©2023 Seyfarth Shaw LLP www.seyfarth.com 2023 Cal-Peculiarities | 75 In addition to issuing the required policies and notices and responding to the above-outlined requests, employers should ensure they have in place appropriate contractual terms with vendors and others with whom they share the personal information of consumers (including employees/job applicants), conduct appropriate due diligence, and implement appropriate data governance measures where required.116 Duty to Implement Reasonable Security Measures The CCPA includes a requirement for employers to implement reasonable security measures to protect personal information. (See § 4.9.1) Remedies Violations of the CCPA can trigger administrative fines ranging from $2,500 for each violation to $7,500 for each intentional violation or violations involving personal information of consumers under 16 years of age.117 The CCPA does not provide a private right of action for any claims other than those relating to security breaches (see § 4.9.1).118 Nor does the CCPA provide a basis for a private right of action under any other law (e.g., section 17200 of the California Business & Professions Code).119 Enforcement The amended law went into effect on January 1, 2023 and has a one-year lookback period for any data collected by businesses from January 1, 2022. Enforcement will begin on July 1, 2023.120 1 Gerawan Farming, Inc. v. Lyons, 24 Cal. 4th 468, 489-90 (2000). 2 Compare Smith v. Fresno Irrigation Dist., 72 Cal. App. 4th 147, 165-66 (1999) (reversing judgment for plaintiff in lawsuit alleging wrongful termination when he was dismissed after testing positive for amphetamines, methamphetamines, and marijuana; random drug test was justified by hazards inherent in his employment) with Luck v. S. Pac. Transp. Co., 218 Cal. App. 3d 1 (1990) (mandatory drug testing of computer programmer was breach of implied covenant of good faith and fair dealing as it was an unwarranted intrusion under California Constitution’s privacy provisions; plaintiff was not a safety employee and no other compelling interests justified the testing). Luck’s “compelling interest” test for non-safety-related private sector drug testing was disapproved in Hill v. Natl’ Collegiate Athletic Ass’n, 7 Cal. 4th 1, 56-57 (1994). 3 Loder v. City of Glendale, 14 Cal. 4th 846 (1997) (upholding applicant testing as part of generally applicable pre-employment exam, where employer’s “substantial interest” overcame “relatively minor” intrusion on expectation of privacy, but disallowing testing of current employees seeking promotion), cert. denied, 522 U.S. 807 (1997); see generally Hill v. NCAA, 7 Cal. 4th 1 (1994) (privacy rights depend in part on reasonable expectation of privacy, and invasion of privacy can be justified by “countervailing interests” or by consent). See also Pilkington Barnes Hind v. Superior Court, 66 Cal. App. 4th 28 (1998) (upholding suspicionless applicant testing). 4 Lopez v. Pac. Mar. Ass’n, 657 F.3d 762 (9th Cir. 2011) (amended opinion issued on denial of rehearing and petition for rehearing en banc) (policy challenged not on privacy grounds but rather on the theory that “one strike” rule discriminated against former addicts on the basis of disability). 5 San Francisco, CA Municipal Code Pt. II, Police Code, ch. VII, article 33A, §§ 3300A.1-3300A.11 (Prohibition of Employer Interference with Employee Relationships and Activities and Regulations of Employer Drug Testing of Employees). 6 The EEOC tried to nudge federal law in California’s direction law in 2012, in the EEOC’s Enforcement Guidance on Consideration of Arrest and Conviction Records Under Title VII of the Civil Rights Act of 1964. See http://www.eeoc.gov/laws/guidance/arrest_conviction.cfm (visited Feb. 27, 2023). The EEOC argued that pre-employment inquiries about arrests not resulting in convictions have had a disparate impact on applicants in protected classifications such as national origin and race, and that use of arrest records “is not job related and consistent with business necessity.” This approach would still leave employers free, of course, to consider the underlying facts that led to the arrest. 7 Lab. Code §§ 432.7. Exceptions exist for certain types of arrests for peace officers and health care employees. See also Gov’t Code § 12952(a)(3) (employers, in checking conviction history on an applicant, generally must not consider or relay information about arrests not
RkJQdWJsaXNoZXIy OTkwMTQ4