Employer’s Obligations Under the CPRA

The CPRA gives consumers a lot of control over their personal information collected by businesses. For example, consumers have the right to know at or before the point of collecting that information who collects personal information about them, the kinds of information collected and purposes for which that information is used. They have the right to view their personal information, request it be deleted or corrected if inaccurate, and the right to opt out of the sale or sharing of their personal information.

To that end, the law imposes on covered businesses a series of obligations related to the rights consumers have over their personal information. For example, the law requires covered businesses to:

  • Provide disclosure notices when collecting personal information;
  • Comply with consumer requests regarding personal information (subject to some exceptions);
  • Implement reasonable security measures with respect to personal information collected; and
  • Not discriminate or retaliate against anyone exercising their rights under the law.

The following sections will examine the CPRA requirements in more detail, particularly the law’s notice and disclosure requirements and consumers’ specific rights under the law.