Steps Businesses Should Take to Address the End of the California Workforce Data Exception

If your business has California employees, applicants or contractors, it’s time to review your current policies to ensure compliance with the recent changes that include additional workforce member rights. 

The California Consumer Privacy Act (CCPA) of 2018 was amended by the California Privacy Rights Act of 2020 (CPRA). As of Jan. 1, CPRA amendments provide additional privacy rights not only to consumers but to employees, applicants and contractors as well. If your business’s consumer privacy policies have been updated to reflect the recent CCPA amendments, there are distinctions between the obligations for consumers and workforce members that businesses must address in the near future.

The previous CCPA workforce data exception is no longer available pursuant to the CPRA amendments. While the CPRA amendments were effective as of Jan. 1, enforcement of the new protections is currently scheduled to begin on July 1.

The workforce members’ six new rights include:

• • Right to know what personal information has been collected by a business
  • Right to correct inaccurate personal information held by a business
  • Right to delete personal information held by a business
  • Right to opt out of having their personal information sold or shared by a business
  • Right to restrict use or disclosure of their sensitive personal information
  • Right not to be retaliated against for exercising their rights under CCPA

As a result, businesses should have the following workforce capabilities:

• • Provide a privacy notice at the point of collecting personal information
  • Provide a method and means to exercise the new workforce rights
  • Provide a more detailed privacy policy to workforce members

As the enforcement date of July 1 grows near, now is the time to ensure your business is compliant with the new California workforce members’ rights. The act currently permits private rights of action for data breaches, but not yet for employee notification and rights violations. Please contact Karleen Green, Jason Pill, Walt Green or any member of Phelps’ Labor and Employment or Cybersecurity, Privacy and Data Protection teams if you have questions or need compliance advice and guidance.