An Investigative Sweep into The Largest California Employers

 
The California Attorney General Rob Bonta recently announced an investigative sweep into large employers operating within the state via inquiry letters mailed to their corresponding doorsteps. The AG is now requesting proof that companies are complying with the provisions of the California Consumer Privacy Act (CCPA) with respect to the personal information of employees and job applicants. Effective January 1, 2023, covered businesses, in this case the largest employers, must provide notice of privacy practices, and fulfill consumer and employee requests to exercise their rights to access, delete, and opt out of the sale and sharing of personal information.

What is driving California enforcement to protect employee data?

California has the highest number of employed peoples in the United States, at about 18.4 million and growing. According to Fortune Magazine, 55 of the largest companies in the world have headquarters in California, and earned nearly $13.8 trillion in revenue in 2021 and employ nearly 18 million people within the state.

The technology industry continues to drive the state’s economy. These Silicon Valley companies employ many of the country’s highest-paying jobs:

• Apple Inc.
• Google (Alphabet Inc.)
• Meta
• Cisco
• Intel Corporation
• HP Inc.

Additionally, California’s thriving employment numbers are made up of the following industries:

• Trade and Logistics
• Healthcare
• Hospitality and Tourism
• Financial Services
• Film and Entertainment
• Agriculture and Food Production
• Education
• Manufacturing
• Construction and Real Estate Development

California has established itself as the undisputed leader in the nation’s workforce. The state’s diverse economy offers a broad spectrum of job opportunities across every sector. This rich tapestry of industries has contributed significantly to the state’s ability to attract a diverse and talented workforce. The provisions of the CCPA not only recognize the overwhelming working force, but also the need to protect employee data rights of over 18.5 million Californians.

The Investigative Sweep

“The California Consumer Privacy Act is the first-in-the-nation landmark privacy law, and starting this year, the personal information of employees, job applicants, and independent contractors received greater data privacy protections because of it,” said Attorney General Rob Bonta. “We are sending inquiry letters to learn how employers are complying with their legal obligations. We look forward to their timely response.”

The AG of California is committed to making good on his promise for enforcement of the CCPA and the CPRA amendments to the CCPA. The investigative sweep, conducted by the AG and the California Privacy Protection Agency (CPPA), is not merely a courtesy. It is a serious regulatory enforcement action aimed at ensuring that large employers operating within the state are complying with the provisions of the California Consumer Privacy Act (CCPA). If a business is found to be non-compliant during the investigation sweep, it could lead to potential and swift enforcement actions, penalties, fines, or even legal and reputational consequences.

The AG has conducted several of these investigative sweeps, including a 2022 sweep that lead to a major settlement with a cosmetic retail giant. In another investigative sweep from January 2023, the AG sent letters to businesses with mobile apps that may have failed to comply with consumer opt-out requests or do not offer any mechanism for consumers who want to stop the sale of their data. The California 30-day cure period is gone, effective July 1st. The investigative sweep letter acts as a “notice to cure.”

Other notices to cure include:

• An investigative sweep of businesses operating loyalty programs that offered financial incentives such as discounts, free items, or other rewards, in exchange for personal information without providing consumers with a notice of financial incentive;
• An online advertising business who’s privacy disclosures were not understandable to the average consumer and did not include the required information; and
• A data broker whose “Do Not Sell My Personal Information” link worked only on certain browsers and directed consumers to a confusing webpage that required several additional steps to submit CCPA requests.

Preventing or responding effectively to an investigative sweep with Proactive Privacy Governance

Even if businesses have not received a letter in a sweep, this is a good opportunity to review procedures. Preventing or preparing effectively for an investigative sweep with proactive privacy governance is crucial for businesses operating in California. Implementing Proactive Privacy Governance practices and tools can help organizations stay ahead of potential investigations and demonstrate commitment to protecting customer data and complying with the CCPA and other privacy laws.

• Maintain Transparent Privacy Policies:
  Ensure that your privacy policies are clear, concise, and accessible to consumers. Transparent privacy policies build confidence with customers and demonstrate your commitment to privacy protection. DNSS popup in the footer of your website should clearly inform consumers of what is collected (“notice at collection”) and allow Global Privacy Controls for immediate opt outs.
• Establish a privacy program with automated DSR workflows:
  Automating DSR workflows streamlines the process, ensures timely responses, and helps maintain compliance. Provide data subjects with a user-friendly online portal or interface to submit their DSR requests. Have a centralized DSR management system that logs and tracks all incoming requests. Automated DSR workflows should be integrated with data mapping tools to locate the relevant data associated with the data subject making the request.
• Conduct Privacy Impact Assessments (PIAs):
  Perform Privacy Impact Assessments for new projects or systems that involve the collection and processing of personal data. These assessments will help identify potential privacy risks and determine the appropriate measures to mitigate them.
• Implement Data Minimization Practices:
  Adopt data minimization practices to collect and process only the necessary personal information required to achieve specific purposes. Data mapping and automated categorization can reveal what and how data is collected and who it is shared with, and also it can determine if data is unnecessary.
• Conduct Periodic Internal Audits:
  Regularly assess and audit your privacy practices to identify any areas of non-compliance and address potential issues before they become larger problems.
• Adapt to Regulatory Changes:
  Stay up to date with changes in privacy regulations and adapt your privacy program accordingly. Being proactive in updating your practices to align with evolving laws can help you avoid compliance issues. Use software that is developed to stay compliant with emerging laws and be ahead of the curve.
• Cooperate with Authorities and Be Transparent:
  In the event of an investigative sweep, cooperate fully with the authorities involved. Respond to inquiries promptly and transparently, providing all relevant information to demonstrate compliance with privacy laws. Audit trails and downloadable reporting improve the response time to regulatory authorities and allow businesses to be transparent and focus on more than just compliance.

Proactive Privacy Governance is essential, particularly in California where privacy regulations have set the benchmark for other emerging privacy laws. By implementing these strategies and continuously improving privacy practices, businesses can minimize the risk of being subjected to investigative sweeps and respond effectively if one does occur. Taking privacy seriously not only helps organizations comply with regulations but also fosters confidence among consumers, partners, and stakeholders.

Clarip’s Data Privacy Governance Platform ensures compliance with all consumer privacy regulations. Implementing automated data mapping with Clarip’s patented auto-tagging and categorization technologies, organizations can take the guess work out of the data minimization scenarios. Clarip takes data privacy governance to the next level and helps organizations reduce risks, engage better, and gain customers’ trust!

Contact us at www.clarip.com or call Clarip at 1-888-252-5653 for a demo.

Email Now:

Mike Mango, VP of Sales
mmango@clarip.com

Related Content:

Making the Case for Data Minimization
Automated Data Mapping
Data Discovery
Looking for Product Data Sheets?