Compliance With the California Consumer Privacy Act in the Workplace: What Employers Need to Know

• Jurisdiction: California,United States
• Citation: Vol. 29 No. 2
• Publication year: 2019
• Author: By Lydia F. de la Torre and Lauren Kitces
• topic: Employment Law

COMPLIANCE WITH THE CALIFORNIA CONSUMER PRIVACY ACT IN THE WORKPLACE: WHAT EMPLOYERS NEED TO KNOW

By Lydia F. de la Torre and Lauren Kitces¹

I. INTRODUCTION

The California Consumer Privacy Act (CCPA) represents a quantum leap in consumer privacy and a major change in the regulatory framework applicable to companies doing business in California. The CCPA goes into effect on January 1, 2020, and imposes limits on the collection and sale of personal information by organizations that meet certain thresholds ('businesses') and provides certain individuals ('consumers') with four different rights and asserts an obligation on businesses: the right to opt-out of data sales (opt-in for minors), the right to delete, the right to know, the right to not be discriminated against for exercising any of the preceding rights and the obligation to inform. While the law contains certain limitations, at its core, it is based on the idea that consumers should have transparency regarding the use of their personal information, and control over aspects of its use.

The CCPA regulates the processing of data of 'consumers' and defines consumer to mean: (i) a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section reads on September 1, 2017, (ii) 'however identified, including by any unique identifier'.² The term 'resident,' as defined in the law, includes (1) every individual who is in the State for a reason other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State and is outside the State for a temporary or transitory purpose.³ Accordingly, the CCPA applies to employee data, contractor data, applicant data, and the data of company officers and directors who are residents of California.

The core of the CCPA is the broad definition of 'personal information.'⁴ Due to this expansive definition, employers should assume that any information they might collect and keep on any California resident who applies to work, works, or has worked for them is subject to the CCPA.

[Page 96]

Guidance on the applicability of the CCPA in the workplace context will evolve as the Office of the Attorney General of California ('Attorney General') promulgates rules during 2020 and beyond. The CCPA requires rulemaking to be issued on specific topics, and also empowers the Attorney General to issue rules and provide guidance to address any aspect of the CCPA.⁵ Public forums were held January through March of 2019. A notice of Proposed Regulatory Action ('Notice') is expected during the fourth quarter of 2019. After that, a new period for comments will open. Final rules are expected mid-2020. On October 2019 the Attorney General filed a notice of proposed rulemaking action⁶ and published a proposed text for the CCPA regulations ("Proposed Rules").⁷ The comment period on the Proposed Rules will be open through December 6, 2019.

This article provides a high-level overview of how the CCPA will impact an employer's privacy obligations under California law and identifies steps that employers should consider taking in order to minimize regulatory risks. The recommendations discussed in this article will not suffice to provide a complete picture of how any given individual organization will be impacted by the CCPA and does not constitute legal advice. It is essential for impacted employers to consult experienced privacy counsel in order to understand their specific exposure to the CCPA and plan accordingly.

II. EMPLOYEE PRIVACY IN CALIFORNIA PRIOR TO THE CCPA

In California, workers⁸ have greater rights of privacy than in many other states. A worker's right of privacy begins with the California Constitution and is bolstered by various laws. In addition to the employee privacy regulations specified in the California Labor Code (cited below), employers have an obligation to comply with all general California privacy laws (i.e., laws that apply outside of the employment area such as the Fair Credit Reporting Act ('FCRA') and the Health Insurance Portability and Accountability Act ('HIPAA')).

Pre-CCPA privacy laws were typically conditioned on the existence of a 'reasonable expectation of privacy' and informing workers through handbooks, log-in scripts, and other means was generally sufficient to dismantle such expectations. Notwithstanding existing statutes, employers could, relatively easy, effectuate a waiver of California workers' privacy rights through unilateral notices disclosing data practices, which effectively meant workers could expect limited privacy in the workplace.

