On November 3, 2020, California voters passed the California Privacy Rights and Enforcement Act (CPRA or CCPA 2.0). The CPRA amends various parts of the existing California Consumer Privacy Act (CCPA). The CCPA gives California residents various rights over the personal information that businesses collect about them. However, the CCPA did make exceptions in certain cases, such as for information on employees.
Do you have questions about the CPRA? Register for the CPRA Live Q&A
The CCPA temporarily limited the rights that employees have over their personal information in the context of their role at the business and for employment purposes, such as for administration of benefits and use of emergency contacts. For this information, employees do not have the rights to access, delete, or opt-out of the sale of the personal information. They did, however, maintain the right to know, taking the form of a notice at the collection of the information. Employees also had the right to a private right of action in the event of a breach of unencrypted, unredacted personal information due to a lack of appropriate security measures.
This exemption was due to expire on January 1, 2021, thus giving employees additional rights under the CCPA. However, the CPRA did include an extension of the current exemption. Therefore, the current employee exemption will continue until January 1, 2023. This will give employers and businesses additional time to address the logistics of handling such requests from employees, particularly in light of the additional rights given to consumers under the CPRA.
To learn more about what the CPRA means for your overall privacy program, read the blog here.