For employers that operate in California, the exemption from coverage under the state’s sweeping California privacy law is about to expire, and as of January 1, 2023, any employer with at least $25 million in gross annual revenue will be required to comply. The 2018 California Consumer Privacy Act (CCPA), as amended by the 2020 California Privacy Rights Act (CPRA), imposes some of the toughest restrictions in the nation on the collection and use of personal information by covered businesses, and gives California consumers unprecedented rights regarding what and how personal information is collected and stored.
Starting January 1, 2023, the CCPA will allow employees to review personal information collected by their employer, allow employees to control how personal information is shared, and, subject to certain exceptions, allow employees to demand deletion or correction of their stored personal data.
As of this writing, the California Privacy Protection Agency has not issued final implementing regulations to provide guidance to employers on how to comply. Accordingly, until further guidance is issued, covered employers will simply have to make good faith efforts to comply based on their interpretation of the statutory language.
Members of the Center for Workplace Compliance (CWC) can read more here.