As discussed here, the California Consumer Privacy Act of 2018 (CCPA), in its current state, likely applies to businesses that collect the personal information of their employees. AB 25, which passed in the California Assembly on May 29, 2019, sought to address this issue by removing employees and job applicants from the CCPA’s definition of “consumer.” This amendment was slated to exclude businesses from having to comply with the CCPA if their only connection to the “big data” world is collecting the personal information of employees and job applicants.
Recently, however, AB-25 underwent significant revisions when it made its way to the Senate Judiciary Committee for hearing on July 9, 2019. The bill’s author, Assembly Member Ed Chau, agreed to amend AB-25 before it unanimously passed. The amended version now states that businesses collecting personal information from job applicants, employees, owners, directors, officers, medical staff members or contractors of the business are exempt from the CCPA only until January 1, 2021. Moreover, businesses are not completely off the hook under the one-year exemption. They must still comply with the disclosure obligations under Sections 1798.100, and remain subject to a private right of action under the CCPA if there is a data breach based on a business’s failure to implement and maintain reasonable security procedures and practices.
It remains to be seen if AB-25 will be signed into law in its current iteration. The addition of the sunset clause suggests that this amendment may be a placeholder until proponents on both sides of this issue negotiate legislation that, on the one hand, alleviates the CCPA’s burden on employers who do not collect or sell typical consumer data, and on the other hand, adequately protects employee privacy and information.