CALIFORNIA: CCPA privacy notice expands to include vaccine records

We recently expanded our model data privacy notice under the California Consumer Privacy Act (CCPA) of 2018 to include vaccination records and disclosures to third parties who have a business need to know the information. See our newly revised Model Form, Notice of Data Privacy for Employees and Applicants, for example language. As we previously reported, the CCPA applies to for-profit employers with gross annual revenues of more than $25 million. Covered employers must provide certain disclosures to applicants, employees, and contractors who are California residents before obtaining their personal data for employment purposes.

Many employers are now grappling with whether to ask employees to verify that they have been vaccinated for COVID-19 (coronavirus). This question is relevant for employers who want to offer voluntary incentives for getting fully vaccinated, as well as for employers who want to make vaccination mandatory (subject to legally protected exceptions for employees with objections based on sincerely held religious beliefs or disability concerns). If you’re a covered employer and you plan to ask employees whether they have been vaccinated, it would be a good idea to incorporate vaccination records into your CCPA notice.

Tips: The explanation section at the beginning of our Model Form has also been updated to address the California Privacy Rights Act of 2020 (CPRA), which as we recently reported, takes effect on January 1, 2023, although it applies to data collected on or after January 1, 2022. If you need help customizing the privacy notice for your needs, contact your Vigilant Law Group employment attorney.