As data privacy talks in Congress heat up, HR Policy urged policymakers to consider the inherent differences between consumer and HR data to ensure that legislation expanding privacy rights for consumers does not inadvertently undermine employers’ efforts to provide leading wages, benefits, and safe workplaces.
Consensus forming on federal privacy legislation? Questions on whether a federal privacy law should preempt state laws and whether to include a private right of action have been major sticking points in forming agreement around consumer data privacy legislation. However, compromise solutions may be taking shape. John Beezer, a senior advisor to Senate Commerce Chairwoman Cantwell (D-WA), said at a recent conference, “I'm not going to say those things are resolved, but I would say they're substantially less of an obstacle than they used to be, from my perspective.”
Consumer privacy protections not designed with the workplace in mind: Each of the four state consumer data privacy bills enacted by California, Utah, Virginia, and Colorado—and Connecticut’s SB 6, which is awaiting the governor’s signature—recognize that consumer privacy rights are not designed with the workplace in mind and exclude HR data.
“There are clear and vital reasons for employers to process employment-related personal information about employees and contractors,” our letter to the key committees reads. “Employers collect and process information about workers that is essential for issuing pay checks, administering benefits—such as health insurance and paid leave—and withholding taxes. Rights appropriate to the consumer context, such as the right to be forgotten, to have prescribed forms of disclosure, and to opt out of the transfer of personal data, would do more harm than good if applied in the employment context.”
Outlook: It is unclear whether the consumer privacy legislation will be taken up this year, despite potentially significant progress toward reaching consensus between the parties in key committees. However, in California, it is looking increasingly likely that a workplace-focused data privacy and algorithmic protections measure will be considered by the end of the state’s legislative session in August, even after a union-backed comprehensive workplace privacy bill (AB 1651) was withdrawn. Absent such an enactment, the current exemption of HR data from the state’s data privacy law will expire on January 1, 2023.