TheConsumer Privacy Act applies to companies with gross revenues of$25 million or more and that receive, sell or share personalinformation about more than 50,000 Californians or that derive morethan half their revenue from selling customer data. (Photo: JasonDoiy/ Recorder)

State lawmakers have sent to Gov. Gavin Newsom what will likelybe the final amendments to the California Consumer Privacy Act before thelandmark data-privacy bill goes into effect on Jan. 1.

The proposed changes offer some clarification for businesses andemployers, but they also renewed calls from the tech industry forthe U.S. Congress to override the new state law that lets consumersknow, and in some cases control, what information companies collectabout them.

Related: 5 technology and data trends affecting employeebenefits

"Actions taken by the Legislature this year will improve theCalifornia Consumer Privacy Act, but many clarifications are stillnecessary before it will work for consumers and businesses,"Courtney Jensen, Technet's executive director for California, saidin a statement. "The importance of federal action to avoid apatchwork of privacy laws has never been clearer, and we urgeCongress to act."

The amendments do not reflect the broadest changes sought byboth advocates and critics of the California Consumer Privacy Act,or CCPA. There will be no private right of action. There are nomass exemptions.

"The most significant thing about CCPA amendments is actuallythat very few changes will take place," said Lydia de la Torre, ofcounsel at Squire Patton Boggs. "Most bills were defeated and thechanges are modest."

The clock is ticking, however, for employers to comply with thenew law.

The Consumer Privacy Act applies to companies with grossrevenues of $25 million or more and that receive, sell or sharepersonal information about more than 50,000 Californians or thatderive more than half their revenue from selling customer data.

The definition covers employers, too, and the information theycollect about job applicants and workers. Amendments sent to thegovernor, however, give employers a one-year exemption fromrequirements that they disclose that information upon request. Thedelay is designed to give labor groups, privacy advocates andbusiness association time to hammer out a compromise about whatdata employers need to share with their workers.

"Everyone is going to have to sit down with their counsel andsay, 'OK, does this exempt me?'" said Philip Recht, partner incharge of Mayer Brown's Los Angeles office. "If they conclude thatthey are covered to some extent, they have to decide how they'regoing to comply from a mechanical, operational perspective."

If the law is not amended in 2020 to extend the exemption orpermanently change the workplace provisions, employers should "getready for access requests from current and former employees, whichtend to be complicated and time consuming," de la Torre said. "Apitfall to avoid is long retention periods especially forunstructured data" such as emails, she said.

Draft regulations that may also offer more compliance guidanceto employers are due from Attorney General Xavier Becerra thisfall.

Becerra's office earlier this year asked for public comments ona wide range of Consumer Privacy Act topics, including possibleexemptions from the law and requirements for complying withrequests for data. The attorney general will begin enforcing thenew law in July.

Here are other key Consumer Privacy Act bills sent to thegovernor:

>>> AB 1355 creates a one-yearexemption shielding business-to-business communications andtransactions from certain disclosure provisions. The bill alsoauthorizes the attorney general to decide what constitutes a"verifiable consumer request" for information in an attempt toensure that personal data does not fall into the wrong hands.

>>> AB 1146 allows a business tokeep customers personal information if that data is necessary toprovide a warranty or product recall information.

>>> AB 874 clarifies that thedefinition of personal information under the Consumer Privacy Actdoes not include "deidentified" or aggregate consumer data. Themeasure adds business-sought language clarifying that personalinformation must be "reasonably capable" of being associated with aparticular consumer or household, as opposed to just "capable," tobe subject to the law's disclosure requirements.

Read more:

• 5 technology and data trends affecting employeebenefits
• Companies working hard on GDPR compliance, buthealth care and finance lag
• Oregon bill would allow consumers to monetizehealth data