If you operate in California or have contact with consumers in California, you have likely already heard about the California Consumer Protection Act (“CCPA”), the United States’ answer to the European Union’s General Data Protection Regulation. The CCPA goes into effect on January 1, 2020 and can be enforced six months after it is enacted. Per the CCPA’s website, the goal of this extensive privacy act is to give consumers ownership of their personal information, provide them with control of it, and give them a sense of security. The CCPA protects a consumer’s right to prevent a business from sharing or selling his or her personal information and to have control over his or her personal information. If a business holds a consumer’s personal information, it is responsible for safeguarding it. The law places significant obligations on businesses to abide by consumers’ wishes regarding personal data, including properly storing and transmitting data as well as deleting it upon request.
In the original drafting of the CCPA, the term “consumers” is very broadly defined as residents of the state of California, and the term “personal information” includes any “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Using these definitions, the CCPA would apply to any employers and third-party background screening providers (also known as CRA’s, or Consumer Reporting Agencies) using or transmitting personal information to run background checks on potential employees.
Employers obtain and store various types of personal data about their employees and job applicants. An employer who orders background checks through a third-party consumer reporting agency transmits the personal data of employees and job applicants in order to conduct the investigations. While the General Data Protection Regulation does not provide an exception for employers and employment-related personal information, an amendment to the CCPA has been signed that provides relief for employers. AB 25, which was passed by the California Appropriations Committee on May 1, 2019, amends the definition of “consumer” to remove employees, contractors, job applicants, and agents of the business. While these classes of people are now excluded from the “consumer” definition, AB 25 does stipulate that the person’s personal information must be collected and used only in relation to the person’s role as a job applicant, employee, contractor, or agent on behalf of the business. Other uses would not be exempted from the CCPA.
While the passage of AB 25 provides relief for employers and consumer reporting agencies in relation to personal data belonging to employees and the other classes of individuals described above, it may not apply to other types of personal data stored and used by the business. It is important for employers to regularly review their background screening, personal information, and privacy policies to ensure compliance with new and evolving legislation. If you would like AccuSource to provide a complimentary review of your current background screening compliance program, please click the button below to schedule a complimentary audit of your background screening process.