COVID-19 Alert #7 - Three CCPA Implications of Business Screening for COVID-19

1) Covered businesses taking employees’ temperatures, or requiring customers or employees to report COVID-19 symptoms must provide an appropriate privacy notice at or before the point of collection.
2) Collecting such data may ultimately require the business to update its public-facing privacy policy, which must disclose all categories of personal information collected within the past 12 months.
3) Collecting biometric data (such as body temperature) and other personal health information exposes the business to a greater risk of being sued in the event of a data breach. Plan to restrict access, limit retention, and securely dispose of the data once it’s no longer needed.