The law also requires covered businesses to disclose certain information in their privacy policies, including information about consumers’ rights under the CPRA and how to exercise them. Under the CPRA, employers must comply with the privacy disclosures as they relate to employees, job applicants and their personal information.

Notice at Collection

The notice at collection must include all of the following:1

• The categories of personal information to be collected about an applicant or employee.
• The purposes for which the categories of personal information are collected or used and whether that information is sold or shared.
• The categories of “sensitive personal information” collected (if any), the purposes for which they are collected or used, and whether such information is sold or shared.
• Sensitive personal information includes things like Social Security number, driver’s license number, financial account information, login credentials, health information, biometric data, racial or ethnic origin, religious or philosophical beliefs, union membership, and genetic data.
• The length of time the business intends to retain each category of the personal information, including sensitive personal information. Or, if that’s not possible, the criteria used to determine the retention period, provided that the business cannot retain the information longer than is reasonably necessary for the disclosed purpose.

Many CPRA provisions refer to “selling” or “sharing” personal information. Generally, such provisions likely will have little impact on employers with respect to the information collected from employees and job applicants, as employers don’t sell employment data and, for purposes of the CPRA, “sharing” personal information means disclosing it to a third party for the purposes of “cross-contextual behavioral advertising,” i.e., targeted advertising.

• Although selling or sharing their employees’ data isn’t something employers generally do, they should consult with their legal counsel about all CPRA provisions regarding the sale, sharing or disclosure of personal information and how they might implicate their employment-related information practices.

Employers should consult their legal counsel with any questions about their notice and personal information collection practices.

Privacy Policies for Employment-Related Information

In addition to the notice at the time of the collection, the law requires covered businesses to disclose to consumers in their privacy policies information about their rights under the law and procedures for exercising those rights. Subject to some general exceptions, the CPRA gives consumers the right:2

• To delete personal information, subject to specific exceptions.
• To correct inaccurate personal information.
• To access personal information.
• To know what personal information is sold or shared and to whom.
• To opt out of sale or sharing of personal information.
• To limit use and disclosure of sensitive personal information.
• Of no retaliation exercising their rights under the law.

Covered businesses also must disclose the following in its privacy policy:

• Categories of personal information collected during the preceding 12 months.
• Categories of sources from which personal information is collected.
• Business or commercial purposes for collecting personal information.
• Categories of third parties to which personal information is disclosed.
• Categories of personal information the business has sold or shared in the prior 12 months, or, if the business hasn’t sold or shared personal information in the preceding 12 months, a statement to that effect in the privacy policy.
• Categories of personal information disclosed for business purposes in the preceding 12 months, or, if the business hasn’t disclosed personal information for business purposes, a statement to that effect in its privacy policy.

The requirement to provide consumer information going back 12 months is commonly called the “12- month look back period.”

Employers must update their privacy policy at least once every 12 months.

Covered employers should consult with legal counsel to determine the best way to address the CPRA notice and disclosure requirements given the particular data collection practices and other circumstances unique to their business.

1. Civ Code sec. 1798.100(a)