Page 9 - SMRH Eye on Privacy 2019 Year in Review Brochure

What To Do About Employees Under CCPA: An Update
Posted on September 19, 2019
One of the amendments we’ve been watching over the past months is one that impacts rights of employees — both the company’s and other company’s employees. Under AB25, which passed the California Senate and is now awaiting governor signature, companies will be (for a year) exempted from providing current and former employees, job applicants, and contractors with the full suite of CCPA rights. Starting January 2020, however, these individuals must be provided with notice of information use. Access and deletion rights will not go into effect until January 2021. A related bill, AB 1355, also recently passed the California Senate, and impacts individuals who are “acting as an employee, owner, director, officer, or contractor” of another company, if the communications with that person “occurs solely within the context of the business.” Under this bill, the majority of the rights contemplated under CCPA would not apply to these individuals until January 2021.
PUTTING IT INTO PRACTICE: We will continue to monitor these developments, but if these changes become law, then companies will need to provide their own employees with notice beginning in January, and other companies’ employees notice in January 2021. All within these categories would also need access and deletion rights as contemplated under CCPA beginning in January 2021.
Like a Butterfly, Will the CCPA Continue to Evolve?
Posted on May 28, 2019
California legislators have passed many bills to amend the California Consumer Protection Act since the law was passed. Last week there was significant developments in the status of those bills, as we reported. In addition to dropping the concept of a private right of action for non-breach matters, there are other key things to keep in mind. Some are good news for corporations, but some pending bills that would have helped clarify the law are not moving forward. On the pro-business side, employers and businesses that focus on handling employee data will be happy to learn of the revised definition to consumers. On the pro-consumer side, however, a bill was withdrawn that would have allowed the sharing of unique consumer identifiers for marketing purposes without being considered a “sale,” drawing a chorus of “shucks” from businesses alike. Keep reading for the details.
First, a bill that would specifically exclude employees from the definition of “consumers” (AB 25) has been approved by the committee and is now before the full Assembly. Second, a bill that would narrow the definition of personal information (AB 873) is also moving forward. That bill changes narrows the definition to anything “reasonably capable of being associated with...a particular consumer or household” instead of just “capable of being associated with” a consumer or household. Third, a bill expanding the definition of “deidentified” (as opposed to personal information which does identify a person) is moving forward (AB 873). As proposed, “deidentified” would mean information “that does not identify and is not reasonably linkable, directly or indirectly, to a particular consumer” provided related technical and administrative controls are in place. And Fourth, a bill that would eliminate times when the public records exception would apply (AB 874). In short, this would increase the number of situations where a business would not have to comply with CCPA because the data at issue is exempt from the Act.
Five additional bills, which are aimed at correcting more minor issues, are also progressing through the legislative process: (1) addressing drafting errors (AB 1355); (2) giving more methods to receive consumer requests (AB 1564); (3) allowing motor vehicle information to be shared for warranty or repair purposes without being subject to consumer requests (AB 1146); (4) removing certain consumer rights where necessary to complete a transaction initiated by the insurer (AB 981); and (5) explaining that customer loyalty programs are exempt from the Act’s anti-discrimination provisions (AB 846).
Eye on Privacy 2019 Year in Review 8