24 December 2020
Since the California Consumer Privacy Act (CCPA) passed in 2018, businesses have been working hard to provide appropriate notice to consumers regarding the collection and use of their personal information.
But the definition of "consumer" in the CCPA is broader than many people realize. Any California resident can be a consumer: not just the public (e.g. your customers and users of your website), but also your employees.
In this article, we're going to look at how businesses are providing CCPA-compliant notice to both their employees and the public.
Here's a very brief introduction to the CCPA and the CCPA's consumer notices.
The CCPA applies to any for-profit company operating in California (based anywhere in the world) if one or more of the following characteristics apply to it:
There is one exception: the CCPA does not apply to "service providers." Service providers are businesses that operate on behalf of other businesses.
Under the CCPA, consumers have a "right to notice." This means they have the right to information about what personal information your business collects, uses, shares, and sells.
To fulfill the right to notice, all businesses covered by the CCPA must provide up to four types of consumer notice:
The following principles apply when you are creating your consumer notices:
We're going to look at how to create these consumer notices in respect of two types of consumers: the public and your employees.
At least until 2021, the CCPA distinguishes between two types of consumers:
First, we're going to look at how to provide the four consumer notices for that second group of consumers: the general public, who interact with your business but do not work for it.
You should provide a Notice at Collection whenever you collect personal information from consumers.
Your Notice at Collection must:
Here's an excerpt from a Notice at Collection created by Central Valley Community Bank:
The table shows a list of categories of personal information that the business collects, together with its intended uses of the personal information.
Further down, the business offers to provide the notice in alternative formats and provides a link to its Privacy Policy:
Amending your Privacy Policy is one of the most important parts of CCPA compliance. A Privacy Policy is mandatory for all businesses that collect personal information.
Our Privacy Policy Generator makes it easy to create a Privacy Policy for your website. Just follow these steps:
Enter your email address where you'd like your policy sent, select translation versions and click "Generate."
You'll be able to instantly access and download your new Privacy Policy.
In the CCPA Proposed Regulations (available here), the California Attorney-General provides a model Privacy Policy. We've broken this model down into eight sections and provided some examples from businesses that are already meeting these requirements.
In the first section of your CCPA Privacy Policy, you should:
Here's part of Moving Picture Company's Privacy Policy where the business explains the right to know:
You'll also need to:
Explain how you have processed personal information over the past 12 months:
For each category of personal information on the list, explain:
Here's an example from Weatherbit, disclosing the categories of personal information the business has collected over the past 12 months:
Note that Weatherbit discloses that it has not collected personal information from category "B." This is not necessary under the CCPA.
Explain how you have disclosed and/or sold personal information over the past 12 months:
Here's part of the Privacy Policy of IrvingGQ. It explains the categories of personal information that the company has disclosed for business purposes and the categories of recipients to whom the business disclosed it:
Note that this Privacy Policy actually goes further than the Proposed Regulations require.
Here's how Oreck covers the first two points above:
Here's how Thomson Reuters does this:
Explain the right to non-discrimination.
Here's how CooperSurgical does this:
Note that you may not need to go into this much detail to comply with the CCPA. In particular, the section about financial incentive schemes (in the red box) is not required unless you operate such a scheme.
Explain how an authorized agent can make a CCPA request on a consumer's behalf.
Here's how Ironwood Pharmaceuticals does this:
Note how the business uses clear and straightforward language in its explanation.
Provide contact details via which a consumer can request further information.
Here's an example from eHealthInsurance:
Note how this business provides a broad range of contact options for consumers.
Disclose the date you last updated your Privacy Policy.
Here's how Salt Edge does this:
You only need to provide this information if your business buys, sells, receives, and/or shares the personal information of more than 4 million consumers per year.
With respect to the past 12 months, disclose:
For each item above, disclose:
You must provide Notice of the Right to Opt Out (also known as a "Do Not Sell My Personal Information" page) if you sell consumers' personal information.
