California Privacy Laws in the Workplace: Understanding Your Rights

By /
Low aerial view of Mission District, San Francisco CA

Workplace privacy is a growing concern, especially as technology evolves. This issue significantly impacts daily work life.

Employers now have powerful tools at their disposal. They can monitor workers, investigate applicants, and screen current employees more easily than before.

Your employer might monitor work emails or track your internet usage. They could even use video surveillance on the job. These tools can gather vast amounts of information. It’s often unclear where legitimate business needs end and an illegal invasion of privacy begins.

Fortunately, California provides strong employee privacy protections. The California Constitution guarantees a fundamental right to privacy. Numerous state laws also shield workers from unwanted employer intrusion and surveillance.

But many employees aren’t fully aware of these specific rights. It can also feel difficult or risky to raise privacy concerns with an employer, especially over actions that seem minor.

Workplace invasion of privacy is a serious matter, though. If your employer improperly monitors you or collects personal data without proper consent or notice, you may have legal options. Significant penalties can apply to employer violations.

This guide helps you understand your workplace privacy rights under California law. It aims to clarify when an employer’s actions might cross the legal line.

We’ll begin by explaining key laws about employee tracking and monitoring. Then we’ll cover the specific rules surrounding background checks.

Finally, we’ll outline concrete steps you can take if your employer has violated your rights. Understanding the law is the first step to effectively protecting your privacy.

Table Of Contents
  1. What are the Laws on Employee Monitoring and Tracking in California?
  2. Summarizing Federal and California Laws on Background Checks
  3. What to Do If Your Employer Has Violated Your Privacy Rights

What are the Laws on Employee Monitoring and Tracking in California?

Employee monitoring has increased significantly in recent years, particularly following the rise of remote work.

Remote work can offer valuable flexibility and autonomy, which can lead to increased productivity. But it has also prompted increased employer tracking. Many companies use tools to monitor remote and in-office workers.

Common monitoring technologies include:

Keystroke logging (tracking typing activity).
Laptop or cellphone software measuring productivity metrics.
Monitoring work computer web traffic and internet usage.
GPS tracking for company vehicles or sometimes mobile devices.
Reviewing messaging and other activity on work platforms (like Slack, Teams, or company email).

This level of monitoring can feel like an invasion of privacy. But, does it violate your legal rights? When does legitimate oversight become illegal surveillance?

Workplace electronic privacy is an evolving legal field. Clear laws aren’t always available for every new technology. But key federal and California laws do provide important guidance and restrictions. These laws outline how employers generally may or may not monitor their employees.

Let’s look at some of the most important monitoring and tracking laws.

The Electronic Communications Privacy Act of 1986 (EPCA)

The main federal law covering electronic communications monitoring is the Electronic Communications Privacy Act of 1986 (EPCA).

The ECPA generally prohibits employers from intentionally intercepting employee electronic communications. This includes emails or phone calls on employer systems. But the law contains important exceptions for employers:1

1) The Business Purpose Exception: Employers may sometimes monitor communications for legitimate business reasons. This exception often applies to monitoring conducted on employer-owned equipment or networks.
2) Informed consent: Employers may monitor communications if they have employee consent. Consent might be obtained through written policies or onboarding paperwork that employees acknowledge.

These broad federal exceptions give employers significant leeway. They can often legally monitor work-related electronic communications under the ECPA.

tate law frequently offers stronger employee privacy protections than federal minimums. This makes understanding California’s specific laws critical. Let’s examine those now.

How California Offers Enhanced Privacy Protections

California provides strong and unique workplace privacy rights. Article 1, Section 1 of the California Constitution guarantees all citizens an “inalienable right” to pursue and obtain privacy.2

This constitutional protection often means employers face a higher standard here than under federal law alone. California generally requires stronger justifications for workplace intrusions affecting privacy.

When can a California employer legally monitor or collect employee information that impacts privacy? Generally, only if one of two strict conditions is met:

a)  The employee gives valid, informed consent to the specific intrusion beforehand, or:
b) The employer proves a compelling need for the intrusion. This need must outweigh the employee’s reasonable expectation of privacy in that situation.

This compelling need standard is significantly tougher than just showing a business reason. Employers have to prove both of the following:

1) The employer’s interest is vital, essential, and truly compelling.
2)  There is no less intrusive means to accomplish that essential business purpose.

It’s not enough for an employer to simply state a general business purpose. The need must be genuinely crucial. The method used must also be the least invasive option.

If an employer can’t satisfy this high standard, their actions (like monitoring or data collection) might constitute an illegal invasion of privacy. The employer could face legal liability.

Workplace privacy laws and the constitutional standard are complex. Do you have concerns about your employer’s monitoring or data practices? Consulting an experienced California employment lawyer is the best way to understand your specific rights and options.

