The passage of Prop 24, the California Privacy Rights Act of 2020 (“CPRA”), has caused a bit of confusion among businesses in California.  The confusion stems from the fact that the CPRA has an effective date of January 1, 2023, amending the existing California Consumer Privacy Act (CCPA) when it takes effect, but also immediately extending the current limited exemptions under the CCPA for employment-related data, also to January 1, 2023. (Without the CPRA, the limited exemptions would have already expired.)_ It appears that this labyrinth of amendments, extensions, and exemptions has misled some businesses subject to CCPA (the rules for which will change a little under the CPRA) into believing that they are completely exempt from privacy obligations until 2023 with respect to job applicants, employees, owners, directors, officers, medical staff, and contractors (collectively “employees and applicants”).  This is not the case!  In short, businesses have existing obligations under the CCPA concerning the personal information of their employees and applicants, which became effective on January 1, 2020.

To understand the current employment-related obligations of businesses in California, a brief history lesson is needed.  The CCPA was signed into law in 2018 by then Governor Jerry Brown.  Immediately, it became clear that there were major problems with the law, including, but not limited to, the definition of “consumer” (the second C in CCPA), which is defined to be any resident of California.  Lawmakers recognized the potential issues that would come from granting employment-related data subjects (i.e., job applicants, employees, independent contractors) all the rights a traditional consumer would have under the CCPA.  Thus, the California State Assembly introduced AB25, which originally tried to completely exempt business from having to comply with the CCPA for employees and applicants.

Unfortunately for employers, AB25 was amended in the State Senate and the version that was eventually passed and signed into law by Governor Gavin Newsom in October 2019 (just weeks before the CCPA became effective) exempted businesses in their role as employers from most but not all of the CCPA’s requirements with respect to employment-related data (i.e., limited exemptions mentioned above).

Under the CCPA (as amended by AB25), employers have the following current obligations:

  • Provide notices to employment-related data subjects (job applicants, employees, owners, directors, officers, medical staff, and contractors) of the categories of personal information being collected and the purposes for which the personal information will be used
  • Implement “reasonable security” over certain categories of personal information to avoid a private right of action following a data breach. To this end, it may be prudent to review and augment vendor contracts to ensure that employment-related personal information is handled properly.

Companies should continue to monitor CCPA/CPRA developments, and ensure their privacy programs and procedures remain aligned with current compliance requirements.

 

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Sean Paisan Sean Paisan

Sean Paisan is of counsel in the Orange County, California, office of Jackson Lewis P.C. He is the leader of the firm’s Cal/OSHA practice subgroup and co-leader of the firm’s Construction industry group. His practice focuses on assisting employers with Cal/OSHA compliance, investigations…

Sean Paisan is of counsel in the Orange County, California, office of Jackson Lewis P.C. He is the leader of the firm’s Cal/OSHA practice subgroup and co-leader of the firm’s Construction industry group. His practice focuses on assisting employers with Cal/OSHA compliance, investigations, and fighting citations. Additionally, Sean also assists employers in data privacy and traditional employment matters, including litigation and counseling.

Sean’s first exposure to OSHA regulations occurred during his undergraduate studies while working for a construction company that helped build Disney’s California Adventure. After attending law school and working for the Los Angeles County District Attorney’s Office and the United States Attorney’s Office, Sean moved into private practice, where he focused on general liability matters, including serious injuries and fatalities. Through this experience, Sean became very knowledgeable on the myriad of Cal/OSHA regulations imposed on businesses, especially in the construction, manufacturing, and healthcare industries, and the consequences for violations of those regulations. From there, Sean became OSHA 30 certified and began assisting employers with all workplace safety matters, from compliance, to investigations and inspections, to the appeals of citations in California, Arizona, Washington, and Hawaii.

Throughout his career, Sean has been called upon to try cases that cannot be settled. He has handled trials in the United States District Court, California Superior Court, Cal/OSHA Appeals Board, Workers Compensation Appeals Board, and the US Department of Labor OALJ, as well as binding arbitrations. Sean has tried cases involving the following subjects: general employment, wrongful death, premises liability, unfair competition (B&P § 17200), false advertising (Lanham Act), misappropriation of trade secret, restrictive covenants, and whistleblower (AIR21).

In addition to his trial experience, he is routinely called on to assist his clients with workplace crises such as catastrophic injuries, fatalities, data breaches, and ransomware incidents. Drawing on his years of in both civil and criminal law, Sean’s unique background allows him to anticipate and proactively manage issues, rather than simply reacting to requests and inquiries by investigating agencies such as law enforcement, OSHA, Cal/OSHA, California Bureau of Investigations (BOI), Federal Aviation Administration (FAA), National Transportation Safety Board (NTSB), as well as opposing counsel in litigation matters.

In addition to his litigation experience, Sean has earned the CIPP/US credential through the International Association of Privacy Professionals (IAPP). He helps organizations manage rapidly evolving privacy threats and mitigate the potential loss and misuse of information assets. He has an in-depth understanding of how privacy laws can impact business operations. These laws include the Health Insurance Portability and Accountability Act (HIPAA), Federal Trade Commission Act (FTC Act), Health Information Technology for Economic and Clinical Health Act (HITECH), Genetic Information Nondiscrimination Act (GINA), Fair Credit Reporting Act (FCRA), Gramm-Leach-Bliley Act (GLBA), Fair and Accurate Credit Transaction Act (FACTA), Dodd-Frank Wall Street Reform and Consumer Protection Act, California Financial Information Privacy Act, Family Educational Rights and Privacy Act (FERPA), Telemarketing Sales Rule, Telephone Consumer Protection Act (TCPA), Junk Fax Prevention Act, Controlling Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), Cable Communications Policy Act, Video Privacy Protection Act, Children’s Online Privacy Protection Act (COPPA), California Online Privacy Protection Act (CalOPPA), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). With respect to laws affecting the ability of the government to obtain information, Sean can assist employers in understanding their obligations under the Federal Wiretap Act, Electronic Communications Privacy Act (ECPA), Communications Assistance for Law Enforcement Act (CALEA), Right to Financial Privacy Act, Privacy Protection Act, Foreign Intelligence Surveillance Act (FISA), and USA PATRIOT Act.

Before becoming an attorney, Sean earned his bachelor’s degree in accounting from the University of Southern California, where he also played varsity ice hockey in the ACHA. When not practicing law, Sean enjoys spending time with his wife and three young children, playing adult league ice hockey, mountain biking, and motorsports.