California Employers be Ready in January for Enforcement of CCPA and CPRA!

The California Consumer Privacy Act (“CCPA”) came into effect in 2018. It provided significant privacy rights and protections to California consumers and placed numerous obligations on businesses that either: (1) had annual gross revenues in excess of $25,000,000 in the preceding calendar year; (2) buy, sell, or share the personal information of 100,000 or more consumers; or (3) derive 50% or more of their annual revenues from selling or sharing consumers’ personal information. Although the CCPA constituted a significant obligation on businesses interacting with California Residents, its effect on California employers was limited. For California Employers, the legislature granted a partial exemption for candidate and employee information and essentially only required employers to: (1) provide notices when they collected personal information from their employees; and (2) secure any collected personal information. When the California Privacy Rights Act (“CPRA”) passed in 2020 it expanded the scope of the CCPA and, for the first time, placed significant obligations on California employers, which obligations go into effect on January 1, 2023.