The California Consumer Privacy Act (“CCPA”) takes effect on January 1, 2020 and imposes a wide range of new requirements for the collection and processing of personal data of California residents. Under the CCPA, “consumer” is defined broadly as a natural person who is a California resident. Assembly Bill 25 (“AB 25”), signed into law on October 11, 2019, provides a temporary and limited reprieve for employee data by establishing an exemption to the CCPA’s…
Background As most of you are aware, the collection, processing, use and transfer of personal data is regulated and restricted in most countries outside the US. This is especially true for countries in the EU and EEA, where any such action generally requires a valid basis, or risks being illegal. Compliance with EU data privacy requirements can be challenging for US-based multinationals which collect, process and transfer personal data of EU/EEA-based employees to administer the employees’…
As has been widely reported (see Baker & McKenzie client alert), the European Court of Justice (ECJ) invalidated the EU/US Safe Harbor Program which allowed transfers of personal data of EU/EEA residents to U.S. companies that registered under the program. Generally, such transfers are allowed only if a permissible ground exists, and the Safe Harbor Program was a convenient ground for many U.S. companies doing business in the EU/EEA. By invalidating the program, these companies are now forced to rely on other grounds, such as the data subject’s express consent or Model Agreements between the transferring and receiving entity.
What Does This Mean for Equity Award Administration?
In the context of equity awards, U.S. companies granting awards to employees in the EU/EEA have to collect, process and transfer the employees’ personal data (i.e., information by which an employee can be identified) to administer their participation in the plan. Usually, the equity award database is maintained in the U.S., so the data has to be transferred to the U.S. In addition, the data is often shared with third-party providers (e.g., stock plan brokers) which also maintain databases in the U.S.