The CCPA Proposed Regulations require that you do the following in your Notice of the Right to Opt Out:
You should provide Notice of the Right to Opt Out via a clear and conspicuous link that reads "Do Not Sell My Personal Information" or "Do Not Sell My Info."
Here's an excerpt from a Notice of the Right to Opt Out from Publisher's Clearing House (PCH):
Note that PCH allows consumers to provide their account number, but does not require them to do so. This is good. You must not require consumers to create an account with your business in order for them to be able to exercise their CCPA rights.
You only need to provide a Notice of Financial Incentive if you operate a financial incentive scheme.
We won't fully explain the CCPA's financial incentive provisions in this article. Briefly, the CCPA allows a business to offer consumers discounts or other benefits in exchange for their personal information, so long as the business meets certain conditions.
Your Notice of Financial Incentive must:
Provide:
Here's an extract of a Notice of Financial Incentive from Prodege:
In this excerpt, Prodege sets out the terms of its scheme and explains how consumers can opt in and opt out. It is not clear whether the opt-out method Prodege provides would be satisfactory under the CCPA but it seems promising.
Employees also have a right to notice under the CCPA. As noted, the CCPA's definition of "consumer" covers all California residents, meaning:
While we normally think of "consumers" as "customers" or "potential customers," this definition of "consumer" includes employees of your business.
Extending all the CCPA's provision to all employees will require a lot of work. Accordingly, in October 2019, that State of California enacted Assembly Bill 25 (AB-25, available here) in order to give businesses some breathing space.
Here's the relevant part of AB-25:
AB-25 states that until January 1st, 2021, a business will not have to comply with the CCPA in respect of its:
However, there is one provision of the CCPA that businesses must comply with in respect of their employees even before 2021 (i.e. now): providing Notice at Collection for employees.
The CCPA's Notice at Collection requirements are mostly the same in respect of your employees as they are in respect of all other consumers.
Your Notice at Collection for employees must:
At least until the CCPA is finalized in 2021, there are two differences between a Notice at Collection for employees and a Notice at Collection for non-employees. In your Notice at Collection for employees:
Here's an example of a Notice at Collection that Pyrotek provides to job applicants:
This small excerpt provides a lot of useful information, including:
You should provide Notice at Collection for employees whenever you collect employees' personal information. Consider including a Notice at Collection with employee handbooks, terms of employment, internal policies, etc.
Until at least 2021, there's no need to provide a Privacy Policy for employees. However, some businesses have already created such a document.
Here's an excerpt from a Privacy Policy for employees produced by Cohn Restaurant Group:
Most businesses currently providing a Privacy Policy for employees have created a document that effectively serves as a Notice at Collection for employees, i.e. it explains what categories of personal information the business collects for what purposes.
Here's an example from Trendmaker Homes:
For now, this is acceptable. From 2021 onwards, your Privacy Policy for employees could look very different. For example, unless the CCPA changes, your Privacy Policy for employees will need to provide information about how your employees can exercise their CCPA rights.
For now, there is no need to provide Notice of the Right to Opt Out or Notice of Financial Incentive to your employees.
There had been concern among businesses that certain practices involving the collection and sharing of employment data would be considered a "sale." For example, sharing employee data with third-party providers for the purpose of providing benefits.
However, the Proposed Regulations released in February 2020 (available here) clarify that the collection and use of employment-related information for providing benefits constitutes a "business purpose" rather than a sale.
Therefore, for most employers, there should be no need to provide Notice of the Right to Opt Out for employees. A Notice of Financial Incentive also does not apply to employment-related activities.
The table below explains which notices you must provide to which types of consumers:
Public | Employees | |
Notice at Collection | Provide now | Provide now |
Privacy Policy | Provide now | Provide after Jan 1st, 2020 |
Notice of the Right to Opt Out | Provide now | N/A |
Notice of Financial Incentives | Provide now | N/A |
This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.