California is now one step closer to excluding information relating to employees from the scope of the California Consumer Privacy Act (“CCPA”). On May 29, 2019, the California Assembly passed Assembly Bill 25 (“AB 25”), which would narrow the CCPA’s definition of “consumer” to exclude, among others, employees. AB 25 now goes to the Senate for its consideration. As a result, how big of a step this represents, and how much closer we are to an amendment widely supported by companies across industries, remains to be seen.
The CCPA and its various consumer privacy rights (and corresponding business obligations), such as access and deletion, will apply with respect to “personal information” relating to any “consumer.” In this regard, the CCPA defines a “consumer,” in pertinent part, as “a natural person who is a California resident.” Cal. Civ. Code § 1798.140(g). As a result, unlike privacy laws that may focus on information relating to specific individuals (e.g., children or patients), the CCPA generally will apply with respect to personal information relating to any California resident, regardless of the nature of a business’s relationship or interaction with the individual, including, for example, job applicants and employees.
AB 25, however, would amend the CCPA to narrow the definition of “consumer” in certain employment and related contexts. Specifically, AB 25 would clarify that a “consumer” does not include “a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant to, an employee of, a contractor of, or an agent on behalf of, the business,” but only “to the extent the person’s personal information is collected and used solely within the context of the person’s role as a job applicant to, an employee of, a contractor of, or an agent on behalf of, the business.”
If ultimately enacted, AB 25 would represent a significant amendment to the CCPA. The bill would allow companies to exclude from the scope of their obligations under the CCPA information relating to individuals who apply for or are employees, so long as that information is used only for employment purposes. The bill also would allow companies to exclude information relating to contractors and agents to the extent the information is used solely in the context of those relationships.
It is important to note that AB 25 would define a “contractor” as “a natural person who provides services to a business pursuant to a written contract.” This definition is broad, but does not clarify whether the written contract must be between the business and the individual providing the services or whether the written contract may be with that individual’s own employer. In particular, AB 25 does not specifically state whether the exclusion would also cover personal information that a business handles relating to its vendor’s employees (i.e., the individuals who actually provide the business with the relevant services) if it is used for vendor management purposes. Nonetheless, this would appear to be a reasonable reading.
Every business subject to the CCPA that employs California residents or that has contractors or agents who are California residents would significantly benefit if AB 25 is enacted. In particular, being able to exclude systems that handle HR and vendor data from scope would significantly narrow the impact of the CCPA for many businesses. Moreover, those businesses that handle personal information that is covered by other CCPA exceptions, such as the exception for personal information handled “pursuant to” the Gramm-Leach-Bliley Act or the exception for protected health information subject to the Health Insurance Portability and Accountability Act, would particularly benefit. These businesses (e.g., a financial institution whose business has a retail consumer focus) may conclude that they handle only limited personal information that would still be subject to the CCPA.
While AB 25, if enacted, would represent a significant amendment to the CCPA, it would not address other areas where the application of the CCPA may lead to absurd results. For example, AB 25 would not exclude personal information collected by a business relating to individuals associated with the business’s commercial customers (e.g., contact information relating to individuals associated with a commercial customer). Nonetheless, the process of bringing sensible clarifications to what is a confusing and often poorly drafted statute appears to be a marathon and not a sprint, notwithstanding the CCPA’s impending January 1, 2020 operative date. At this stage, any step forward is a positive one.