Information contained in this publication is intended for informational purposes only and does not constitute legal advice or opinion, nor is it a substitute for the professional judgment of an attorney.
This is the fifth in a series of articles about the implications of the California Privacy Rights Act for employers.
- the categories of personal information collected by the employer during the preceding 12 months;
- the categories of sources from which the personal information is collected;
- the business or commercial purposes for collecting, selling, or sharing that personal information;
- the categories of third parties to which personal information is disclosed;
- the categories of personal information sold or shared for purposes of cross-context behavioral advertising in the preceding 12 months;
- the categories of personal information disclosed for a business purpose in the preceding 12 months; and
- the individual’s CPRA rights and how to exercise those rights, which includes, at a minimum, a toll-free telephone number and at least one other method for submitting rights requests.1
For more discussion of HR Individuals’ rights, please refer to our previous articles explaining the data rights that HR Individuals can exercise under the CPRA.2
Comparison With the Notice at Collection
Options to Opt Out
Combining With the Notice at Collection
Combining With Other Privacy Policies
1. Perform Data Mapping: The first step often is to map relevant HR data. That is, employers should determine what categories of personal information they collect from HR Individuals, the sources of collection, the third parties to whom employee personal data is disclosed, and the purposes for which such information is collected. This assessment likely will require coordination among multiple departments, stakeholders, and custodians to account accurately for the company’s information-handling practices.
1 See Cal. Civ. Code § 1798.130(a)(5).
2 See Zoe Argento, California Privacy Rights Act for Employers: The Rights to Opt Out of Sales and Sharing, Restrict Sensitive Personal Information, and Non-Discrimination, Littler Insight (Sept. 7, 2021); Zoe Argento, California Privacy Rights Act for Employers: The Rights to Know, Delete, and Correct, Littler Insight (Aug. 16, 2021).
3 See Cal. Civ. Code §§ 1798.100(a), 1798.130(a)(5).
5 Cal. Civ. Code § 1798.140(ad).
6 Cal. Civ. Code § 1798.140 (ah)(1).
7 Cal. Civ. Code § 1798.135 (c). The CPRA also allows companies to comply with automated opt-out preference signals sent by a browser or other mechanism.
8 See Cal. Civ. Code § 1798.121.
9 See Cal. Civ. Code § 1798.130(a)(5).