A new bill would extend the exclusion of HR data in California’s privacy law to 2026 as a new ruling in Illinois could provide a precedent for federal labor law preemption of state privacy measures where covered by a labor agreement.
California Assembly member Evan Low’s AB 2871 would extend the California Consumer Privacy Act’s HR data exemption through December 31, 2026. The exemption is currently set to sunset on January 1, 2023.
The measure is expected to face legal challenges by privacy advocates even if it passes. If the exemption is allowed to expire, HR data will be subject to the CCPA’s requirements—which could disrupt employer talent strategies. Alternatively, privacy advocates could introduce and push HR-focused data privacy legislation.
Meanwhile, the Appellate Court of Illinois ruled that the federal Labor Management Relations Act preempts the state’s Biometric Information Privacy Act. In the case, a union employee of Chicago’s Roosevelt University claimed the university violated the privacy act by requiring him to scan his hand to check in and out of work. The court, however, ruled that the claims were preempted by the NLRA since hand scanning was covered by the collective bargaining agreement between the plaintiff’s union and the university.
“The members of the collective bargaining unit in this case have surrendered their individual right to bargain with their employer about timekeeping procedures, even where those timekeeping procedures also include the collection and use of the employees’ biometric information,” the judge wrote.
Outlook: Twenty-two states are actively considering consumer data privacy legislation, pressuring on Congress to act. Next week, the House Energy & Commerce Committee will hold a hearing focusing on several privacy and AI-focused bills.