Exempt No More: What Does the CPRA Mean for HR Department?

Kristen Mathews and Suhna Pierce authored an article for CPO Magazine discussing the new privacy obligations with respect to the personal information of employees, applicants for employment, independent contractors, owners, directors, officers and their beneficiaries, and emergency contacts who are California residents once the California Privacy Rights Act (CPRA) takes effect on January 1, 2023.

“Employers can take several steps ahead of January 2023 to develop and implement technical and organizational measures (both internal and external-facing) to receive, assess, and respond to individuals’ requests to exercise their rights,” the authors wrote.

They added: “One step is mapping PI [personal information] collected from and about individuals, including the categories of PI (e.g., contact, financial, employment information, etc.) and their sources (e.g., collected directly from the individual or from other sources). Additionally, employers can create data retention policies, including policies for automatic archiving or deletion, to minimize the volume of data that the business must collect and review for a request. Businesses should take note that the CPRA applies to PI collected on or after January 1, 2022 and account for any specific data retention period required by federal or state law.”

Read the full article.