What you need to know about the new CCPA employee data amendments

While California’s Consumer Privacy Act (CCPA) has been in effect for three years, the passage of the California Privacy Rights Act (CPRA) which amended the CCPA, ushered in significant changes to the CCPA, effective January 1, 2023. Companies with workers who are California residents are now required to extend personal information privacy rights to their workers – both past and present – including officers, contractors, medical staff, directors and job applicants.  

In this article, we discuss what the CPRA changes mean for your business; how it affects you as a Workday customer and how you can ensure compliance with Kainos Smart Shield. 

What changes have been made by the new CPRA amendment?

The California Privacy Protection Agency (CPPA), is a governing administrative agency (Data Privacy Authority) that will operate as a watchdog to protect consumer privacy. This agency will vigorously enforce the law against businesses that violate consumers’ privacy rights.

The new CPRA amendment now protects employee’s personal information and specifies that a notice must be provided to employees by employers, at or before the point of the collection of their personal information. This notice must include a list of the personal information that will be collected and the commercial or business purpose for the collection of the data. Employers should also provide their employees with a copy of, or a relevant link to, the employer’s privacy policy.

• Personal information is classified as any information which identifies, relates to, or could be reasonably linked to a consumer or their household. This includes the individual’s full name, social security number, email address and even goes as far as their internet browsing history, geolocation and biometrics.
• Personal information of California job applicants, employees, owners, directors, officers, and medical staff members, collected and used by businesses in the context of an individual’s role, for emergency contact information, or to provide benefits.  
• Personal information reflecting a written or verbal communication or transaction between a covered business and an employee, owner, director, officer, or independent contractor, of another business, which occurs within the context of conducting due diligence or providing or receiving a product or service. 

• If you do not comply with the CPRA, your organization could be subject to fines of $2,000 per violation, $2,500 for negligent violations and $7,500 for wilful violations.
• Companies have 30 days once regulators have notified them to comply with the law.
• Employees have the right to sue their employers under the latest CCPA amendment if certain conditions are met. If the business fails to protect certain types of personally identifiable information which include an employee's first name (or first initial) and last name in combination with any of the following: social security number, driver’s license number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to identify a person's identity. Other information includes financial and/or medical details.

There are several steps businesses can take to comply with the new regulations:

• A business can conduct an inventory of what information they hold on their employees and where it is stored. It is particularly important to identify any personal information which is considered sensitive.
• Assess how that sensitive data is protected, who has access to it and what are those access controls.
• Limit access to valid users, maintain tight controls over your contractors, and put in data masking options based on rulesets.
• An important part of the process is evaluating the sufficiency of security procedures and internal controls currently in place over employee data. Workday’s security framework and audit capabilities support effective data privacy controls. But HR organizations must be intentional about how their internal controls leverage Workday capabilities.

Discover how Smart Shield can help protect your business' most sensitive information.