New Privacy Rights for California Employees Effective January 1, 2023

New Privacy Rights for California Employees Effective January 1, 2023

Beginning January 1, 2023, California employees can exercise new privacy rights under the California Privacy Rights Act (CPRA) and, accordingly, their covered employers will face new compliance obligations. The new rights for California employees will include, among others: the right to know, right to rectification, right to deletion, right to data portability, and right to limit use and disclosure of sensitive personal information. Employers will need to evaluate employee requests to exercise their rights to determine their obligations under the CPRA, as employers may have certain bases to deny employee rights requests. For example, should an employee attempt to exercise their right to deletion, the employer could rightfully deny that request to the extent that certain personal information is required to carry out the employment relationship (to process payroll, provide benefits, etc.), or because of statutory requirements that dictate the retention of certain employment-related information. This is a significant change for employers with employees in California; for some it will require a re-assessment of how personal data is handled and maintained within their organization, along with changes to current policies and procedures. While compliance will not be enforced until July 1, 2023, employers can and should begin to prepare for these changes now.