HR Departments Beware: The CPRA Is Coming

Why This Privacy Law is Important:

The one group exempted from the majority of the California Consumer Privacy Act of 2018 (CCPA) is employees, job applicants, and contractors. That exemption is scheduled to expire on December 31, 2022, and the California Privacy Rights Act (CPRA) will go into effect the following day, January 1, 2023. When it does, California residents who are employees, job applicants, and contractors will be entitled to the full suite of data privacy rights as other California residents - a significant expansion of the existing law and a potential operational challenge for many organizations and their HR departments.

Overview:

In 2018, California became the first state in the nation to sign into law a comprehensive consumer data privacy law, the CCPA. The CCPA, which took effect on January 1, 2020, provides most California residents with broad rights over how their personal information is collected, used, and shared by covered businesses and their service providers. 

Employees, job applicants, and contractors were excluded from 90% of the law’s protections. Instead, that group of California residents have been entitled to two protections under the CCPA: (1) a notice at or before the point of collection explaining what information is being collected about them and how it will be used; and (2) the right to bring a private right of action in the event of a negligent security incident. They have not, however, been entitled to assert any of the CCPA related data subject rights, such as the right to