On July 14, 2023, California Attorney General Rob Bonta announced a new investigative sweep of businesses’ compliance with the California Consumer Privacy Act (CCPA). Specifically, the Attorney General is seeking information from California employers about how they handle the personal information of their employees and job applicants within the state.

This is the first time that employment-related personal information has been specifically targeted for enforcement. Until recently, data collected and processed in the employment and B2B contexts had been largely exempted from CCPA requirements. However, those exemptions expired on January 1, 2023, and the new provisions became enforceable on July 1. This development has left many California businesses scrambling for a compliance solution that deals with HR data.

The announcement also sends a clear signal that the Attorney General intends to continue enforcing the CCPA alongside the newly created California Privacy Protection Agency. While it was always clear that the AG’s Office has its own independent authority to police the privacy law, it wasn’t clear whether it would be interested in doing so after the new agency started operating. This arrangement essentially doubles the state’s privacy enforcement capabilities.

‍