Insights
Publications

Is your company covered by California's new privacy law?

November 22, 2019 Articles
North Bay Business Journal

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a consumer-friendly privacy law inspired by the European Union’s General Data Protection Regulation, will take effect.

The CCPA is aimed towards bolstering consumers’ privacy rights by instituting notice, retention, security, and other requirements related to collecting consumers’ “personal information,” defined broadly to include “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

For example, the CCPA potentially governs information collected from consumers for mailing and marketing lists, billing, satisfaction surveys, and other purposes.

Is your company covered?

To fall within the CCPA’s coverage, a for-profit business must meet only one of the following criteria: (1) annual gross revenues exceeding $25 million; (2) annual purchase, receipt for the business’s commercial purposes, sale, or sharing for commercial purposes, alone or in combination, of the personal information of 50,000 or more consumers, households, or devices; or (3) 50% or more of annual revenues derived from selling consumers’ personal information.

Any business (including a nonprofit) that does not directly meet one of the above-listed criteria may still be covered if it (1) controls or is controlled by, and (2) shares common branding with, a company meeting one of the above criteria.

Data collection notice requirements

The CCPA requires the disclosure of various information about data collection. Most notably, it calls for covered entities to notify consumers of “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.” This information must be provided “at or before the point of collection.”

For example, covered entities that collect consumer information (such as names and contact information) for mailing or marketing lists must, at or before the time the information is collected, explain to consumers what information it is collecting and how it will be used. If the entity wants to later use that information for a previously undisclosed purpose, the entity must notify affected consumers of the new purpose.

In addition to notice regarding the information collected, the CCPA also requires the disclosure of a consumer’s rights to (1) request disclosure of the personal information collected; (2) opt-out from the sale of the data; (3) request that data be deleted; (4) non-discrimination for the exercise of privacy rights; and (5) use an authorized agent to make privacy-related requests of the covered entity.

For information collected through the entity’s website, CCPA-required disclosures would be provided in the entity’s website privacy policy. It is therefore critical that companies evaluate and update their posted privacy policies prior to the new year.

Liability for security breaches

The CCPA establishes liability for certain security breaches involving the “unauthorized access and exfiltration, theft, or disclosure” of consumers’ personal information. In the event of a covered breach, each affected individual can recover between $100 and $750 in statutory damages.

Thus, damages can add up pretty quickly in class action lawsuits. The breach must result from “the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.”

The CCPA does not define “reasonable security procedure and policies,” but California’s attorney general provided some guidance in its February 2016 California Data Breach Report. Thus, covered entities should review their information security policies and practices to reduce the risk of a breach.

Application to employment-related data

Although the CCPA is expressly directed at consumer privacy, it also has implications for employment-related data.

“Personal information” may encompass many categories of data collected from employees, applicants, or other personnel, such as contact information; Social Security numbers; education and employment history; bank and financial information; medical, insurance, or benefits information; family and dependent information; photographs or recordings; and internet or computer activity records.

Assembly Bill 25 delays most of the CCPA’s application to employment-related data until Jan. 1, 2021. However, on Jan. 1, 2020, two provisions relating to such data will take effect for covered employers: (1) data collection notice requirements and (2) liability for security breaches.

Thus, covered employers may want to (1) review all online and hard-copy forms used to collect personal information, such as employment applications, new hire paperwork, and benefits enrollment materials, to ensure they provide CCPA-compliant notice; (2) develop a general privacy notice for new hires explaining what categories of data will be collected during their employment and how the data will be used; (3) review and update internal policies concerning the collection and use of personal information; and (4) train employees regarding CCPA requirements.

And, as with all covered entities, employers should carefully review their information security policies and procedures, and coordinate with their IT and HR departments, to reduce the risk of a security breach.

Firm Highlights

Publication

New California Crown Act Reminds Employers to Carefully Consider Workplace Dress and Grooming Policies

California Governor Gavin Newsom has signed into law the nation’s first bill banning discrimination based on an employee’s hairstyle. Senate Bill 188, otherwise known as the Crown Act, expanded the definition of race under...

Read More
Publication

California's AB5 Codifies Stricter Rules for Independent Contractors - What Employers Need to Know

On September 18, 2019, California Governor Gavin Newsom signed into law AB5, codifying the ABC test for distinguishing employees from independent contractors and expanding its application beyond California’s Wage Orders. While AB5 does not...

Read More
Publication

California Employers Granted a One-Year Reprieve on New Mandatory Sexual Harassment Training Deadline

If you are scrambling to comply with the new California sexual harassment training requirements, we have some good news: with some exceptions, employers have another year to put those plans in place. Under prior law...

Read More
News

Farella Braun + Martel Ranked Among “Best Law Firms” by U.S. News & World Report and Best Lawyers

Read More
Publication

California's AB5 Codifies Stricter Rules for Independent Contractors - What Wine Industry Employers Need to Know

California Governor Gavin Newsom has signed into law AB5, codifying a new test for distinguishing employees from independent contractors. While AB5 does not go into effect until January 1, 2020, it will apply retroactively...

Read More
News

Kelly Matayoshi Installed as President of UC Hastings College of the Law Alumni Association Board of Governors

Read More
Publication

What Employers Should Know About the California Consumer Privacy Act Taking Effect January 1, 2020

On January 1, 2020, the California Consumer Privacy Act (CCPA), a consumer-friendly privacy law inspired by the European Union’s General Data Protection Regulation, is set to take effect. The CCPA is aimed towards bolstering...

Read More
Publication

California’s New Ban on Mandatory Employment Arbitration: How We Got Here and What This Means

All employers should be aware that their use of mandatory employment arbitration agreements is prohibited in California effective January 1, 2020 under recently signed Assembly Bill No. 51 (AB 51). Under current California law...

Read More
Publication

In the Weeds: Marijuana Legalization & Employment Laws

Over the last several years, attitudes towards marijuana use have rapidly changed in the United States. According to a 2018 Pew Research Survey, 62 percent of U.S. respondents said marijuana use should be legal...

Read More
News

Benchmark California 2020 Ranks Farella Among Top Litigation Firms

Doug Young named among Top 20 Trial Lawyers in California SAN FRANCISCO, October 16, 2019: Farella Braun + Martel continues to be ranked among the top litigation firms by Benchmark California 2020, a guide...

Read More