California Consumer Privacy Act and Compliance Issues Employers Should Consider Before 2020
As we approach the end of 2019, there are recent laws and decisions that will affect employers in 2020. Since passing the California Consumer Privacy Act (“CCPA”), which takes effect on January 1, 2020, the California Legislature has continued to make amendments to the CCPA to address the concerns of consumers and businesses. In addition, a recent California decision evaluated whether services charges added by businesses are gratuities under California law. This summary of Assembly Bill 25, which amends the CCPA, and the O’Grady decision provides employers with additional guidance regarding compliance with California laws.
Assembly Bill 25 – Amendments to The California Consumer Privacy Act
Under the original California Consumer Privacy Act, businesses holding personal information may be directed by a consumer to disclose what it has collected or delete it at no charge within 45 days of a specific request. This bill adds that a business is obligated to determine that the request is a verifiable consumer request, and may require reasonable authentication of the consumer. If the consumer has an account with the business, the business may require that the request be made through the account. However, if the consumer does not have an account with the business, the business cannot require the consumer to create an account with the business to make the request.
With the ever rising number of data breaches and incidence of cybercrime, consumers are now permitted to bring a private civil action against businesses for failure to implement security practices that results in an unauthorized disclosure, theft, access or exfiltration of personal information. In addition, businesses are also required to inform consumers of the categories of personal information to be collected and the purpose of the collection at or before the point of collection.
Assembly Bill 25 exempts information collected from a person by a business in the course of the person as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business, as specified in the Consumer Privacy Act, from all provisions of the Act except for the private civil action provision and obligation to inform the consumer of the categories of personal information to be collected, until January 1, 2021.
O’Grady v. Merchant Exchange Productions, Inc.
2019 WL 5617001
An automatic or mandatory “service charge” added by a food or beverage service company that reasonably appears to be a gratuity for the service staff may be a gratuity under Labor Code section 351 that is required to go only to the non-managerial employees involved with the actual serving of food and beverages. The O’Grady decision explains that there is no categorical prohibition that a “service charge” cannot also meet the statutory definition of a “gratuity” and a putative class action lawsuit on behalf of non-managerial food and beverage service employees could proceed against the employer where the employer did not disseminate the total proceeds of the service charge to the food and beverage service employees, and allegedly retained a portion of the service charge and/or used a portion of the service charge to pay managers or other non-service employees.
For more information about these new laws, please contact Michael Lee, senior counsel in Hunt Ortmann’s Employment Practice Group at lee@huntortmann.com