California: New Bill Provides Employers Relief from California Consumer Privacy Act Requirements

Governor Newsom signed AB 25 into law, limiting the scope of the California Consumer Privacy Act (CCPA) as it applies to employers.  The bill imposes the limitations from the date the CCPA goes into effect on January 1, 2020, although such limitations are not permanent and will automatically terminate the following year, barring any legislative action.

How Does AB 25 Effect the CCPA?

The CCPA protects a resident of California’s personal information, defined as any individually identifiable information.  AB 25 excludes the following categories of information from the CCPA scope:

• HR Data – personal information of a CA resident in their capacity as a “Workforce Member,” meaning job applicants, employees, independent contractors, corporate officers and directors, individuals with a majority ownership in a business, and certain health care professionals
• Emergency Contacts – personal information indicated as a Workforce Member’s emergency contact
• Third-Party Benefits Information – personal information used to administer benefits for a California resident or their spouses and dependents

What are Employers Still Responsible for?

In spite of these limitations, employers will still need to comply with the CCPA in other areas.  California residents can seek recovery for information security breaches.  Employers must still comply with the CCPA’s notice requirement, and must inform Workforce Members as to what types of personal information are to be collected, or what purpose, and if previously collected personal information is used for any previously undisclosed purpose.  Lastly, personal information collected by employers from individuals who are not Workforce Members, or in a different capacity than Workforce Members (e.g., an employee who purchases goods from the company and is therefore also a customer), is still subject to CCPA compliance requirements.

Who is Covered by the CCPA?

The CCPA applies to companies that meet the following thresholds:

1. annual gross revenues exceeding $25 million;
2. annual purchase, receipt for the business’s commercial purposes, sale, or sharing for commercial purposes, alone or in combination, of the personal information of 50,000 or more consumers, households, or devices; or
3. 50 percent or more of annual revenues derived from selling consumers’ personal information.

Companies that control or are controlled by, or share common branding with, a company that meets the above thresholds may also be subject to the CCPA.

Action Items