Publications

Is your company covered by California's new privacy law?

November 22, 2019 Articles
North Bay Business Journal

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a consumer-friendly privacy law inspired by the European Union’s General Data Protection Regulation, will take effect.

The CCPA is aimed towards bolstering consumers’ privacy rights by instituting notice, retention, security, and other requirements related to collecting consumers’ “personal information,” defined broadly to include “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

For example, the CCPA potentially governs information collected from consumers for mailing and marketing lists, billing, satisfaction surveys, and other purposes.

Is your company covered?

To fall within the CCPA’s coverage, a for-profit business must meet only one of the following criteria: (1) annual gross revenues exceeding $25 million; (2) annual purchase, receipt for the business’s commercial purposes, sale, or sharing for commercial purposes, alone or in combination, of the personal information of 50,000 or more consumers, households, or devices; or (3) 50% or more of annual revenues derived from selling consumers’ personal information.

Any business (including a nonprofit) that does not directly meet one of the above-listed criteria may still be covered if it (1) controls or is controlled by, and (2) shares common branding with, a company meeting one of the above criteria.

Data collection notice requirements

The CCPA requires the disclosure of various information about data collection. Most notably, it calls for covered entities to notify consumers of “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.” This information must be provided “at or before the point of collection.”

For example, covered entities that collect consumer information (such as names and contact information) for mailing or marketing lists must, at or before the time the information is collected, explain to consumers what information it is collecting and how it will be used. If the entity wants to later use that information for a previously undisclosed purpose, the entity must notify affected consumers of the new purpose.

In addition to notice regarding the information collected, the CCPA also requires the disclosure of a consumer’s rights to (1) request disclosure of the personal information collected; (2) opt-out from the sale of the data; (3) request that data be deleted; (4) non-discrimination for the exercise of privacy rights; and (5) use an authorized agent to make privacy-related requests of the covered entity.

For information collected through the entity’s website, CCPA-required disclosures would be provided in the entity’s website privacy policy. It is therefore critical that companies evaluate and update their posted privacy policies prior to the new year.

Liability for security breaches

The CCPA establishes liability for certain security breaches involving the “unauthorized access and exfiltration, theft, or disclosure” of consumers’ personal information. In the event of a covered breach, each affected individual can recover between $100 and $750 in statutory damages.

Thus, damages can add up pretty quickly in class action lawsuits. The breach must result from “the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.”

The CCPA does not define “reasonable security procedure and policies,” but California’s attorney general provided some guidance in its February 2016 California Data Breach Report. Thus, covered entities should review their information security policies and practices to reduce the risk of a breach.

Application to employment-related data

Although the CCPA is expressly directed at consumer privacy, it also has implications for employment-related data.

“Personal information” may encompass many categories of data collected from employees, applicants, or other personnel, such as contact information; Social Security numbers; education and employment history; bank and financial information; medical, insurance, or benefits information; family and dependent information; photographs or recordings; and internet or computer activity records.

Assembly Bill 25 delays most of the CCPA’s application to employment-related data until Jan. 1, 2021. However, on Jan. 1, 2020, two provisions relating to such data will take effect for covered employers: (1) data collection notice requirements and (2) liability for security breaches.

Thus, covered employers may want to (1) review all online and hard-copy forms used to collect personal information, such as employment applications, new hire paperwork, and benefits enrollment materials, to ensure they provide CCPA-compliant notice; (2) develop a general privacy notice for new hires explaining what categories of data will be collected during their employment and how the data will be used; (3) review and update internal policies concerning the collection and use of personal information; and (4) train employees regarding CCPA requirements.

And, as with all covered entities, employers should carefully review their information security policies and procedures, and coordinate with their IT and HR departments, to reduce the risk of a security breach.

California Consumer Privacy Act full text, here.

Firm Highlights

Publication

Navigating California's Workplace Violence Prevention Law

California has introduced a new requirement compelling most employers to implement a workplace violence prevention policy by July 1, 2024. The implications of this law are significant, prompting the need for human resource executives...

Read More
Publication

Employment Law Update for Nonprofits With Holly Sutton

Welcome to  EO Radio Show - Your Nonprofit Legal Resource . Charities, foundations, and their founders often request help addressing employment practices and compliance questions. In this episode, host Cynthia Rowland is joined by Holly...

Read More
Publication

Important Changes and the Impact of California Industry-Specific Minimum Wage Laws

In the ever-evolving landscape of California labor laws, the minimum wage has once again taken center stage. With the recent state-wide increase to $16 per hour, the Golden State continues to lead the nation...

Read More
News

Farella Braun + Martel Welcomes Benjamin Buchwalter to Growing Employment Group

Read More
Publication

Navigating California's New Rebuttable Presumption Law

The ever-evolving landscape of employment laws in California has introduced a notable change with the implementation of a new law that establishes a rebuttable presumption of retaliation in some circumstances. This law, which took...

Read More
Publication

Employment Law Symposium Recordings & Articles

Employers Face Significant New Requirements for Severance Agreements and Non-Competes  (Recording) Conducting Effective, Defensible Investigations (With Lessons Learned from Summary Judgment & Trial)  (Recording) California Employment Law Updates: What to Look Out for in...

Read More
Publication

Navigating California's Evolving Legal Landscape Governing Leaves of Absence

California’s employment laws are no stranger to change, and recent years have witnessed the introduction or modification of various protected leaves by employees. In this article, we will delve into three significant leave categories...

Read More
News

Ripple Effects of the Supreme Court’s 2023 Decision on Affirmative Action

Kelly Matayoshi was quoted in the article "Ripple Effects of the Supreme Court’s 2023 Decision on Affirmative Action" in the Bar Association of San Francisco's fall issue of  San Francisco Attorney Magazine . Read...

Read More
Publication

Navigating Cannabis in the Workplace: A Guide for California Corporations

The landscape surrounding cannabis in the workplace is rapidly evolving, posing challenges for California corporations and businesses to establish effective policies and procedures. As the use of cannabis, both medical and recreational, becomes more...

Read More
News

Farella Braun + Martel Earns 2024 Best Law Firms® Rankings

Read More