Employer CCPA FAQs #9: May an employer become subject to the CCPA because of a corporate transaction?

As our series of FAQs regarding the California Consumer Privacy Act (“CCPA”) continues we are examining the scope of the law’s jurisdiction. These FAQs should help employers determine if they are required to comply with the CCPA and if so, what steps their HR professionals and IT departments should take to be in compliance.

As a reminder, the CCPA is a new privacy law that applies to data collected about California-based employees. The CCPA will go into effect in early 2020, and employers who must comply should be addressing compliance obligations now.

For US employers who have not had to comply with the GDPR, the requirements of the CCPA will likely require a new analysis of the treatment of employee-data and implementation of updated or new data policies. For employers with European operations, one key area of interest is the degree to which the CCPA aligns with the European General Data Protection Regulation (“GDPR”). Employers in compliance with the GDPR will likely already be familiar with many of the requirements of the CCPA – and with some assistance, should be able to bring their operations and policies into compliance with respect to California-based employees.

BCLP offers a complete compliance program for employers that includes a formal gap assessment and tailored policies, procedures, and protocols to close identified gaps. Bryan Cave Leighton Paisner LLP has a team of knowledgeable lawyers and other professionals prepared to help employers address their obligations under the California Consumer Privacy Act. If you or your organization would like more information on this or any other employment issue, please contact an attorney in the Employment and Labor practice group.

Question #9: May an employer become subject to the CCPA because of a corporate transaction?

Yes.

As discussed in the FAQ #2, the CCPA applies to a “business” -- a term that is defined as an entity that “does business in the State of California” and that meets one of the following three thresholds:

1. Annual gross revenue in excess of $25 million,
2. Purchases, receives for commercial purposes, sells, or shares for commercial purposes, personal information of 50,000 or more consumers, or
3. Derives 50% of annual revenue from selling consumer personal information.^[1]

An employer that does not meet the definition of “business” before acquiring another entity could meet the definition of a “business” following the acquisition.  The following provide a few examples of situations where this might occur:

1. Acquirer has more than $25 million in gross revenue, but does not have California-based employees and does not “conduct business” within California. Target is based in California and is folded into an existing operating division of Acquirer.  Post-closing the Acquirer may satisfy the definition of “business” under the CCPA.^[2]
2. Acquirer has less than $25 million in gross revenue (e.g., $20 million). The Target is based in California with gross revenues that will result in the post-closing entity exceeding $25 million in gross revenue (e.g., $6 million).  The Target will be folded into an existing operating division of Acquirer.

Employers with no California operations that are contemplating a transaction that may result in employing California residents post-closing should be prepared to address their CCPA compliance obligations relating to the newly acquired California employees.  In particular, such an employer should plan for incorporating CCPA compliant provisions in employee privacy notices, employee policies, security procedures and applicable vendor contracts.

[1] CPPA, Section 1798.140(c)(1)(A)-(C).

[2] While the three thresholds contained within the definition of a “business” have yet to be interpreted by a court, note that the first revenue-oriented threshold that the statute does not specify that the $25 million must be generated within the state of California.