[Page 97]

Additionally, in certain circumstances California employers are expected (or legally required) to take actions that further limit workers' privacy rights. This includes, for example, taking affirmative steps to protect workers from harassment by co-workers, monitoring and enforcing compliance obligations under securities and financial laws, responding to government investigations, and producing evidence in discovery proceedings.

The pre-CCPA California laws specifically relevant to employee privacy include:

• California Labor Code Section 96(k): Prohibiting employers from taking action against employees for lawful conduct that occurs away from the employer's premises during non-working hours.
• California Labor Code Section 138.7(a): Regulating employer's access to worker compensation records.
• California Labor Code Section 226: Generally requiring employers to provide an employee's wage statement, but mandating that only the last four digits of an employee's social security number or identification number be printed on the statement.
• California Labor Code Section 432.2: Restricting the use of polygraphs on employees (similar restrictions exist at the federal level).
• California Labor Code Section 432.7: Including anti-discrimination provisions mandating that employers not consider juvenile criminal records as a factor in hiring, promoting, or terminating (subject to certain restrictions).
• California Labor Code Section 435: Generally prohibiting employers from causing an audio or video recording to be made of an employee in a restroom, locker room, or room designated for workers to change their clothes.
• California Labor Code Section 980: Generally prohibiting employers from demanding passwords and accessing social media accounts of employees and job applicants, except where it is reasonably believed to be relevant to an investigation of misconduct or violation of the law.
• California Labor Code Section 1026: Requiring employers to 'make reasonable efforts' to safeguard the privacy of employees if the employee has enrolled in an alcohol or drug rehabilitation program.
• California Labor Code Section 1198.5: Granting employees the right to expect and receive copies of the personnel records that the employer maintains.
• California Labor Code 6408(d): Allowing access by employees or their representatives to accurate records of employee exposures to potentially toxic materials or harmful physical agents.
• California Civil Code Section 52.7: Prohibiting anyone from requiring, coercing, or compelling any other individual to have an identification device subcutaneously implanted, particularly by conditioning employment, employee benefits, or a promotion when consenting to the implant.
• California Code of Civil Procedure Section 1985.6: Mandating some specific rules that employers must observe when responding to subpoenas for the release of employee records.
• California Fair Employment and Housing Act.⁹ Precluding employers from asking candidates about their age, national ancestry, religion, marital status, sexual orientation, or health conditions (subject to certain exceptions; similar restrictions exist at the federal level).

[Page 98]

The CCPA expands workers' rights in various significant ways that are discussed in Section VIII below.

III. CCPA'S APPLICABILITY TO EMPLOYEE AND CONTRACTOR DATA AND THE WORKER DATA MORATORIUM

Following the enactment of the original version of CCPA in June 2018, the applicability of the CCPA to workers' data was the subject of debate. Reading the plain language of the CCPA, it was clear that the law regulated the personal information of consumers and defined 'consumer' to mean a resident of the State of California, which includes workers. However, a number of arguments were advanced to support the proposition that it was not the intent of the legislature to regulate workers' data.

The reasoning behind this argument centered mainly on the 'common understanding' of the concept of a consumer as an individual who buys products or services for personal use. Following the passage of the CCPA, some organizations lobbied for a narrower definition of 'consumer' that would exclude both employees and contractors. Their efforts eventually resulted in the passage of a moratorium (hereinafter, the 'worker data moratorium') that partially carves out worker data until January 1, 2021. The worker data moratorium was enacted through consolidated bills Assembly Bill 25,¹⁰ Assembly Bill 1355,¹¹ and Assembly Bill 1146.¹² Subsection (h) has been added to Cal. Civ. Code Sec. 1798.145, to state:

'(n) (1) This title shall not apply to any of the following:

(A) Personal information that is collected by a business about a natural person in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the natural person's personal information is collected and used by the business solely within the context of the natural person's role or former role as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or a contractor of that business.
(B) Personal information that is collected by a business that is emergency contact information of the natural person acting as a job applicant to, an employee of, owner of, director of, officer

...