New Legislation Gives Employers a One-Year Limited Exclusion
Privacy and the protection of personal data ― which are of paramount concern to all ― led to the enactment of the California Consumer Privacy Act (CCPA) in 2018. Although CCPA becomes effective in 2020, state lawmakers have been working on several bills this year to clarify and improve the Act. Most relevant for employers, Assembly Bill 25 (AB 25) generally provides a one-year exemption from the CCPA for transactions and records within the context of employment. AB 25 was passed by the legislature as of September 13, 2019, and is expected to be signed by the governor shortly.
In brief, the CCPA created new rights for California residents to be informed of the collection of their personal information; to gain access to their personal information that has been collected by a business; to have such information deleted and to opt out of the sale of their personal information.
However, in testimony received by the California Attorney General's office in preparation for rulemaking, concerns were expressed over the definitions of "sale," "personal information," and "consumer." Commentators noted that it was not clear how employment records would be regulated by the CCPA.
For example, one of the rights provided by the CCPA to consumers is the ability to opt out of the "sale" of their personal data. The CCPA defines "sale" broadly to include the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to another business or third party for monetary or other consideration. As a result, many of the instances when employers provide personal data to a service provider or vendor in support of the employment relationship could be considered a sale, and employers may have to manage opt-out requests by employees as well as provide specific disclosures to its employees. Consequently, the right of a consumer to opt out of any such "sale" could impact routine business operations, including wage payments and the administration of employee benefits, and affect other employer activities that would not ordinarily be considered as a "sale" of personal data.
Similarly, the CCPA right to request that personal information be deleted could conflict with existing federal and state laws. For example, the California Labor Code requires employers to maintain detailed records reflecting virtually all activity with respect to employment, from hiring to enrollment in employee benefits; documentation of hours worked, wages earned, deductions from pay, and many other related matters. The CCPA right to request deletion does not apply if it would conflict with existing law. The problem is some employers may not be aware of this. An employer may receive requests to delete employment records, and it would be very problematic if an employer actually deleted the personal data of its employees in a way that affected the accuracy of legally required employer records.
In reaction to the concerns raised, AB 25 was enacted to provide a one-year delay in the application of most of the requirements of CCPA, including the key area of employment records. Lawmakers, businesses and other stakeholders intend to use this one-year period to draft new legislation that specifically addresses employee data privacy.
Background: Which Businesses Are Subject to the CCPA?
The California Consumer Privacy Act applies to for-profit organizations that collect or possess personal information related to California residents; and:
- Have annual gross revenues over $25,000,000; or
- Annually buy, receive, sell or share for commercial purposes, alone or in combination, the personal information of 50,000 or more California consumers, households or devices; or
- Derive 50 percent or more of its annual revenues from selling consumers' personal information.
Advocates note that even small businesses may qualify under these thresholds. For example, a small store that is open just 12 hours per day would meet the 50,000 records measure if they have an average of more than 12 transactions per hour.
Action Required: Key CCPA Disclosure Requirement Continues to Apply to Employers Beginning January 1, 2020
According to Section 1798.100(b) of the CCPA: Employers must still comply with the CCPA requirement that employers notify employees, at or before the time of collection, of the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.
There is no specific mandate regarding how an employer must provide this information to its employees. Apparently, it could be satisfied in various ways; e.g., email, employee handbook, employee portal posting, etc. However, it may be advisable to be able to confirm and demonstrate that each employee received such information. The initial disclosure may need to be furnished to employees, job applicants and others by January 2020.
ADP is seeking clarification of the intended content and format of such a notice, and will advise clients on approaches that would satisfy the CCPA.
For details, see AB 25, also found at http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB25
ADP Compliance Resources
ADP maintains a staff of dedicated professionals who carefully monitor federal and state legislative and regulatory measures affecting employment-related human resource, payroll, tax and benefits administration, and help ensure that ADP systems are updated as relevant laws evolve. For the latest on how federal and state tax law changes may impact your business, visit the ADP Eye on Washington Web page located at www.adp.com/regulatorynews.
ADP is committed to assisting businesses with increased compliance requirements resulting from rapidly evolving legislation. Our goal is to help minimize your administrative burden across the entire spectrum of employment-related payroll, tax, HR and benefits, so that you can focus on running your business. This information is provided as a courtesy to assist in your understanding of the impact of certain regulatory requirements and should not be construed as tax or legal advice. Such information is by nature subject to revision and may not be the most current information available. ADP encourages readers to consult with appropriate legal and/or tax advisors. Please be advised that calls to and from ADP may be monitored or recorded.
If you have any questions regarding our services, please call 855-466-0790.
ADP, LLC.
One ADP Boulevard,
Roseland, NJ 07068
Updated on September 18, 2018
