Question: If a company is based in California, will the requirements of the CCPA apply to all employee data held by the company?

Probably not.

Assuming that the CCPA applies to the employer , it will only impact data that the company holds about “consumers.”  As is discussed in Series 1, Question 1, “consumer” is defined by the CCPA as a “natural person who is a California resident,” which will include California-based employees.^[1]  As a result, if a California-based employer processes “personal information” about a resident of another state – or a resident of another country – that information should not be subject to the CCPA.  In other words, for multi-state employers, the CCPA will not apply to employees residing outside of California.

Example:  Assume Company A (with revenue over $25 million) is based in Palo Alto and has both European and American employees.  The CCPA should only apply to the information collected about Californians and should not apply to the information collected from residents in other states or in Europe.  ^[2]

As a practical matter, this means that an employer that must comply with the CCPA, but has national or global operations, will have to have a set of privacy notices, employee procedures, and vendor agreement provisions that are tailored for its California- resident employees.

_________________

[1]           CCPA, Section 1798.140(g).

[2]           EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) – Version for public consultation (16 Nov. 2018) at 8.

[View source.]