California Privacy Laws Related to Surveillance

California law also restricts other forms of workplace surveillance. A key rule involves recording conversations.

California is generally a two-party consent state for confidential communications. This means all parties must consent to being recorded.

This rule primarily comes from the state Penal Code (e.g., § 632).3 Secretly recording a private conversation without consent is illegal. It violates privacy. It can potentially lead to criminal charges as well. This protection applies broadly to places where you have a reasonable expectation of privacy.

Do you suspect your employer is illegally recording conversations or meetings? Document any details carefully and consult an employment lawyer immediately.

Other specific state laws also limit workplace surveillance. California Labor Code § 435 explicitly prohibits employers from recording or monitoring employees in certain private areas. This includes restrooms, locker rooms, and rooms designated for changing clothes.4

Another relevant law is the Consumer Protection Against Computer Spyware Act. This act generally prohibits installing spyware on a computer without the user’s knowledge and consent.5 

The specific application of this law is still developing. But it offers potential grounds to challenge secret installations of invasive tracking software.

California’s Business and Professions Code § 17200 may also apply. This law targets unfair or unlawful business practices. Widespread or deceptive privacy violations by an employer might be challenged under this section. Potential remedies include court orders to stop the practice (injunctions).6

What if your employer uses illegally obtained information against you? For example, they may discipline or fire you based on a secret recording or spyware data. This illegal evidence gathering likely strengthens any legal claims you bring related to that discipline or firing. An employment lawyer can best advise on your specific situation and available legal strategies.

California Privacy Laws Related to Information Collecting and Record-Keeping

Several more recent California privacy laws may significantly impact workplaces. The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) set key rules. These laws govern how certain employers collect, use, and protect employee personal information.

Importantly, these specific CCPA/CPRA rights and obligations don’t apply to all employers. They generally cover only for-profit businesses doing business in California that meet at least one of these thresholds:

1) Must have annual gross revenues over $25 million, or:
2) Must annually buy, sell, or share the personal information of 100,000 or more California consumers or households, or:
3) Must derive 50% or more of their annual revenues from selling or sharing California consumers’ personal information.

For covered employers, these privacy laws generally require them to:

1) Provide Notice: Give employees clear notice before or at the time personal information is collected. This notice must explain what information is gathered and the purposes for its use.
2)  Honor Employee Rights: Allow employees to request access to their collected personal information. Allow employees to request deletion or correction of their data (subject to legal exceptions). Allow employees to limit the use and disclosure of sensitive personal information. Allow opt-out of data selling or sharing (if applicable). Employers can’t retaliate against employees for exercising these privacy rights.
3) Maintain Procedures: Implement and maintain reasonable security procedures to protect employee data. Have proper procedures for receiving and responding to employee privacy requests.

The California Labor Code provides employees additional rights unrelated to the CCPA or CPRA. You have the right to inspect and receive a copy of your personnel records maintained by your employer.7

These personnel records typically include items like your original job application, performance evaluations, and disciplinary action records. Employers must generally keep these types of records for at least three years after your employment ends.

California Privacy Laws Related to Social Media Accounts

California law provides specific privacy protections regarding employee social media accounts. Key rules exist under the state Labor Code and Government Code.

Generally, your employer can’t request your personal social media login information. This includes usernames or passwords.

Employers also can’t force you to access your personal accounts in their presence. They can’t compel you to reveal non-public social media content.

This rule helps maintain a boundary between work and personal online life. But it typically doesn’t protect information you choose to post publicly. Employers can usually view and potentially act on publicly available information.

Limited exceptions allow employer access to private social media accounts in specific situations. An employer might request access during an investigation into workplace misconduct. This usually requires specific facts pointing to the account’s relevance.

Employers can also generally access information stored on employer-issued devices. This includes company phones or laptops they provide to you. Access might extend to social media viewed or used on that device.8 

However, any access under an exception must be narrowly focused. It should relate directly to the investigation’s purpose or managing the employer’s device/network. Accessing or using information beyond that limited scope could constitute an illegal invasion of privacy.

California Privacy Laws Related to Disabilities or Medical Conditions

California law also provides specific privacy protections concerning employee disabilities or medical conditions.

State anti-discrimination laws like the Fair Employment and Housing Act (FEHA) prohibit discrimination based on physical or mental disability or medical condition.

While discrimination is barred, employers can usually ask certain relevant questions. They may inquire about your ability to perform essential job functions. They can also ask necessary questions when responding to your request for a reasonable accommodation.

Medical inquiries or examinations after a conditional job offer might be allowed. But they face strict legal limits. Any such inquiry or exam must be directly job-related. It must also be consistent with business necessity.

Employers have a strong legal duty regarding employee medical information. They must keep this sensitive information confidential.

Medical records must be stored securely and separately. They should not be kept in your regular personnel file. Access must be strictly limited only to individuals with a legitimate need-to-know.

