In Wentworth v. Regents of the University of California (2024) 105 Cal.App.5th 580, the Court of Appeal issued a key ruling on the Information Practices Act (IPA) (Civ. Code § 1798 et seq.), holding that personal information need not be "confidential" or "private" to be protected from unauthorized disclosure by a state agency. The court reversed the dismissal of the plaintiff's invasion of privacy claim, clarifying that the IPA broadly protects records that are "linked to" an individual, regardless of their confidential status.

This decision expands the scope of the IPA, exposing state agencies to liability for the improper disclosure of a wider range of employee information.

In Frayo v. Martin. (2024) 102 Cal.App.5th 1025, the Court of Appeal held that an employer did not violate the CMIA by firing an employee who refused a mandatory COVID-19 test. The court affirmed a demurrer, finding that (1) a request to take a test is not an unlawful request for a medical authorization under § 56.20(b), and (2) § 56.20(c) did not apply because the employer never possessed the plaintiff's "medical information" since he refused the test.

This decision confirms CMIA governs the handling of possessed data, not the act of requiring a test, and does not protect an employee from termination for refusing the test itself.