APA jointly testified with the National Payroll Reporting Consortium before the California Consumer Privacy Act (CCPA) Public Forum in February with concerns about protecting payroll and employment data. The CCPA requires that implementing regulations account for compliance conflicts with other federal and state laws and directs the California Attorney General to create exceptions.
The problem lies with the broad and ambiguous definitions of “sale,” “personal information,” and “consumer” in the CCPA, said Pete Isberg, Vice President of Government Relations for ADP and co-chair of APA’s Government Relations Task Force Subcommittee on State and Local Topics, who spoke for both groups. Without clarification, the result is an inconsistent implementation of the law with the potential for a decrease in privacy protections.
The CCPA is intended to grant consumers new rights with respect to the collection of their personal information. A consumer can contact a business and ask what information it collects about the consumer, where it collected the information, and with whom it has shared the information. Consumers also may ask that their personal information be deleted and can opt-out of the sale of their personal information.
APA and NPRC asked the attorney general to eliminate any ambiguity by taking the following steps:
- Clarify the definition of sale. Whether the monetary consideration must be received for the actual purchase of personal data or another business arrangement where the data is not the subject of the exchange is significant. APA and NPRC asked for assurance that implementing regulations will not prevent the effectiveness of payroll activities against fraud, screening for money-laundering, and identity verification functions.
- Clarify the definition of personal information. The law is ambiguous as to whether it applies to any consumer information and not only the records of the individual making the request or an individual who purchased or received services from a covered business. Further, if applied to the employment context, the language does not state that the consumer must be an employee of the business. The regulations should indicate that an employer cannot delete required employment and tax records even at the request of an employee, APA and NPRC said.
