On July 14, 2023, California Attorney General Rob Bonta launched investigations into large California employers regarding their compliance with the California Consumer Privacy Act (the “CCPA”) as it relates to their processing of employee and job applicant personal information.

Attorney General Bonta’s investigative sweep is the first CCPA enforcement activity related to employee data. The attorney general may only enforce CCPA statutory requirements because the California Superior Court delayed enforcement of the CCPA regulatory requirements until March 29, 2024. The CCPA statute has required businesses to fully comply with their obligations under the act with respect to employee data since January 1, 2023. Prior to this date, the CCPA exempted employee data from the scope of the CCPA except the CCPA required businesses to provide a privacy notice at or before the point of collecting such data and consumers could file suit against employers for certain security incidents related to employee data.

Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments surrounding CCPA enforcement and provide updates as more information becomes available.  

[View source.]