With the California Consumer Privacy Act just six months from implementation, the California legislature is hard at work refining and amending the CCPA. While some of the proposed amendments seek to clarify ambiguous terms, others would limit or expand the reach of the law, representing the divide between privacy advocates and the tech industry.
Note: this post was updated following the June 28, 2019 changes to AB 25.
Over the course of the next several months, this blog will detail several of the most interesting and impactful debates surrounding the CCPA. Today, let’s discuss AB-25 and AB-1564.
AB 25: Employees are not “consumers”
One of the first ambiguities many observers identified about the CCPA is that the definition of “consumer” did not exclude a company’s employees. Given that companies typically store sensitive personal information about their employees, this would impact the implementation of the law in a number of ways that were likely unintended by the original drafters.
However, the CCPA was intended to protect consumers whose personal information gets collected in the course of a company’s business, rather than its employees. As a result, AB 25 would revise the CCPA to specifically exempt personal information about its employees that a company “collected and used solely within the context of” that person’s employment.
On June 28, 2019, AB 25 was updated to exempt not only employees and job applicants, but also owners, directors, officers, medical staff, or contractors of a business. It also exempts information collected regarding emergency contacts of all of the categories of people listed above.
It’s important to note that AB 25 would not leave employees without any protection. Employees would still be protected under the CCPA to the extent a company treats them as consumers, due to the “within the context” carveout described above. And while there is currently no federal law protecting employee data overall, employees receive a number of specific protections under other laws, such as the Americans With Disabilities Act, the Civil Rights Act, and other anti-discrimination and anti-retaliation laws.
AB 1564: Companies can use the Internet for consumer requests
The CCPA requires companies to provide at least two methods for a consumer to submit requests relating to their personal information, including, at a minimum, a toll-free phone number and (if the business has a website), a webpage.
AB 1564 would modernize this section of the law by removing the requirement of a toll-free number, instead requiring a business to provide “a toll-free telephone number or an email address and a mailing address” (in my opinion, the text is written poorly and it’s not quite clear what the “or” is modifying. However, the legislative comments clarify that this requirement is a) a toll-free number or b) an email address and physical address). If a business exists solely online, they only need to provide an email address for consumers to make their requests. Businesses with websites also need to make a page available on their website for consumers to make the requests.
It’s frankly hard to believe that a requirement for a toll-free number exists in a 2018 law aimed at the tech industry, but there we go. AB 1564 seems like a logical step to make it easier for consumers to enforce their rights under the CCPA.
Stay tuned to this blog for updates on these two amendments and much more.
Disclaimer: This information is given for legal education only. This post is not legal advice and does not create an attorney-client relationship. Please contact an attorney for legal advice.
Daniel Zarchy is a civil litigator and privacy attorney in San Francisco, California. Daniel is also a Certified Information Privacy Professional (CIPP/US). The views and opinions expressed herein are solely those of the author and do not necessarily reflect the views or opinions of any other party or law firm.
Latest posts by Daniel J. Zarchy
(see all)Like this:
Like Loading...