AB 25: Exempts employment-related information from CCPA until January 1, 2021

On Oct. 11, 2019, Gov. Gavin Newsom signed Assembly Bill 25, exempting employee and job applicant personal information collected for employment purposes from certain of the California Consumer Privacy Act's requirements until Jan. 1, 2021. The CCPA, which took effect on Jan. 1, requires businesses to provide consumers with information regarding the handling of their personal data. Prior to Newsom signing AB25, the CCPA defined a "consumer" so broadly that it appeared to cover employees and job applicants.

Under AB25, employers are exempt for one year from abiding by many requirements of the CCPA with respect to personal information about job applicants and employees that is collected and maintained for employment purposes. The exemption includes, for example, requests for disclosure or deletion. However, the exemption does not apply to: (1) the CCPA's notice requirements to inform consumers and employees of the categories of personal information to be collected from them and the purposes for which their personal information will be used; or (2) the CCPA's private right of action for a data breach resulting from an employer's failure to implement reasonable security measures as required under the CCPA. In addition, employers will still be required to give employees notice and to obtain explicit consent if employers intend to collect additional categories of personal information or to use previously collected information for new purposes.

AB25 will only serve as a temporary reprieve for California employers, as it is scheduled to sunset on Jan. 1, 2021. Unless the California Legislature enacts new privacy restrictions governing employment-related data before then, businesses will have to comply with all provisions of the CCPA with respect to employment-related data by Jan. 1, 2021.

Karen L. Corman is a Labor and Employment partner and Eileen M. Sherman is an associate at Skadden, Arps, Slate, Meagher & Flom LLP.