On July 14, 2023, the California Attorney General announced a new CCPA investigatory sweep focused on employee data. The Attorney General’s Office reported that it had sent inquiry letters “to large California employers requesting information on the companies’ compliance with the California Consumer Privacy Act (CCPA) with respect to the personal information of employees and job applicants.”

The Office’s focus on employee data comes in the wake of the CCPA’s employee and business-to-business data exemptions expiring on January 1, 2023, after the California legislature failed to extend both at the end of its 2022 session. With the employee data exemption expired, businesses are now required to, among other things, provide privacy policies to California employees and respond to employee rights requests.

The CCPA’s application to employee data is the subject of much debate given that the CCPA is directed at consumer data and existing California law already provides certain employee data rights. Recently finalized CCPA regulations do not address employee data and, at a recent California Privacy Protection Agency Board meeting, Agency counsel identified this topic as one of the most difficult areas to address in future rulemaking.

The Office’s investigatory sweep is a reminder that the CCPA’s requirements on employee data are now enforceable by the Attorney General and the new California Privacy Protection Agency. It also is a reminder that the CCPA’s statutory requirements are still enforceable despite a June 30, 2023 court ruling that delayed enforcement of the new CCPA regulations until March 2024. The Office has conducted prior enforcement sweeps, including on mobile applications, loyalty programs, and recognition of the global privacy control signal.