CCPA Is the Only Comprehensive State Privacy Law Covering Employee Data. BIPA, SHIELD and the AI Video Interview Act Still Reach Your Records.

A privacy program built around the comprehensive state privacy laws will answer almost nothing about the personnel file. The reason behind that gap is a structural one. Nearly all of those laws exclude human resources data by design, and California is the exception only because its exclusion, in California Civil Code 1798.145(m), went inoperative on January 1, 2023.

Outside California, the statutes that cover an employee record are something else entirely. Each is a narrow statute aimed at a single practice. 740 ILCS 14 covers a biometric time clock, and 820 ILCS 42 covers a video interview screened by software.

New York General Business Law 899-bb covers a database holding a New York resident's private information. Each has its own trigger and its own duty. You will not find any of them on a map of state privacy regimes.

Those regimes split the compliance question in 2 for an institution in higher education. The first asks which comprehensive state privacy law covers your employee records, and the second asks which narrow statutes apply to what you already hold. They have different answers and different consequences, and only the second produces work most weeks. Both begin at the same place, which is the personnel file.

The Comprehensive Laws Carve HR Data Out. California Stopped.

Start with the comprehensive laws, because the personnel file is where they stop. California wrote its human resources exclusion as a temporary measure. Only one state ever let that stopping point lapse.

California Civil Code 1798.145(m)(1) removed the CCPA's application to personal information collected about a natural person acting as a job applicant or employee of that business. The subdivision covered owners, directors, officers, medical staff members, and independent contractors too. It also covered emergency contact information and data held to administer benefits.

Subdivision (m)(4) then set an end date in one sentence. The subdivision shall become inoperative on January 1, 2023. The code's own annotation records the same outcome, that subdivisions (m) and (n) went inoperative on that date by their own provisions.

What the Lapse Changed

Once that subdivision went inoperative, records an HR department had held outside the CCPA came inside it. The obligations the statute places on a business, and the rights it gives the people it covers, now apply to applicant, employee, and contractor data in California. They apply on the same terms as any other personal information.

That is the whole of the comprehensive story here. Every other comprehensive state regime keeps its human resources carve-out, so an institution operating outside California will find those laws quiet about the personnel file. The narrow statutes are another matter, and several of them apply to the file you already keep.

The Statutes That Do Reach a Personnel File Are Not Privacy Laws

Those narrow statutes are where most of the work is. Each is triggered by a practice, and 3 of them apply to an ordinary personnel file. Buying a new tool is usually what triggers one.

Why the Employment Relationship Is Inside Each One

BIPA settles the question inside its own definitions section. 740 ILCS 14/10 defines a written release as informed written consent or an electronic signature. In the context of employment, it also covers a release executed by an employee as a condition of employment. The statute contemplates the employment relationship on its face, which is why a fingerprint time clock became the standard BIPA fact pattern.

The AI Video Interview Act follows the same pattern one stage earlier, covering applicants. 820 ILCS 42/5 requires an institution screening applicants with software for an Illinois-based post to give notice, provide an explanation, and obtain consent. All 3 of those happen before the interview is recorded.

Recording where somebody lives is what New York asks about. New York General Business Law 899-bb applies to any person or business that owns or licenses computerized data including private information of a New York resident. The statute includes no exclusion for the employment context. An institution with 1 New York employee owns computerized data about a New York resident.

A resident in 1 state is enough, which makes these harder to plan for than a comprehensive regime. A comprehensive law can be answered once, at the level of the institution. A narrow statute has to be answered practice by practice.

2 of the 3 above are triggered by a tool somebody chose to buy, which is the records problem set out in this guide to employee documentation that survives an inspection. None of it appears on a privacy law map. The harder mistake runs the other way, when a statute is assumed to apply and does not.

The One That Looks Like It Applies and Does Not

That assumption is tested most often by one statute in particular. Washington's My Health My Data Act, RCW 19.373, is written in language that sounds like it covers any health-related record an organization holds, and an HR department holds several of those. Leave records, accommodation files, and occupational health results all describe a person's health.

Common but wrong

My Health My Data covers the health information in our HR files.

RCW 19.373.010(7) defines consumer as a natural person who acts only in an individual or household context, and states that consumer does not include an individual acting in an employment context. The Act excludes the employment relationship in its definitions.

Those health records are outside the Act, and the exclusion in RCW 19.373.010(7) has 3 consequences worth writing down.

• A Washington employee's leave record is outside the Act, because that person is acting in an employment context.
• The same person's consumer health data, collected outside employment, is inside it.
• An institution can be subject to the Act for its public-facing services while its own workforce is outside it.

Assuming one applies is no harmless excess of caution. A policy asserting that RCW 19.373 covers HR records creates obligations the statute does not impose. The institution has invented those obligations for itself, and an auditor reading that policy will hold it to them. The correction belongs in the records your office keeps.

2 Deadlines That Belong to the Records System

The records themselves are subject to 2 separate deadlines. Neither is counted the way an annual review is counted. Both of them are set by somebody outside your office.

1. Destruction under BIPA. Under 740 ILCS 14/15(a), a private entity holding biometric identifiers must develop a written retention schedule and destruction guidelines, made available to the public, and must destroy the data when the initial purpose has been satisfied or within 3 years of the individual's last interaction with the entity, whichever occurs first. The count begins at the individual's last interaction.
2. Deletion under the AI Video Interview Act. Under 820 ILCS 42/15, on request from an applicant the employer must delete that applicant's video interviews within 30 days, and must instruct anyone who received copies to delete them as well, including all electronically generated backup copies. The count begins at the request.

