It also gives consumers the right to delete the data held by a business or a business's "service provider" — the latter distinction familiar to those in the retirement industry.

"The language seemed so broad that it encompassed a lot of things the bill wasn't intended to regulate," explained Rouse. The data swept under the law could be applied to any employee information—a home address, an email, a social security number.

And that includes virtually all of the other information on an employee that's needed to offer and deliver the most basic of workplace benefits, to say nothing of the more bespoke offerings that have emerged in the retirement space that tailor specific solutions to specific data sets.

"The law basically encompasses any information that can be linked to an individual—fundamental information that retirement and benefits plans need," explained Kevin Walsh, a partner at The Groom Law Group.

"Privacy laws are designed to regulate how big data is being used to market to consumers," explained Walsh. "If the laws are drafted too broadly, they can interfere with a whole bunch of services society views as good things. In the retirement system, it's accepted that we want third parties to look out for participants' interests. None of that operates without allowing service providers to use plan data."

Cali's lawmakers willing to listen—at least for now

SPARK created a data privacy committee in the wake of the European Union's passage and implementation of the General Data Protection Regulation in 2016. Initially, SPARK's members were 50-50 on that regulation's impact on the retirement sector, said Rouse. But as California's initiative emerged, more members said data privacy laws were correlated to the provision of retirement benefits.

SPARK hired The Groom Law Group to lead its lobby effort in California. It worked—or has so far. Last year, before the law was implemented, the legislature passed an amendment that exempts employers from the CCPA relative to information collected on a job applicant, an employee, or contractor of that business.

"There was a lot of resonance with the message that employers need to use employee data to deliver benefits," said Walsh. "Lawmakers listened—it was kind of an 'ah ha, how did we forget that' moment."

But a significant problem remains. The amendment that protects the provision of retirement benefits from the regulation is scheduled to sunset at the end of 2020.

Why an amendment was passed with such a short shelf life is not clear. But California's Attorney General has issued a revised proposal that would change language in the original bill to specify the definition of employee benefits, and define the administration of employee benefits as a business purpose that is exempted from the CCPA's broader restrictions on data collection.

A 15-day comment period recently closed on the proposed revisions. Other industry businesses and trade groups, including Alight Solutions and the American Benefits Council, also weighed in.

"There is still work that needs to be done," said Rouse. Washington State is in the process of crafting a data privacy law that includes a benefits carve-out that he said may not be broad enough. Industry is also at work developing technologies that would give participants greater control over how their data is used, both Walsh and Rouse said.

And at the federal level, data privacy proposals are being drawn up in both chambers of Congress.

That could ultimately create legal friction if a federal statute is at odds with the states that first crossed the finish line.

"Congress is clearly looking at this," said Walsh. "Preemption will be a key issue—will a federal standard apply nationwide. Complying with 50 different data privacy laws would be a nightmare for sponsors, and not good for participants."