As the year winds down, Governor Newsom has signed into law several amendments to the California Consumer Privacy Act (CCPA). Two of the amendments directly impact all companies doing business in California.
Taking effect on January 1, 2020, the CCPA requires subject businesses meeting a certain revenue threshold or other criteria to implement policies and procedures that provide consumers and employees with specific privacy rights previously unavailable under existing law.
The CCPA provides exemptions for some data that is subject to the GLBA Rule and the Fair Credit Reporting Act. However, most of the personal information collected regularly by financial services providers is still subject to the requirements of the CCPA. Based on its’ definition of “personal information,” the CCPA is the broadest protection of personal information in any jurisdiction in the United States.
AB 25, one of the amendments, postpones by one year, until Jan. 1, 2021, all the CCPA’s requirements related to employee data except for the following two:
- Reasonable security measures to safeguard the data.
- Disclosure of the categories of personal information collected about employees and job applicants and the business purposes for which the information is used.
Pursuant to AB 25, a business cannot process “Personal Information” for a purpose not disclosed in the privacy notice. Businesses must ensure that their employee privacy notices are broadly drafted to the extent that they apply to all the ordinary, and extraordinary, purposes to which employee data will be subject.
The second relevant amendment, AB 1355, excludes from coverage of the CCPA, until Jan. 1, 2021, specified business-to-business communications or transactions. With the passage of AB 1355, it is unnecessary for businesses to provide privacy notices to the employees of their clients or their vendors, though they must provide notices to their own employees.
While the California attorney general will not initiate any enforcement procedures under the Act until July 1, 2020, (or six months after the California Attorney General releases the final regulation), the deadline for compliance is just days away. Employers doing business in California must immediately consider and determine whether the CCPA applies to them and if so, take the next necessary steps to ensure compliance.
The attorneys at Glass & Goldberg in California provide high quality, cost-effective legal services and advice for clients in all aspects of commercial compliance, business litigation, and transactional law. Call us at (818) 888-2220, send an email inquiry to info@glassgoldberg.com or visit us online at glassgoldberg.com to learn more about the firm and to sign up for future newsletters.
