Source: https://www.ebglaw.com/news/californias-new-consumer-privacy-act-what-employers-need-to-know/
Timestamp: 2019-04-20 06:34:01+00:00

Document:
California continues to lead the way on privacy and cybersecurity legislation with the enactment on June 28, 2018, of the California Consumer Privacy Act (“Privacy Act” or “Act”). The Privacy Act joins other California laws safeguarding California residents’ privacy rights under the California Constitution. Also, the Act adds to the steadily expanding number of state laws, including the laws of New York, Illinois, and Massachusetts, providing for the privacy and cybersecurity of personal information. The Act becomes effective on January 1, 2020, to afford California businesses sufficient time to achieve compliance.
It is not surprising that the Privacy Act’s enactment comes one month after the effective date of the European Union’s General Data Protection Regulation (“GDPR”). Nor is it surprising that the Act follows the recent congressional investigation into Cambridge Analytica’s apparent misuse of personal information stored on Facebook. The Act was enacted in response to private efforts by an organization called Californians for Consumer Privacy to place on the November 2018 ballot a statewide initiative titled the “Consumer Right to Privacy Act of 2018.” This effort reportedly resulted in more than 600,000 supporting signatures.
The Privacy Act applies to any for-profit business that (i) collects personal information on California residents, (ii) does business in the state of California, and (iii) satisfies one or more of the following thresholds: (a) has annual gross revenues in excess of $25,000,000; (b) alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or (c) derives 50 percent or more of its annual revenues from selling consumers’ personal information. Businesses that hit the thresholds will be covered even if they are located outside the state of California.
to bring a private right of action if certain personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable cybersecurity procedures and practices.
Does the Privacy Act Cover the Personal Information of Employees?
While the Privacy Act is ostensibly a consumer protection statute, its requirements, on their face, apply in the employment context. The Act defines a “consumer” as “a natural person who is a California resident . . . however identified, including by a unique identifier.” Although the Act does not mention employees specifically, no provision excludes them from coverage. The Act, therefore, apparently protects the personal data of any employee who is domiciled in the state of California or who is in the state other than for transitory or temporary purposes.
What Personal Information Is Covered?
any “inferential information” that may be drawn from any of the information collected to create a profile reflecting the individual’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Although PHI is exempted, health care companies that otherwise collect personal information are subject to the Act’s requirements.
What Notices and Responses to Individual Requests Are Required?
The individual’s privacy rights are implemented under the Act through required notices and disclosures. A business that collects personal information must, at or before the point of collection, inform the individual in writing of the categories of personal information to be collected and the business purposes for which the categories of personal information will be used. The individual must also have the right to receive, upon request, a written disclosure of the categories and specific pieces of personal information that the business has actually collected, the categories of sources from which the personal information is collected, the business purpose for collecting (or selling) the personal information, and the categories of third parties with whom the business shares personal information. If the personal information was shared with third parties, the individual has the right to know the categories of third parties with whom the business shares personal information and the business purpose for disclosing the information. The business must, at a minimum, provide a toll-free number for an employee to make the request, and, if it maintains a website, a website address.
Does the Privacy Act Provide for a Right of Deletion of Personal Information?
A consumer must have the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. A business may refuse the request, however, in certain circumstances, including to comply with regulatory or other legal obligations requiring the information’s retention. The business may also refuse the request if it maintains the information for internal purposes in a lawful manner that is compatible with the context in which the information was originally provided. In the employment context, the exceptions to an employee’s right to request deletion may frequently permit the employer to continue to retain the records despite the request.
develop a plan to curtail the collection of personal information or to ensure compliance as of the January 1, 2020, effective date.
 Cal. Civ. Code § 1798.198(a).
 See NYS Department of Financial Services Cybersecurity Requirements for Financial Services Companies, 23 NYCRR 500; Illinois Biometric Information Privacy Act, 740 ILCS 14; Massachusetts Data Protection Law, 201 CMR 17.
 See Cal. Civ. Code § 1798.198(b).
 See id. at § 1798.140(c).
 The private right of action provision applies only to the more limited definition of “personal information” contained in section 1798.81.5 of the California Civil Code, which applies to information containing the individual’s name coupled with certain identifiers, such as a Social Security number. The remaining provisions of the Act are enforced by the California Attorney General.
 See Section 17014 of Title 18 of the California Code of Regulations.
 The Act provides, “This title is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers personal information.” See Cal. Civ. Code § 1798.175.
 See id. at § 1798.140(o).
 See id. at § 1798.140(o)(2).
 See id. at § 1798.145(a)(6)).
 See id. at § 1798.100(b).
 See id. at §§ 1798.100(a), 1798.110(a)(b).
 See id. at §§ 1798.110(c), 1798.115.
 See id. at § 1798.130(a)(1).
 See id. at § 1798.130(a)(5)(A).
 See id. at § 1798.105.

References: § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798
 § 1798