The California Consumer Privacy Act (CCPA) is a sweeping privacy law that applies to businesses of all sizes across almost every industry. Up on The Workplace podcast this week, CalChamber President Allan Zaremberg is joined by CalChamber Executive Vice President Jennifer Barrera and Policy Advocate Sarah Boot to talk about the challenges of implementing the CCPA. In discussing the many unworkable provisions of the law, the trio digs deep into the potential costs the CCPA poses to both business and consumers. The conversation concludes with a discussion of legislative fixes needed before the CCPA goes into effect on January 1, 2020.
Of the many privacy laws in the country, the CCPA is the only one that applies across all industries uniformly, Boot explains.
“The law applies very broadly, across every industry and to businesses of all sizes,” Boot states. The reason is the incredibly broad definition of “personal information,” which extends “far more broadly than what people normally think of,” Boot says.
The CCPA deals with “data and privacy, and this isn’t just about tech companies; this is about virtually every business in California and those who do business in California,” Zaremberg says.
Boot summarizes for listeners that many people mistakenly believe the CCPA applies only to “Big Tech.” Although the CCPA does apply to large companies in any industry (those making more than $25 million in revenue per year), as well as to data brokers, there is a third, incredibly broad category of businesses—many of them small businesses often left out of the discussions: any business that “collects 50,000 pieces of personal information…in a year.”
Although this number may sound like a high threshold, it’s not, Boot says. The CCPA definition of “personal information” includes, for example, IP addresses, and the burdensome requirements of the CCPA apply to any business that merely “receives” personal information as defined by the CCPA.
Boot continues with an example: an ad-supported blog that gets 137 unique online visitors per day over the course of one year will hit the threshold to comply with CCPA.
Turning to the impact on the consumer, Zaremberg and Boot review who the law identifies as a “consumer” and how consumers benefit from data businesses collect.
Zaremberg says that companies keep data and uses the example of a car dealer which keeps information on consumers for recalls.
“All of this data that people have, in some respects influences consumer activity,” Zaremberg says. “So if there’s a car recall, they want to make sure they have that data so they can notify the current owner….”
Boot explains that the CCPA defines “consumer” as any California resident. She elaborates that the CCPA gives “consumers” the right to request that a business delete their data. If this definition is not changed to exclude employees, an employee accused of sexual harassment could request that complaints about him/her be deleted.
The definition could result in multiple flaws that not only undermine consumer privacy, but employee protections as well.
Barrera says she finds this part of the law fascinating with regards to labor and employment.
Allowing an investigated, documented and retained personnel file involving sexual harassment to be deleted is “inconsistent with the goals of the #MeToo movement to make sure that, if someone has committed harassment, that even a future employer would be able to find out that information, and now you’ve eliminated that potential by allowing an employee, a harasser, to come in and delete that information from the employer’s records,” Barrera says.
“For an employer, it puts them in a very difficult position,” Barrera continues. “if an individual can call up, say ‘Delete all the information you have on me,’ how does an employer then defend their actions if it’s challenged in court? How is an employer supposed to defend themselves if they had to delete all the information that documented the situation?”
California has the opportunity to lead the country on this issue and produce model legislation on consumer privacy that works for both consumers and businesses, Zaremberg says in closing:
“Let’s bring some common sense to an issue that we support, we want to protect. It’s the law. We just want to make it work.”
Subscribe to The Workplace
Subscribe to The Workplace on Google Play, iTunes, PodBean, Tune In and Stitcher. New episodes will be released each Wednesday.
