On February 10, 2020, the Attorney General issued revisions to the proposed regulations to the California Consumer Privacy Act (the CCPA) which were originally published in October of last year. While the Attorney General cannot bring an enforcement action until July 1, 2020, these revisions indicate that the office is gearing up to start bringing CCPA enforcement actions in July. Further, while employers won a brief reprieve for their employee and applicant personal information due to an amendment to the CCPA, it is important to remember that this reprieve only lasts until January 1, 2021. As the law currently stands, employers have only had to comply with a small portion of the CCPA for their employees and job applicants.
The government just sent a stern reminder to all employers, especially those involved in providing healthcare, that they must still comply with the protections contained in the HIPAA Privacy Rule during the Coronavirus outbreak. The Office for Civil Rights of the U.S. Department of Health and Human Services (HHS) issued a reminder this month after the World Health Organization declared a global health emergency. In fact, the Rule includes provisions that are directly applicable to the current circumstances.
Many small or solo franchisees, subsidiaries, and affiliates of larger businesses may think the California Consumer Privacy Act (CCPA), does not apply to your separate business entity because it does not meet one of the three threshold criteria for CCPA coverage: (1) your annual revenue is under $25 million; (2) you do not annually collect the personal information of 50,000 or more California residents, households or devices; and (3) you are not in the business of selling information. But upon closer inspection, you may be disappointed to learn that California’s groundbreaking new privacy law, which became effective January 1, 2020, may yet still apply to you based on a potentially broad "control" test.
Illinois has introduced new workplace privacy legislation governing the use of artificial intelligence during the job interview process. The state legislature unanimously passed the Artificial Intelligence Video Interview Act (“the AIVI Act”), HB2557, which imposes consent, transparency and data destruction requirements on employers using AI technology during the job interview process. This comes at a time as many employers are beginning to take advantage of AI for hiring as recently reported by the Washington Post in its profile of the video interviewing software HireVue.
Governor Gavin Newsom just signed into law two amendments to the California Consumer Privacy Act (CCPA) that will have a direct impact on employers doing business in the state. The new amendments, signed on October 11, 2019 and taking effect on January 1, 2020, require covered businesses meeting a certain revenue threshold or other criteria to implement policies and procedures that provide consumers – which includes employees – certain privacy rights not previously available under existing law.
On July 25, 2019, New York Governor Anthony Cuomo signed the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) into law. The Act creates additional protections for the residents of New York and their private information. It also endeavors to improve cybersecurity measures for those who possess private information about New York residents.
Alright. So, you’ve battened down the hatches of your company’s premises, to protect your employees and your information. Employees are required to create secret computer passwords they’re not to share with anyone, even colleagues. Your policy requires changing passwords every 45 days. You’ve installed security guards at the front desk, distributed security badges to limit access to your premises, conducted background checks on your new hires. You require signed Confidentiality, Non-solicitation, and Non-competition Agreements with employees to whom you’ve provided access to your secrets. You’ve erected firewalls to protect your servers.
Thanks to recent negotiations among state lawmakers, it appears that California employers may get a temporary reprieve on some of the more sweeping data privacy requirements that were set to take effect in just a few short months.
Early last year, I posted about tougher, bi-partisan privacy and data security legislation in the works in North Carolina. North Carolina State Representative Jason Saine (R), Senior Appropriations Chair, teamed-up with North Carolina Attorney General Josh Stein (D) and issued a fact sheet outlining what the new legislation would include.
An amendment to New Jersey’s data breach notification requirements of the Consumer Fraud Act is currently awaiting signature by State Governor Phil Murphy. The bill, Assembly No. 3245, was recently passed by both the New Jersey Senate and Assembly. If signed into law as expected, the amendment will expand the definition of personal information to include “user name, email address, or any other account holder identifying information, in combination with any password or security question and answer that would permit access to an online account.” In turn, it would require businesses to notify consumers of online account security breaches – thereby eliminating a business’s ability, under the current law, to avoid notifying consumers when there is a breach of online information. The bill’s statement indicates that its purpose is to provide consumers with the opportunity to quickly change online account information to prevent outside access to online accounts, and to put consumers on notice to monitor for potential identity theft.