Come January 1, 2023, businesses that are subject to the California Privacy Rights Act (CPRA) (which amended the California Consumer Privacy Act (CCPA)) will need to reconsider their privacy practices, not only with respect to their customers' personal information but also with respect to their personnel's information.

As a reminder, a company that does any business in California is subject to the CPRA if any of the following apply:

• the company had annual gross revenue above $25 million in the previous calendar year;the company collects, stores, analyzes, discloses, or otherwise uses the personal information of 100,000 or more California residents or households in a given year; or
• the company derives at least 50 percent of its annual revenue from selling (disclosing to a third party for monetary or other valuable consideration) or sharing (disclosing to a third party for cross contextual advertising) the personal information of California residents.

Note that the CPRA applies, even if the company does not have offices in California, if they meet any one of the above thresholds and do business in California.

Privacy Policy Notice

Businesses that are subject to the CPRA must draft new, or update existing, personnel privacy policies that disclose the personal information they collect in the employment context, including from employees and contractors.

Privacy policies will now need to include additional disclosures regarding data retention time periods or criteria used to...

Read Full Story: https://www.mondaq.com/unitedstates/employee-rights-labour-relations/1240216/...