76 | 2025 Cal-Peculiarities ©2025 Seyfarth Shaw LLP www.seyfarth.com Consumers have the right to request disclosure of what personal information about them has been collected and how it is used or shared ("the right to know"), the right to correct inaccuracies, the right to request deletion (subject to certain exceptions), the right to opt out of sale or sharing of personal information, and the right to limit the use and disclosure of “sensitive personal information.”139 Sensitive Personal Information "Sensitive personal information” includes a consumer’s government identification (e.g., SSN), account log-in, financial accounts and card numbers including access credentials, geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of communications, genetic data, information concerning a consumer's health, sex life, or sexual orientation, or biometric information processed for the purpose of uniquely identifying a consumer.140 Non-discrimination Consumers also have the right to not be discriminated against for exercising their CCPA rights.141 Third-party sharing and vendor management In addition to issuing the required policies and notices and responding to the above-outlined requests, employers should ensure they have in place appropriate contractual terms with vendors and others with whom they share the personal information of consumers (including employees/job applicants), conduct appropriate due diligence, and implement appropriate data governance measures where required.142 Duty to Implement Reasonable Security Measures The CCPA includes a requirement for employers to implement reasonable security measures to protect personal information. (See § 4.9.1.) Remedies Violations of the CCPA can trigger administrative fines ranging from $2,500 for each violation to $7,500 for each intentional violation or violations involving personal information of consumers under 16 years of age.143 The CCPA does not provide a private right of action for any claims other than those relating to security breaches (see § 4.9.1).144 Nor does the CCPA provide a basis for a private right of action under any other law (e.g., section 17200 of the California Business & Professions Code).145 Enforcement The amended law went into effect on January 1, 2023 and has a one-year lookback period for any data collected by businesses from January 1, 2022. Enforcement began on July 1, 2023.146 1 Gerawan Farming, Inc. v. Lyons, 24 Cal. 4th 468, 489-90 (2000). 2 Compare Smith v. Fresno Irrigation Dist., 72 Cal. App. 4th 147, 165-66 (1999) (reversing judgment for plaintiff in lawsuit alleging wrongful termination when he was dismissed after testing positive for amphetamines, methamphetamines, and marijuana; random drug test was justified by hazards inherent in his employment) with Luck v. S. Pac. Transp. Co., 218 Cal. App. 3d 1 (1990) (mandatory drug testing of computer programmer was breach of implied covenant of good faith and fair dealing as it was an unwarranted intrusion under California Constitution’s privacy provisions; plaintiff was not a safety employee and no other compelling interests justified the testing). Luck’s “compelling interest” test for non-safety-related private sector drug testing was disapproved in Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 56-57 (1994). 3 Loder v. City of Glendale, 14 Cal. 4th 846 (1997) (upholding applicant testing as part of generally applicable pre-employment exam, where employer’s “substantial interest” overcame “relatively minor” intrusion on expectation of privacy, but disallowing testing of current
RkJQdWJsaXNoZXIy OTkwMTQ4