A few weeks ago, I pondered whether the California Consumer Privacy Act of 2018 (CCPA) is still a bit of a work in progress with the introduction of a proposed amendment. Recently, another amendment was proposed by Assembly Member Edwin Chau in the form of Assembly Bill 25.

Assembly Bill 25 would exclude employees and job applicants from the definition of “consumer.” The new amendment states: “Consumer does not include a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant or employee, contractor, or agent, on behalf of the business, to the extent their personal information is used for purposes compatible with the context of that person’s activities for the business as a job applicant, employee, contractor, or agent of the business.”

If this amendment passes, the broad rights granted to consumers under the CCPA would not apply to employees and job applicants of CCPA-covered employers. The CCPA grants consumers (California residents):

  • the right to ask companies to identify the personal data they collected on the consumer and whether a business is collecting or selling/disclosing their personal information;
  • the right to demand that personal data not be sold or shared for business purposes;
  • the right to sue companies that violate the law or that experience data breaches,
  • the right to access and download their personal information in a transferrable way;
  • the right to opt-out; the right to request deletion of their personal information; and
  • the right not to be discriminated against.

This proposed amendment would likely mean that CCPA-covered businesses would not have to be concerned with their employees or job applicants asserting any of the consumer rights conferred by the CCPA. CCPA-covered businesses are defined as profit businesses that do business in California and meet any of the following three criteria:

  • annual gross revenue in excess of $25 million;
  • annual purchases, receipt or sales of the personal information of 50,000 or more California residents; or
  • companies that derive 50 percent or more of their annual revenue from selling consumers’ personal information.

A key fact to note from this definition is that the CCPA applies to any business that “does business in the State of California” as described above, and not just businesses residing or incorporated in California. This change would be most impactful to CCPA-covered employers in terms of their readiness preparation for CCPA compliance when the CCPA takes effect on January 1, 2020.

Photo of Deborah George Deborah George

Deborah George is a member of Robinson+Cole’s Business Litigation Group as well as its Data Privacy + Cybersecurity Team. Ms. George advises clients on and focuses her practice on data privacy and security, cybersecurity, and compliance with related state and federal laws. She…

Deborah George is a member of Robinson+Cole’s Business Litigation Group as well as its Data Privacy + Cybersecurity Team. Ms. George advises clients on and focuses her practice on data privacy and security, cybersecurity, and compliance with related state and federal laws. She also has experience providing counsel in civil litigation and employment law matters. She has significant experience offering advice and counsel on legal issues related to human services agencies, including Medicaid, as well as drafting and reviewing contracts, business associate agreements, and data use agreements. Read her full rc.com bio here.