©2023 Seyfarth Shaw LLP www.seyfarth.com 2023 Cal-Peculiarities | 69 “in the most expedient time possible and without unreasonable delay.”50 The items considered protected information include, but at not limited to, medical information, health insurance information, and genetic data (defined as “any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material”).51 California mandates a special format for the notice to individuals affected by a breach.52 The notice must be in plain language and must be titled “Notice of Data Breach.”53 The notice must use at least 10-point font and include the following “clearly and conspicuously displayed” headlines: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.”54 The relevant statute also includes a template notice of breach that will “be deemed to be in compliance with” these new format requirements.55 4.10 Personnel Records In a lawsuit, the personnel files of California employees often are unavailable to the party seeking them until (1) there is a notice given to the employees and (2) the employees have the opportunity to object in court to the disclosure of their files.56 Employee privacy rights have yielded, however, when respecting privacy rights would hinder the pursuit of a class action against an employer.57 Courts have permitted class-action counsel alleging wage and hour violations to obtain the name, address, and telephone number of every current and former employee belonging to the allegedly aggrieved class, so long as the employee did not, after receiving notice, object in writing to contact by plaintiffs’ counsel.58 In Belaire-West Landscape, Inc. v. Superior Court, the Court of Appeal rejected the employer’s suggestion to shield private employee information unless the employee affirmatively agreed to be contacted. Belaire-West reasoned that “no serious invasion of privacy” was involved, as what was involved was only “contact information, not medical or financial details.”59 Belaire-West allowed an optout procedure and did not require an opt-in procedure, because “there was no evidence of any actual or threatened misuse of the information”60 and because the “prompt payment of wages due an employee is a fundamental policy of this state.”61 California courts have exalted the class-action procedure over employee privacy rights even when employees are on record as wanting to be left alone. In one case, where the defendant’s employees had signed forms stating that they did not want to be contacted by plaintiffs’ lawyers, the defendant argued that these forms revealed a heightened expectation of privacy that justified only opt-in discovery of the employees’ private contact information. The Court of Appeal rejected this argument, ordering disclosure of employee addresses and telephone numbers unless the employees affirmatively opted out of the disclosure process.62 And in some circumstances courts have even ordered disclosure of employee home addresses without permitting the affected individuals to object to their privacy being invaded.63 4.11 Background Checks The federal Fair Credit Reporting Act (FCRA)64 requires employers to give certain notices and access rights to applicants and employees on whom an employer is requesting a background report, and to give these individuals a chance to correct inaccuracies in the report. Compliance with the FCRA is complicated. Here we highlight some ways in which California’s analogous statutes differ. 4.11.1 Credit reports The California Consumer Credit Reporting Agencies Act (CCRAA)65 governs certain credit-history information that a consumer credit reporting agency reports for use in evaluating an individual’s fitness for employment or other permissible purposes. While resembling federal law on this subject, California law also requires employers to provide, on the form authorizing the credit report, a check-box that the individual can use to request a copy of the report, and California employers must, when notifying the consumer of any adverse action, identify the consumer
RkJQdWJsaXNoZXIy OTkwMTQ4