The Delay Continues – California Passes Prop 24 And Employers Must “Wait and See

November 09, 2020

By Jennifer Baldocchi, Ryan Derry & Emily Stover

Last week, California voters passed Proposition 24, the California Privacy Rights Act of 2020 (“CPRA”), which expands and clarifies certain rights and obligations under the California Consumer Privacy Act of 2018 (“CCPA”). Relevant to California employers, Proposition 24 extends the moratorium on certain rights and obligations related to job applicant and employee data to January 1, 2023. (Our discussion of Proposition 24’s impact with respect to data collection and consumer privacy rights can be located here.)

Since it was codified in 2018, companies in California have been waiting to see whether certain provisions of the CCPA, including an individual’s right to access and request deletion of personal information, would apply to data collected and retained by employers. As we reported at the time, in October 2019, Governor Gavin Newsom signed AB 25 into law, which delayed, until 2021, application of most sections of the CCPA to information collected from applicants, employees, and contractors, in the course of their employment or contracts.[1] This past October, California extended that moratorium to January 1, 2022, under AB 1281.[2] Now, under Proposition 24, that timeline is pushed out to January 1, 2023.

Proposition 24’s Exemption:

As to employment-related information, Proposition 24, like AB 25, generally excludes from coverage:[3]

Data collected by a covered business about a person in the course of that person acting as a job applicant, employee, or independent contractor, used solely within that individual’s role with the business;
Emergency contact information of an applicant, employee, or independent contractor; and
Information of an applicant, employee, or independent contractor necessary for the business to administer benefits.

These exemptions for employment-related information will become inoperative on January 1, 2023.

What Now?

Thus, the question becomes: What should employers expect regarding the CPRA between now and January 2023?
We continue to anticipate the California legislature will take steps to address and modify the broad definitions within the CCPA/CPRA and its applicability to employment and contractor-related data and information.[4]
Next Steps For Employers:

Given the passage of Proposition 24, California employers should consider doing two things:

First, Proposition 24, like AB 25, does not exempt employment-related data from the requirements for pre-collection notice (Civil Code section 1798.100) and data breach protections and rights of action (Civil Code section 1798.150).[5] Thus, California employers should confirm compliance with pre-collection notice requirements and the security of data and information collected.
Second, given the possibility for further clarification regarding the treatment of employment-related information, employers should watch for further developments. In the interim, however, employers would continue to be well-served to identify and map employment-related information and data that could be subject to future requirements under the CPRA or other legislative action.

[1] The notice provision (Cal. Civ. Code § 1798.100(b)) and private right of action provision (Cal. Civ. Code § 1798.150) are not subject to this moratorium, and became effective as of January 1, 2020. See Assem. Bill 25, 2019-2020, Reg. Sess., Ch. 763.

[2] Assem. Bill 1281, 2019-2020, Reg. Sess., Ch. 268.
[3] The specific categories for these three exemptions under the CPRA include: “job applicant, employee, owner, director, officer, medical staff member, or independent contractor.” See Prop. 24 at Sec. 15, § 1798.145(m)(1)(A).
[4] Under the California Constitution, the Legislature may not amend or repeal a ballot proposition unless the initiative permits amendment or repeal without the general electors’ approval. See Cal. Constitution Art. 2, Sec. 10(c). Here, Proposition 24 expressly permits legislative amendment, provided that: “amendments are consistent with and further the purpose and intent of this Act….” Prop. 24 at Sec. 25(a); see also Sec. 3(c)(6) (“The law should be amended, if necessary, to improve its operation, provided that the amendments do not compromise or weaken consumer privacy, while giving attention to the impact on business and innovation.”). Proposition 24 recognizes the interests in protecting information of employees but also the challenges given such relationships: “The privacy interests of employees and independent contractors should also be protected, taking into account the differences in the relationship between employees or independent contractors and businesses, as compared to the relationship between consumers and businesses.”
[5] Prop. 24 at Sec. 15, § 1798.145(m)(3).
Click here for a PDF of the full text