State officials overseeing California's data privacy law recently convened a public meeting to discuss a variety of privacy-related issues, and clarification on employer obligations under the law is expected in the near future. It may have suggested that there is a possibility. The May 10 meeting of the California Privacy Protection Agency (CPPA) also touched on the federal Privacy Rights Act, a game-changing state bill regarding the collection of data on minors, as well as other upcoming topics. Here's a summary of what employers need to know about this meeting.
Government agencies oppose federal proposal
The public portion of the meeting began with an update on various laws across the country and coverage of CPPA's position on pending bills. During this portion of the meeting, the Board did not approve the recent comprehensive federal proposal to pass the American Privacy Rights Act (APRA), the nation's first data privacy law.
The CPPA Board noted that it disapproved of APRA because it would preempt certain provisions of the California Consumer Privacy Act and the California Privacy Rights Act (collectively, the CCPA). It would also limit the ability of the California Legislature and the CPPA to protect Californians' privacy rights. Fundamentally, the CPPA Board believes that federal privacy law should provide a floor, not a ceiling, for privacy rights in the United States.
Authorities discuss data collection of minors
The CPPA Board also discussed pending state legislation that would reform how businesses handle the collection, use, and sale of data on minors. Currently, the law prohibits a consumer from targeting the data of a minor under her 16 years of age, where a business has not obtained opt-in consent (from the consumer if she is 13 years of age or older) and the consumer is under her 16 years of age. may not be sold or shared for targeted advertising purposes. (from a parent or guardian if you are 16 years of age or older, or a parent or guardian if you are under 13 years of age). Under AB 1949, the CCPA would be amended to remove the “actual knowledge” standard in determining whether a business must treat a consumer as a child.
The CPPA Board is concerned that removing the actual knowledge standard may require companies to collect more information about consumers to determine their age for compliance purposes. I did. They discussed proposed amendments that would make “constructive knowledge” the norm, meaning that businesses know or should know the age of their consumers. The CPPA Board also expressed concern that expanding the law to cover consumers under the age of 18 may be unrealistic given the differences in the capabilities of 14-year-old and 17-year-old consumers. did.
AB 1949 also prohibits businesses from collecting, using, disclosing, selling, or sharing the personal information of consumers under the age of 18 without their affirmative permission. It will also establish technical specifications for opt-out preference signals that indicate whether a consumer is a child and establish age verification regulations.
Finally, the CPPA Board decided to either remove the requirement to implement age verification regulations by July 1, 2025, or extend the deadline to July 1, 2026.
CPPA Board discusses future emphasis on employee data
During the meeting, the CPPA Board briefly discussed future rulemaking topics. In the end, detailed discussions were put on hold until the next board meeting.
Significantly, however, when asked to identify topics that should be given higher priority in the future, CPPA board member Alastair McTaggart commented specifically on the importance of focusing on regulation around employee data and business-to-business data. That's what I did. In particular, McTaggart pointed out that CCPA is weak when it comes to employee-related data. He said the scope of employee data may need to be adjusted compared to general consumer data.
This brief comment could have far-reaching implications if government agencies act to develop new regulations or guidance regarding employer obligations related to employee data.