Mackall, Crounse & Moore, PLC has joined Dewitt Ross & Stevens S.C.

The newly formed DeWitt Mackall Crounse & Moore S.C. will provide clients with enhanced legal services
and efficiencies as well as access to more than 100 attorneys practicing in nearly 30 areas of
law in Wisconsin and Minnesota.

Dismiss this message


News & Education

Back to Firm News

Filter by:

The California Consumer Protection Act and You - Midwestern Based Employers Take Note

Am I Right that Midwestern-Based Employers Don’t Need to Be Concerned About The CCPA?  Please Tell Me I’m Right (Because I’m Getting A Little Worried Now)

You may be wondering why an attorney based in Madison, Wisconsin, is writing an article about the new California Consumer Protection Act (“CCPA”).  And that would certainly be a fair question.  I do not generally make it a practice to write about California laws.  However, I felt that I needed to make an exception here.  As you have likely guessed from the title above, certain employers based in the Midwest really do need to be concerned with the CCPA. 
So, what is the CCPA?

The CCPA is a consumer privacy law that, among other things. imposes various obligations on businesses seeking to obtain “personal information” from California residents, provides those residents with various rights, including the right to seek legal relief in certain circumstances, and provides for penalties in the event that businesses violate their obligations.  

Okay, what is “personal information”?  

The CCPA defines “personal information” broadly to include “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”  Cal. Civ. Code § 1798.140(o).  At a minimum, this information includes a resident’s “real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers” – in other words, information that employers regularly collect from their employees, job applicants and independent contractors.  

So, as an employer based in the Midwest, how could the CCPA apply to me?

It is probably obvious that employers with any degree of a physical presence in California should take a hard look at whether the CCPA imposes any obligations on them.  However, employers without any California physical location are not necessarily in the clear and could very easily be subject to the law.

By its terms, the CCPA applies to an employer if it: 1) does business in California; 2) collects personal information from one or more California residents; and 3) collects $25 Million or more in annual revenue [1]
.  Consequently, assuming that an employer conducts at least some degree of business in California and satisfies the revenue threshold, it will be subject to the law, without regard to whether or not it has a physical presence in the state, if it happens to employ any individuals who reside in California (i.e., a salesperson, a remote worker, etc.), or happens to accept any job applications from California residents.  

What are an employer’s obligations if the CCPA does apply?

Employers subject to the law need to get CCPA-compliant notices in place as soon as possible (technically, the notices were due no later than January 1, 2020).  At a minimum, the notices are required to set forth information regarding the categories of personal information the employer collects with respect to its California employees and applicants, the uses to which the employer puts that information, and the fact that California residents could have a private right of action against the employer if a data breach occurs, among other things.  These notices should be given to existing California employees through an employee handbook update or separate written policy, and should be included in any job application process pertaining to a California resident.  

In addition, if subject employers do not already have appropriate measures in place, they need to implement reasonable security measures and practices with respect to the personal information they collect/have already collected from California residents.          
Finally, because California is still working on permanent answers to the questions of how and to what extent the CCPA applies to employers, subject employers need to monitor the issue going forward and should prepare themselves for revisions (and, perhaps, additions) to their legal obligations in the future.   

Please contact John Gardner or any other member of DeWitt’s Employment Relations practice group if you need any assistance with respect to the CCPA, or just want to vent about the extreme breadth and broad reach of California’s employment (and general) laws.

[1] The CCPA also applies to business entities that buy, receive, or share personal information of 50,000 or more consumers, households, or devices, and/or derives 50% or more of their annual revenues from selling the personal information of California residents.  

About the Author

John Gardner is an attorney practicing out of our Madison office. He is the Chair of the Labor & Employment Relations practice group. He is also a member of the Litigation practice group. Contact John by email or by phone at (608) 252-9322.

Our Locations

Greater Milwaukee - Get Directions

Green Bay - Get Directions

Madison - Get Directions

Minneapolis -Get Directions



Get to know us

DeWitt LLP is one of the ten largest law firms based in Wisconsin, with an additional presence in Minnesota. It has more than 120 attorneys practicing in Madison, Metropolitan Milwaukee and Minneapolis in over 30 legal practice areas, and has the experience to service clients of all scopes and sizes.


We are an active and proud member of Lexwork International, an association of mid-sized independent law firms in major cities located throughout the Americas, Europe and Asia and an active member of SCG Legal, an association of more than 140 independent law firms serving businesses in all 50 state capitals and major commercial centers around the world.


Super Lawyers 2020
Best Lawyers 2013 – 2020
Compass Award 2012
Top 100 Lawyers: National Trial Lawyers Association Best in 2020


While we would like to hear from you, we cannot represent you until we know that doing so will not create a conflict of interest. Accordingly, please do not send us any information about any matter that may involve you until you receive a written statement from us that we represent you (an “engagement letter”). You will not be a client of the firm until you receive such an engagement letter.

The best way for you to initiate a possible representation is to call DeWitt LLP at 608-255-8891. We will make every effort to put you in touch with a lawyer suited to handle your matter. When you receive an engagement letter from one of our lawyers, you will be our client and we may exchange information freely.

Please click the “OK” button if you understand and accept the foregoing statement and wish to proceed.