Last week, the California Legislature failed to reach agreement on an extension to the employee exemption which applies to the California Consumer Privacy Act (CCPA) which currently exempts employees and employee data from the CCPA requirements. As a result, this exemption will expire on December 31, 2022 – and will result in increasing burdens on California employers as it relates to employee privacy rights.

Under the CCPA, which sets forth the most stringent privacy requirements in the U.S., California residents are afforded a whole host of rights with respect to their personal information, including:

• The Right to Know What Personal Information is Collected and Processed
• The Right to Receive Copies of such Personal Information
• The Right to Correction
• The Right to Deletion
• The Right to Opt-Out of Having Their Personal Information Sold or Shared
• The Right to Limit the Use and Disclosure of Their Sensitive Personal Information
• The Right to Non-Discrimination for Exercising These Rights

For-profit companies with payroll compensation in excess of $63,726 for California employees, which also have a global annual revenue in excess of $25,000,000, must comply with the CCPA (as well as the amendments found in the California Privacy Rights Act (CPRA)) and provide California consumers with all of these rights. A company may also be required to comply with the CCPA if it buys, sells or shares 100,000 pieces of personal information annually, or derives 50% of its annual revenue from the sale or sharing of personal information. However, employees and employment data were exempt from these CCPA requirements – until now.

Starting January 1, 2023, California employees who work for companies that are required to comply with CCPA will now have all of these same consumer rights – thereby creating a myriad of potential issues that employers must address prior to the end of 2022. The fact that these rights also extend to former employees and job applicants only exacerbates the issues.

Employers are therefore faced with a number of questions:

• How do we notify our employees of these rights?
• How will we handle requests from employees, or former employees?
• If we receive a request to delete employee information, what do we do?
• Where is our employee data housed, and how can we access it?
• What are we doing to protect our employee data?

So, what can employers do as they are faced with these increased burdens and challenging questions? Here is a list of best practices that employers should consider as they face the expiration of the employee exemption:

• Provide disclosures to employees and job applicants regarding these CCPA rights;
• Prepare an insert for their Employee Handbook which satisfies the requirements of the CCPA;
• Develop an internal protocol for handling any employee requests; and
• Train their HR Department on the intricacies of the CCPA, as well as the newly-established internal protocol.

While these steps are not comprehensive in nature, they are an important foundation for reaching compliance with the challenging requirements of the CCPA. Of course, you are not alone in this process.