California Employers Prepare for Landmark Worker Privacy Rights

Consumer privacy rights extended to California workers in the coming months will be the first in the US to test how companies give employees more control over the collection and use of their personal information.

Coverage under the landmark California Consumer Privacy Act and its amendments will expand Jan. 1 to include data on employees, job applicants, independent contractors, and business-to-business operations, among other categories. The new workplace requirements mark a departure from the consumer-only scope of four other states’ privacy laws that will go into effect in 2023.

“It’s very big and significant, because before now employers have not had to give employees these kinds of rights,” said Kristen Mathews, partner at Morrison & Foerster LLP.

The employee data collection safeguards are overdue, said Ken Wang, policy associate at the California Employment Lawyers Association. The new requirements increase transparency on the “massive amount of data” companies collect on their workforce, he said.

“Workers should have the right in the workplace to understand what they’re getting into,” Wang said.

‘Careful Communications’

California already has consumer privacy requirements in place for companies that do business in the state and meet certain thresholds. The California Privacy Protection Agency board is finalizing regulations to implement voter-approved changes to the existing law.

Employees too will soon have the right to know what personal information a company collects on them and be able to access it, as well as the ability to correct that information and request its deletion.

Companies already complying with consumer privacy requests aren’t necessarily ready for the employee expansion, though. Organizations usually house employee and consumer data separately, and the worker information is often unstructured, said Daniel Felz, a senior associate at Alston & Bird LLP in Atlanta.

“It’s not necessarily in one spot,” Felz said. The good news is that many companies “already make a ton of data available to employees,” he said.

Employers are looking to leverage existing self-serve tools that let workers see their pay stubs or correct an address, for example, said Lindsey Tonsager, co-chair of Covington & Burling LLP’s global privacy and cybersecurity practice.

The changes are also prompting employers to look at their records retention procedures to determine whether they can limit the information they keep that would fall under the requests, Mathews said. She also recommended companies encourage “careful communications” to be thoughtful about what’s put in writing about employees and applicants.

High Stakes

Privacy-related requests from employees, former employees, or job candidates are more likely to stem from a dispute or precede litigation than those made by consumers, Mathews said. Workplace requests could also seek sensitive information that an employer may not want to delete or hand over, such as interview notes, she said.

“The stakes are high and these requests need to be handled well—carefully—for the company,” Mathews said.

Companies should notify HR and legal when they receive requests, she said. Employers will also consider the law’s exceptions to providing data in some cases, such as attorney-client privilege, Mathews said.

Businesses will have an easier time verifying who’s asking for the data when a request comes from a current employee instead of a consumer, Tonsager said. But the workplace provisions come with the possibility of misuse “to achieve ends completely unrelated to privacy,” she said.

“You’re trying to address a different set of harms,” Tonsager said.

New Rights

Employees are entitled to the information outlined in California’s privacy act, and it’s still speculation how the provisions will be used, Wang said. The newness of the workplace rights in the US leaves open questions about how they will be implemented, he said.

“It’s too early yet to say exactly how it’s going to play out,” Wang said.

Employment lawyers should be aware of the law so that clients know their rights and that there are retaliation protections, Wang said. Workers can also save the pre-collection notices provided by their employers to understand what type of data is at stake, he said.

“They should be aware that such rights exist,” Wang said.