Mackall, Crounse & Moore, PLC has joined Dewitt Ross & Stevens S.C.

The newly formed DeWitt Mackall Crounse & Moore S.C. will provide clients with enhanced legal services
and efficiencies as well as access to more than 100 attorneys practicing in nearly 30 areas of
law in Wisconsin and Minnesota.

Dismiss this message


News & Education

Back to Firm News

Filter by:

The California Consumer Protection Act and You - Midwestern Based Employers Take Note

Am I Right that Midwestern-Based Employers Don’t Need to Be Concerned About The CCPA?  Please Tell Me I’m Right (Because I’m Getting A Little Worried Now)

You may be wondering why an attorney based in Madison, Wisconsin, is writing an article about the new California Consumer Protection Act (“CCPA”).  And that would certainly be a fair question.  I do not generally make it a practice to write about California laws.  However, I felt that I needed to make an exception here.  As you have likely guessed from the title above, certain employers based in the Midwest really do need to be concerned with the CCPA. 
So, what is the CCPA?

The CCPA is a consumer privacy law that, among other things. imposes various obligations on businesses seeking to obtain “personal information” from California residents, provides those residents with various rights, including the right to seek legal relief in certain circumstances, and provides for penalties in the event that businesses violate their obligations.  

Okay, what is “personal information”?  

The CCPA defines “personal information” broadly to include “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”  Cal. Civ. Code § 1798.140(o).  At a minimum, this information includes a resident’s “real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers” – in other words, information that employers regularly collect from their employees, job applicants and independent contractors.  

So, as an employer based in the Midwest, how could the CCPA apply to me?

It is probably obvious that employers with any degree of a physical presence in California should take a hard look at whether the CCPA imposes any obligations on them.  However, employers without any California physical location are not necessarily in the clear and could very easily be subject to the law.

By its terms, the CCPA applies to an employer if it: 1) does business in California; 2) collects personal information from one or more California residents; and 3) collects $25 Million or more in annual revenue [1]
.  Consequently, assuming that an employer conducts at least some degree of business in California and satisfies the revenue threshold, it will be subject to the law, without regard to whether or not it has a physical presence in the state, if it happens to employ any individuals who reside in California (i.e., a salesperson, a remote worker, etc.), or happens to accept any job applications from California residents.  

What are an employer’s obligations if the CCPA does apply?

Employers subject to the law need to get CCPA-compliant notices in place as soon as possible (technically, the notices were due no later than January 1, 2020).  At a minimum, the notices are required to set forth information regarding the categories of personal information the employer collects with respect to its California employees and applicants, the uses to which the employer puts that information, and the fact that California residents could have a private right of action against the employer if a data breach occurs, among other things.  These notices should be given to existing California employees through an employee handbook update or separate written policy, and should be included in any job application process pertaining to a California resident.  

In addition, if subject employers do not already have appropriate measures in place, they need to implement reasonable security measures and practices with respect to the personal information they collect/have already collected from California residents.          
Finally, because California is still working on permanent answers to the questions of how and to what extent the CCPA applies to employers, subject employers need to monitor the issue going forward and should prepare themselves for revisions (and, perhaps, additions) to their legal obligations in the future.   

Please contact John Gardner or any other member of DeWitt’s Employment Relations practice group if you need any assistance with respect to the CCPA, or just want to vent about the extreme breadth and broad reach of California’s employment (and general) laws.

[1] The CCPA also applies to business entities that buy, receive, or share personal information of 50,000 or more consumers, households, or devices, and/or derives 50% or more of their annual revenues from selling the personal information of California residents.  

About the Author

John Gardner is an attorney practicing out of our Madison office. He is the Chair of the Labor & Employment Relations practice group. He is also a member of the Litigation practice group. Contact John by email or by phone at (608) 252-9322.

Our Locations

We are currently limiting the amount of outside visitors to the firm.  

Please work directly with your attorney who will coordinate any onsite visits to ensure the safety of our clients and colleagues.


2 East Mifflin Street, Suite 600
Madison, WI 53703
(608) 255-8891
Get Directions

Greater Milwaukee

13845 Bishop’s Drive, Suite 300
Brookfield, WI 53005
(262) 754-2840
Get Directions


2100 AT&T Tower,
901 Marquette Avenue
Minneapolis, MN 55402
(612) 305-1400
Get Directions

Get to know us

DeWitt LLP is one of the ten largest law firms based in Wisconsin, with an additional presence in Minnesota. It has nearly 140 attorneys practicing in Madison, Metropolitan Milwaukee and Minneapolis in over 30 legal practice areas, and has the experience to service clients of all scopes and sizes.

Our People
Our Law Firm
Areas of Expertise
News & Education
Contact Us


We are an active and proud member of Lexwork International, an association of mid-sized independent law firms in major cities located throughout the Americas, Europe and Asia and an active member of SCG Legal, an association of more than 140 independent law firms serving businesses in all 50 state capitals and major commercial centers around the world.


Best Lawyers 2013 – 2018
Compass Award 2012
Top 100 Lawyers: National Trial Lawyers Association


While we would like to hear from you, we cannot represent you until we know that doing so will not create a conflict of interest. Accordingly, please do not send us any information about any matter that may involve you until you receive a written statement from us that we represent you (an “engagement letter”). You will not be a client of the firm until you receive such an engagement letter.

The best way for you to initiate a possible representation is to call DeWitt LLP at 608-255-8891. We will make every effort to put you in touch with a lawyer suited to handle your matter. When you receive an engagement letter from one of our lawyers, you will be our client and we may exchange information freely.

Please click the “OK” button if you understand and accept the foregoing statement and wish to proceed.