On July 14, 2023 — two weeks after the Sacramento Superior Court ruled that the California Privacy Protection Agency (CPPA) must delay enforcement of any individual regulation related to the California Privacy Rights Act (CPRA), amending the California Consumer Privacy Act (CCPA), for a one-year period following the date the regulation goes into effect — California Attorney General Rob Bonta announced an “investigative sweep” into compliance with the CCPA provisions already in effect.
More specifically, Bonta’s office is sending inquiry letters to large California employers, requesting information on the companies’ compliance with the CCPA’s regulations regarding employees’ and job applicants’ personal information, which is defined in the California Civil Code as, “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
The agency is sending these letters to learn how employers are complying with their legal obligations, according to a press release.
As previously reported, the CCPA went into effect January 1, 2023, and among other things, brought previously exempted employment-related information within the privacy law’s scope. This created new obligations and compliance challenges for covered California businesses, such as providing notice of privacy practices and fulfilling consumer requests to exercise their rights to access, delete and opt out of the sale and sharing of personal information.
As a reminder, the CPPA can enforce the CCPA provisions already in effect — but it can’t yet enforce the CPRA regulations that took effect March 29, 2023. So, as previously reported, employers should not only fine tune their efforts to comply with the CCPA provisions, but also review the March 29, 2023, CPRA regulations and work with legal counsel to determine whether changes must be made in order to comply with the March 29, 2024, enforcement deadline.
