California Privacy Rights Act (CPRA): Employer Obligations

This practice note discusses the expanded obligations that employers have under the California Privacy Rights Act (CPRA), beginning on January 1, 2023, with respect to the privacy of human resources (HR) data. Employers familiar with the CPRA's predecessor, the California Consumer Privacy Act (CCPA), likely know that the CCPA exempts the data of employees, applicants, independent contractors, spouse and dependents, and other individuals in their HR capacity (collectively, HR Individuals) from most of its requirements. The CPRA, however, sunsets the CCPA's near-total exemption for HR data and introduces numerous new requirements for the handling of personal information.