Violating these medical privacy or confidentiality rules can result in legal liability for the employer.

Summarizing Federal and California Laws on Background Checks

California employers routinely conduct background checks when screening job applicants. Sometimes they are used for current employees too.

Common checks review potential criminal history. Others verify professional credentials or education records. Driving records or online searches might also be included. Various types of background investigations exist.

But these checks must respect individual privacy rights. Both federal and California laws place restrictions on their scope and how they are conducted.

Employers violating these restrictions may face legal liability. Our article on “Employment Background Checks in California: What’s Legal & What’s Not” covers these laws more extensively. What follows is a summary. 

The Fair Credit Reporting Act (FCRA)

The main federal law setting standards for employment background checks is the Fair Credit Reporting Act (FCRA). It establishes nationwide rules.

FCRA applies specifically when employers use third-party companies to run background checks. These companies are called Consumer Reporting Agencies (CRAs). Employers use these CRA reports for decisions like hiring, promotions, or retention.9

The law protects both job applicants and current employees. It requires employers using CRAs to be transparent.

Before ordering a background report from a CRA, employers must give you clear written notice. This notice must be a standalone document. It must state that a background check may be obtained for employment purposes. It must also state that information found could be used in employment decisions.

Employers must also get your specific written consent before obtaining the report.

What if the report contains negative information that might lead to an employer taking adverse action against you? They must first provide you a pre-adverse action notice.

This notice must include a copy of the consumer report itself. It also includes a summary of your rights under the FCRA. This gives you a chance to review the information and explain or dispute inaccuracies before the employer makes a final decision.

If the employer ultimately decides to take adverse action (like not hiring you or firing you), they must provide a final adverse action notice. This notice includes information about your right to dispute the accuracy or completeness of the report with the CRA that prepared it.

FCRA also restricts CRAs from reporting certain outdated negative information. Generally, they cannot report:

1)  Arrests that did not lead to conviction or civil lawsuits older than 7 years.
2)  Bankruptcies older than 10 years.

Criminal convictions, however, generally have no federal time limit for reporting under FCRA. However, some state laws, including California’s, may impose additional limits.

It’s crucial to remember that FCRA’s specific rules apply primarily to reports obtained from third-party CRAs. If an employer conducts background checks entirely in-house using their own staff and publicly available records, these rules may not apply. Other privacy laws might still be relevant.

FCRA sets the minimum federal standard. But it isn’t the final word, especially in California. State law often provides additional, stronger protections for workers regarding background checks.

Let’s explore California’s specific background check laws next.

What the Investigative Consumer Reporting Agencies Act (ICRAA) Means for California Privacy Protection

California takes employee background checks seriously. The state’s main law is the Investigative Consumer Reporting Agencies Act (ICRAA). It often provides broader rights than the federal FCRA.10 

ICRAA specifically regulates “investigative consumer reports” (ICRs). An ICR under California law is typically defined as a report containing information on someone’s character, general reputation, personal characteristics, or mode of living. It’s doesn’t include credit checks, which employers aren’t allowed to perform in California for most jobs.

Crucially, ICRAA often applies when this subjective information is gathered through personal interviews. This could involve contacting references, former employers, neighbors, or other acquaintances.

Because ICRAA emphasizes the method (interviews) and content (character/reputation), its notice and consent requirements can sometimes apply even if an employer conducts parts of this type of investigation in-house, not just when using an outside ICRA.

However, ICRAA has limits too. Basic verification of employment history or education might fall outside of some ICRAA rules.

Before conducting a background check covered by ICRAA, employers must take specific steps first. They must:

a)  Provide you with a clear written notice stating that a background check (investigative consumer report) may be obtained.
b) Get your specific written authorization (consent) beforehand to run the check.

A narrow exception exists for these notice and consent rules. Employers don’t need to obtain notice or consent if they suspect specific misconduct and the background check is solely for investigating that suspicion.

Employers using reports covered by ICRAA for any reason must certify the report is for a permissible employment purpose only. Examples include:

Hiring decisions
Promotion, reassignment, or transfer decisions
Retention decisions (including decisions based on investigating potential employee misconduct)
Compliance needed to meet specific federal, state, or local laws or regulations

In short, California employers usually can’t run ICRAA-type background checks randomly or without reason. They need a valid purpose and must usually provide notice and get consent first.

California’s Fair Chance (“Ban the Box”) Law

Other laws govern California background checks. A major one is the Fair Chance Act, often called the “Ban the Box” law.

The law aims to give job applicants with conviction histories a fairer chance. It prevents employers from asking about criminal history too early in the hiring process.

Under the Fair Chance Act, employers generally can’t inquire about or consider the following items before making a conditional job offer:11

1)  Any criminal conviction history.
2) Arrests that didn’t lead to conviction (with limited exceptions).
3) