After months of uncertainty, the rulemaking process for the California Privacy Rights Act (CPRA), the
first-ever comprehensive U.S. data privacy law applicable to HR
data, concluded on March 29.
California employers can put the finishing touches on required
notices and policies, distribute them, and take the other steps
necessary to implement their compliance program.
Under the prior law, the California Consumer Privacy Act (CCPA),
HR data was excluded except that California employers were required
to provide applicants and employees in California with a brief
notice at collection.
Once the CPRA, which amends and supersedes the CCPA, went into
effect on Jan. 1, this near-total exemption for HR data was
eliminated. Employers must post an online privacy policy, ensure
that contracts with service providers contain statutorily mandated
language, and establish procedures so that applicants, employees
and their dependents can exercise their new data rights.
