Until January 2021, employers are not legally required to handleemployee data in the same manner as consumer information under theCalifornia Consumer Privacy Act (CCPA).However, experts recommend scrutinizing employee and contractordata to avoid litigation and challenges to regulatory changes—inCalifornia next year, and elsewhere in the future.

In a webinar titled "Bracing for the Wild Ride in Data PrivacyRegulation"—sponsored by Corporate Counsel and LexisNexis lastThursday—Mark Brennan, a global innovation partner at Hogan Lovells in Washington, D.C., said thatwhen the CCPA was being crafted, there was not total clarity onwhat should be done about employee personal information.

"There was not, at the time, an alternative framework foremployee data," Brennan said.

In October, Assembly Bill 25 was signed into law.The law exempts employers for one year from complying with the CCPAwith respect to anyone who is an employee, job applicant, ordirector or officer. However, AB25 sunsets at the end of the year,and employees will then be granted the same protections from theiremployers that are guaranteed to consumers under the CCPA.

Although AB25 is active for the next nine months, employeesstill have the option to sue their employers over data breaches,Sean Nalty, a shareholder at Ogletree, Deakins Nash, Smoak & Stewart inSan Francisco, said in an interview with Corporate Counsel onFriday. That exemption, coupled with the broad terms of the CCPA,could lead to heavy fines.

"Each piece of personal information that is subject to thebreach can lead to damages of between $150 and $750 per breach,"Nalty explained. "It is important that companies make sure theirculture and standards are focused on data privacy protections."

Philip Yannella, a partner at Ballard Spahr in Philadelphia, said in aninterview with Corporate Counsel on Friday that in-house counselshould remember some of the most sensitive data companies hold intheir employees' personal information.

"We work with a lot of California businesses to beef up theirarbitration clauses to include the CCPA private right of action toprovide some protection against such claims," Yannellasaid.  "This can be challenging because Californiaplaintiffs lawyers have been very creative in finding new waysaround arbitration clauses, and California courts, generallyspeaking, have been reluctant to enforce arbitration clauses."

Data mapping is one key way to track that sensitive information.Brennan said that legal departments should be partnering with humanresources to see how their employee data is being used.

"If you're already going through the resource expenditure to dothe data mapping for other types of data, you can tack this oneasily," Brennan said.

It is unclear if AB25 will be amended, though Yannella believesit is likely it will continue past its current expiration date ofJanuary 1, 2021.

"AB25 had a lot of support, and there are some very good reasonsnot to extend all consumer rights to employees under the CCPA. Myhunch is that the employee carve-out will be extended beyond 2021,and perhaps permanently," Yannella said.

From: Corporate Counsel