $25 million or more and that receive, sell or share personal information about more than 50,000 Californians or that derive more than half their revenue from selling customer data.
The definition covers employers, too, and the information they collect about job applicants and workers. Amendments sent to the governor, however, give employers a one-year exemption from requirements that they disclose that information upon request. The delay is designed to give labor groups, privacy advocates and business association time to hammer out a compromise about what data employers need to share with their workers.
"Everyone is going to have to sit down with their counsel and say, 'OK, does this exempt me?'" said Philip Recht, partner in charge of Mayer Brown's Los Angeles office. "If they conclude that they are covered to some extent, they have to decide how they're going to comply from a mechanical, operational perspective."
If the law is not amended in 2020 to extend the exemption or permanently change the workplace provisions, employers should "get ready for access requests from current and former employees, which tend to be complicated and time consuming," de la Torre said. "A pitfall to avoid is long retention periods especially for unstructured data" such as emails, she said.
Draft regulations that may also offer more compliance guidance to employers are due from Attorney General Xavier Becerra this fall.
Becerra's office earlier this year asked for public comments on a wide range of Consumer Privacy Act topics, including possible exemptions from the law and requirements for complying with requests for data. The attorney general will begin enforcing the new law in July.
Here are other key Consumer Privacy Act bills sent to the governor:
>>> AB 1355 creates a one-year exemption shielding business-to-business communications and transactions from certain disclosure provisions. The bill also authorizes the attorney general to decide what constitutes a "verifiable consumer request" for information in an attempt to ensure that personal data does not fall into the wrong hands.
>>> AB 1146 allows a business to keep customers personal information if that data is necessary to provide a warranty or product recall information.
>>> AB 874 clarifies that the definition of personal information under the Consumer Privacy Act does not include "deidentified" or aggregate consumer data. The measure adds business-sought language clarifying that personal information must be "reasonably capable" of being associated with a particular consumer or household, as opposed to just "capable," to be subject to the law's disclosure requirements.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllPre/Dicta Expands Litigation Analytics Platform to California, Its First Venture Into State Courts
3 minute readCalifornia Planning Certification Program for Privacy Law Specialists
3 minute readTrending Stories
- 1Infant Formula Judge Sanctions Kirkland's Jim Hurst: 'Overtly Crossed the Lines'
- 2Election 2024: Nationwide Judicial Races and Ballot Measures to Watch
- 3Guarantees Are Back, Whether Law Firms Want to Talk About Them or Not
- 4How I Made Practice Group Chair: 'If You Love What You Do and Put the Time and Effort Into It, You Will Excel,' Says Lisa Saul of Forde & O'Meara
- 5Abbott, Mead Johnson Win Defense Verdict Over Preemie Infant Formula
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250