Update Applicable to:
All employers in California.
What happened?
On October 8, 2023, California Governor Newsom has signed AB 947 and AB 1194 into law. These new laws amend and build on existing California privacy laws, including the California Consumer Privacy Act (CCPA).
What are the details?
The California Privacy Rights Act (CPRA) works as an addendum to the CCPA, strengthening rights of California residents, tightening business regulations on the use of personal information, and establishing a new government agency for state-wide data privacy enforcement called the California Privacy Protection Agency (CPPA), among key changes to the Golden State’s data privacy regime.
The California Privacy Rights Act (CPRA) became fully effective on January 1, 2023. Enforcement began on July 1, 2023 – with a so-called lookback period to January 1, 2022, meaning data collected from that date on is liable for compliance. Cookiebot Firm.
As previously communicated by Vensure, the final CPRA Regulations were approved on February 3, 2023, and should be in full effect.
With AB 947, it defines “sensitive personal information” to additionally include personal information that reveals a consumer’s citizenship or immigration status. Companies that collect sensitive information must ensure they are complying with the CCPA/CPRA providing a link on their homepage to allow consumers to limit the use of their sensitive personal information and to opt out of the selling and sharing of this information, or use an automatic opt-out preference signal regarding the processing of such information.
With AB 1194, if a business collects data about consumers that contains information related to accessing, procuring or searching for services regarding contraception, pregnancy care and perinatal care, the business must comply with CCPA/CPRA obligations. The exception is if such information is used for specified business purposes as defined under the CPRA, is retained only in aggregated and anonymized form, and is not sold or shared.
Best practices
- Employers whose business is to collect personal information must adopt the required policies to comply with the amendments to the CPRA and avoid a claim or investigation done by the CPPA.
Employers should review additional resources here:
Law Firm Articles: Article 1, Article 2, Article 3
Need help understanding how changes to employment laws will affect your business?
Learn more about how Vensure's California PEO services can help you navigate complex employment laws and keep your business compliant.
This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.
