CPRA and Employee Rights

Simple Guide

CPRA is effective on January 1, 2023, and its adoption brings about many changes in business practices, especially as it relates to employee rights. If your company is within the compliance criteria for the CPRA, this is one change you don’t want to overlook.

Gartner suggests that it costs businesses approximately $1,524 to process a single DSR. Organizations that manually process DSRs spent roughly $400,000 per million records in 2021 to process and fulfill data subject requests. And these estimates are before extending rights to employees. Getting your ducks in a row helps your company financially and maintains trust with your customers.

Now it’s also essential to maintain faith in your most crucial internal resource — your staff — the people who build, grow, and support your business. CPRA forces companies to change their mindset around employees – current, past, or future. California privacy law grants employees the same enforceable privacy rights as your customers.

Because of this, you need to consider how HR-related data is used and how SaaS and other service providers support HR activities. This also brings about unique challenges for HR, privacy, security, and legal teams, who must work cross-functionally concerning overlapping labor and anti-discrimination laws.

Changing the Mindset Around Employees in the CPRA

• The right to be informed
• The right to access
• The right to delete
• The right to correct
• The right to opt-out of the sale/sharing of personal data
• The right to limit the use or disclosure of sensitive personal information
• Rights related to profiling and automated decision-making

What Rights Does the CPRA Entitle to Employees

CPRA and Employee Rights in One Sentence: Yes, full privacy rights apply to workforce members.

In addition to the rights listed above, now all Californians (yes, including your employees) will be able to:

• Restrict the use and sharing of their Sensitive Personal Information,
• Learn about algorithmic decisions made concerning them, and
• Seek confirmation that you are upholding their rights appropriately.

The scope of their activities includes all business practices, including HR operations. Their primary objective? To seek enforcement of the CPRA.

If the very public $1.2M settlement between Sephora and the California AG, as well as the scores of published enforcement case examples, are any indicator, the State’s privacy watchdogs will pursue low-hanging fruit. Given the long-standing history of HR and employee-related laws, rules, and regulations over the years, businesses will also need to take stock of overlapping legal requirements to balance those needs against the rights and freedoms of Californians.

CPRA Compliance Timeline

• JAN 1, 2023: CPRA becomes operative. Finalized set of modified CPRA rules submitted to Office of Administrative Law. Original CCPA remains effective and enforceable through July 1, 2023. CPRA and available rules operative. Statutory compliance grace period begins. Organizations make necessary adjustments to comply with known rules in good faith before the July 1, 2023 enforcement date.
• FEB 1, 2023: Earliest CPRA rules enforcement can begin. CPPA may delay and/or phase in administrative enforcement activities. CPPA to decide when and how to enforce. Companies cannot be penalized retroactively for noncompliance with draft or missing rules.
• 2023: Remaining CPRA rules released for public comment. Public comments on modified draft CPRA rules. Further modifications possible through EOY. CPPA asked to delay enforcement due to rulemaking delays. Rules covering risk assessments, automated decisioning, and handling of HR data still missing.