Why Neither Fits an Annual Cycle

A compliance calendar is built around dates the institution picks. Both of these run on dates other people set. The 3 year count in 740 ILCS 14/15(a) starts at a former employee's last interaction, which is a fact recorded in a system. The 30 day count in 820 ILCS 42/15 starts when a request arrives without notice.

The published retention schedule in 740 ILCS 14/15(a) is the part most often missing. It has to exist as a document, be available to the public, and describe what the systems do. An institution whose schedule says one thing while its time clock database does another has published the discrepancy itself. Whether any of this applies at all depends on one more definition.

Why an Illinois Public Institution Answers Differently

Whether BIPA applies at all is settled by the definition of private entity in 740 ILCS 14/10. The definition itself runs to only a couple of lines. It decides the answer for a whole sector of institutions.

740 ILCS 14/10 provides that a private entity does not include a State or local government agency. It also excludes any court of Illinois, a clerk of the court, or a judge or justice. BIPA's duties run to private entities, so an institution that is a State agency is outside them on facts that would place a private institution inside.

For this sector the line has nothing to do with size or practice. Ownership of the institution is what the definition turns on. It produces 3 quite different positions across the sector:

• A private university in Illinois using a biometric time clock is inside BIPA, and owes written notice, a written release, and a published retention schedule.
• An Illinois public university using the same time clock on the same terms is outside BIPA.
• Neither position changes the AI Video Interview Act, which applies to employers without that carve-out, or the SHIELD Act, which applies by the residence of the person.

The Costlier Direction to Be Wrong In

An institution that treats its public status as the answer to everything will be wrong about 2 of those 3 statutes. The costlier error runs the other way, when a private institution assumes BIPA is a consumer statute and overlooks the definition that names employees explicitly. Both errors are cheap to avoid and expensive to discover.

Institutions here already run a parallel analysis on the student side, where FERPA obligations are governed by different definitions again. The employee record needs its own answer under 740 ILCS 14, 820 ILCS 42, and 899-bb, written somewhere a person can find it, and matching what the file can show.

What the Personnel File Has to Be Able to Show

What the file can show is the compliance position, because every question above is answered with evidence. None of these statutes requires an institution to train anyone.

Each requires a written release on file for each person whose biometrics were collected. A published retention schedule describing system behavior is required too. So is a record that an applicant was told about the artificial intelligence analysis before the interview, alongside a deletion completed within 30 days of a request.

KC Docs keeps policy versions and targeted attestations attached to the people they apply to. The retention schedule required by 740 ILCS 14/15(a) can therefore be produced in the form it had on any past date. The written release a named employee signed can be found without a search through a shared folder.

The comprehensive laws will keep changing, and the count of states with one will keep going up. The narrow statutes are where the work will come from. Every new tool an institution adopts adds a practice, and a practice is what each of these 4 statutes is written about. An institution that can produce the document behind each practice will answer the next statute the way it answered these.

Frequently Asked Questions

1. Which state privacy laws cover employee data?

Among the comprehensive state privacy regimes, the CCPA is the one that applies to employee records, because its human resources exclusion in California Civil Code 1798.145(m) became inoperative on January 1, 2023 by the terms of the statute. The other comprehensive regimes keep their carve-outs. Separately, narrow statutes such as the Illinois Biometric Information Privacy Act, the Illinois AI Video Interview Act, and the New York SHIELD Act apply to employee or applicant records through their own triggers.

2. Does BIPA apply to employees?

Yes. 740 ILCS 14/10 defines a written release to include, in the context of employment, a release executed by an employee as a condition of employment, so the statute contemplates the employment relationship directly. Under 740 ILCS 14/15(b) a private entity must give written notice that a biometric identifier is being collected, give written notice of the specific purpose and length of term, and obtain a written release before collecting it.

3. Does My Health My Data apply to employee records?

No. RCW 19.373.010(7) defines consumer as a natural person who acts only in an individual or household context, and states that consumer does not include an individual acting in an employment context. An employee's leave record or occupational health file is outside the Act on that basis, although the same person's consumer health data collected outside employment can be inside it.

4. When did the CCPA HR data exemption expire?

California Civil Code 1798.145(m)(4) states that the subdivision shall become inoperative on January 1, 2023, and the code's annotation records that subdivisions (m) and (n) went inoperative on that date by their own provisions. The exemption had covered personal information collected about job applicants, employees, owners, directors, officers, medical staff members, and independent contractors, along with emergency contact and benefits administration data.

5. Does the AI Video Interview Act apply to a public university?

The Act applies to employers that ask applicants to record video interviews and use an artificial intelligence analysis of those videos for positions based in Illinois, and it contains no exclusion for public bodies of the kind BIPA has. BIPA is the statute where public status matters, because 740 ILCS 14/10 states that a private entity does not include a State or local government agency.

References

1. California Legislative Information. "California Civil Code 1798.145(m)(1), the human resources exemption as enacted."
2. California Legislative Information. "California Civil Code 1798.145(m)(4), the subdivision becomes inoperative on January 1, 2023."
3. Illinois General Assembly. "740 ILCS 14/10, definitions of written release and private entity."
4. Illinois General Assembly. "740 ILCS 14/15(a) and 15(b), retention schedule, destruction, and consent before collection."
5. Illinois General Assembly. "820 ILCS 42/5, 42/10 and 42/15, Artificial Intelligence Video Interview Act."
6. New York State Senate. "NY General Business Law 899-bb, data security protections."
7. Washington State Legislature. "RCW 19.373.010(7), definition of consumer under the My Health My Data Act."