CCPA Applies to Employment Information Starting January 1, 2023

A series of amendments to the California Consumer Privacy Act (“CCPA”) will take effect on January 1, 2023, resulting in big changes for your company’s privacy program. The most significant of these is the end of the existing exemption for personal information relating to employees, contractors, and job applicants. Employment information will be subject to the same CCPA protections and controls that currently apply to other categories of personal information. Combined with the California Attorney General’s recent $1.2 million CCPA settlement with Sephora, California is reminding companies everywhere to take CCPA compliance seriously.

If your company currently leverages the employment information exemption (e.g., business offering B2B, professional, networking, or recruiting products and services), it will be essential to reconfigure key aspects of existing privacy strategies to remain in compliance. As a standard bearer in U.S. consumer privacy law, these CCPA amendments will impact most businesses operating throughout the United States.

What can your company do to prepare?

  • California residents? Determine how many end users, employees, contractors, or applicants of the company are California residents and identify the personal information collected and processed about those individuals.
  • Sale, sharing, and other disclosures. Determine whether the personal information is sold, shared, or otherwise disclosed to third parties (e.g., vendors, affiliates, service providers, etc.) and, if so, for what purpose. Note if any of this personal information is “sensitive” in nature as defined under the CCPA, so the company can provide the necessary processing protections.
  • Update your Privacy Policy. Update your privacy policy to include the necessary notices, disclosures, and privacy rights now applicable to employee information under the CCPA.
  • Adjust your privacy practices. Adjustment of your company’s underlying privacy practices to ensure that employment data is collected and processed in compliance with the CCPA.
  • Employee Privacy Notice. Prepare a privacy notice to employees, contractors, and job applicants.
  • Contract Assessments. Assess contracts with customers and service providers to ensure privacy matters apply to employment information.
  • Privacy Requests. Establish a process for responding to privacy requests from employees, contractors, and job applicants to exercise their CCPA rights.

This work must be completed and all updated notices, policies, and practices in place no later than January 1, 2023.

Want more information? Not sure if these amendments impact your business? Reach out to Immix privacy counsel for more information.

Author: Emily Maass / emily.maass@immixlaw.com