Impact of California Consumer Privacy Act (CCPA) on Employee Data

The California Consumer Privacy Act (“CCPA”) takes effect on January 1, 2020 and imposes a wide range of new requirements for the collection and processing of personal data of California residents. Under the CCPA, “consumer” is defined broadly as a natural person who is a California resident. Assembly Bill 25 (“AB 25”), signed into law on October 11, 2019, provides a temporary and limited reprieve for employee data by establishing an exemption to the CCPA’s requirements to provide rights of access, correction and opt-out of sale of personal information for California residents who are job applicants, employees, owners, directors, officers, medical staff or contractors (collectively, “employees”). The exemption applies only to the extent that an employee’s personal information is collected and used solely within the context of such individual’s role as an employee and only until December 31, 2020.

Even with this exemption, the following two CCPA requirements apply as of January 1, 2020:

  • At or before the point of collection of any personal information, companies must notify California resident employees of (i) the categories of their personal information collected, and (ii) the purposes for which such personal information will be used (see Section 1798.100(b)). With respect to (i), collection of new categories of personal information requires a new, revised notice to be provided to the employee. With regard to (ii), companies may not use personal information for any additional purpose not specified in the initial notice without first disclosing such use to the employee and obtaining the employee’s express consent to such additional use.
  • California resident employees have a private right of action if their non-encrypted or non-redacted personal information is affected by a data breach via unauthorized access and exfiltration, theft, or disclosure, where the breach is caused by a company’s failure to implement and maintain reasonable security procedures (see Section 1798.150).

Companies with employees in California will need to adopt procedures to provide a CCPA-compliant privacy notice to such employees on January 1, 2020, with a look back to January 1, 2019 – i.e., companies must disclose how they collected and used employee information in 2019. Such notices will need to be broad enough to capture all of the specific categories of data that companies need to collect with regard to the employment relationship and all applicable compensation and benefits arrangements. For example, to the extent that companies are granting equity awards to California resident employees, such privacy notices will need to include any specific categories of employee personal information needed to make and administer such grants. Because the notice must be provided “at or before” the point of collection of the data, it will generally need to be provided in advance of the issuance of equity awards or other benefits. However, companies should include in equity award agreements or other compensation and benefits plan agreements an acknowledgment that employees have received the privacy notice required by CCPA.

As noted, the limited exemption under AB25 will be valid for only one year and expires on January 1, 2021. After the expiration of the exemption, companies will be subject to the full requirements of the CCPA with respect to employee data. For details on the full scope of the CCPA, please refer to the following alert published by our partner Lothar Determann.

Victor Flores is a partner in Baker McKenzie’s Employment & Compensation Practice, with a focus on Executive Compensation and Employee Benefits. Victor advises global US and non-US companies – both public and private – on all aspects of executive compensation and benefits matters, including the corporate, securities and tax law, and ERISA issues arising in the implementation and administration of compensation programs. He regularly helps clients with the design and implementation of equity and non-equity based incentive compensation programs and nonqualified deferred compensation programs. Victor also has extensive experience advising on compensations and benefits issues in mergers and acquisitions, corporate reorganizations, private equity and other corporate transactions.
Sinead Kelly is a partner in Baker McKenzie’s Compensation practice in San Francisco. She advises on U.S. executive compensation and global equity and has practiced in the compensation field since 2005. In her practice, Sinead counsels U.S. and non-U.S. public and private companies on all aspects of equity and executive compensation plans and arrangements, including plan design, drafting, administration and governance. In this regard, Sinead advises on and assists companies with compliance with U.S. federal and state securities and tax laws relating to compensation arrangements, as well as with preparing SEC disclosures, complying with stock exchange rules and addressing non-U.S. tax and regulatory requirements. She has been repeatedly recognized by Legal 500 as a leading lawyer for Executive Compensation and Employee Benefits.
Christine Pao is an associate in the North America Executive Compensation and Employee Benefits Practice Group. She routinely advises companies - both public and private - on various executive compensation and employee benefits matters. Christine focuses her practice on executive compensation and benefit plans, including non-qualified deferred compensation plans, employee stock purchase plans, and other executive compensation arrangements. She has experience advising on compensation and benefits issues that arise in mergers and acquisitions. She also advises on the corporate, tax, and securities law issues surrounding the design, implementation, and administration of equity and non-equity based compensation programs.
Chetan Gupta is an associate in Baker McKenzie's Employment Practice Group in Palo Alto. Prior to joining the Firm in 2016, Chetan served as a law clerk for the Hon. Justice Arijit Pasayat of the Supreme Court of India. Chetan advises clients on a wide range of domestic and cross-border employment-related matters. He routinely assists US multinationals with employment aspects of entering and doing business in new jurisdictions across the globe, including pre-hire matters, engagement of independent contractors, employee transfer, workplace policies and global code of conduct implementation, data privacy compliance, whistleblower policy and hotline implementation, confidential and proprietary information and non-compete agreements, and planning and implementing reductions in force and performance terminations.