The Connecticut Senate unanimously passed a comprehensive consumer privacy measure that excludes HR data except in circumstances involving a solely automated process that impacts an individual’s employment opportunities. Also this week, a concerning California workplace privacy bill reported last week was withdrawn from consideration this year, with HR exclusions under existing law to expire by year’s end, absent further action.
Under Connecticut’s S.B. 6, individuals would have the right to access, obtain a copy of, correct, and delete their personal data being processed by an employer using a solely automated process in circumstances involving the provision or denial of an employment opportunity.
HR data exclusion: However, the personal data of individuals acting in an “employment context or as an employee, owner, director, officer or contractor of a company” would not be covered by the legislation. If the Connecticut bill becomes law, five out of five state consumer privacy laws would align in not covering such data.
CA comprehensive workplace privacy bill withdrawn: In California, a measure that would impose significant restrictions on the use of HR technologies and requirements on employers—and be enforced by a strong private right of action—was withdrawn by its sponsor, Assemblymember Ash Kalra (D-San Jose).
Down, but not out: “As conversations continued with our sponsors, stakeholders, and Assembly Privacy & Consumer Protection Committee,” Kalra noted in a statement, “it became evident that this complex issue requires more time for further engagement. While I am disappointed the bill will not move forward tomorrow, I remain committed on working to ensure we provide protections for workers whose work is regulated and measured by technology every day.”
Outlook: Employers now turn their focus to the sunset provision in California’s HR data exclusion, which is set to expire on January 1, 2023. If the exclusion is allowed to sunset, the requirements under California’s consumer privacy laws would apply to the workplace—such as a requirement to disclose, correct, and delete personal data, including potentially personnel records and performance reviews, upon a worker’s request.
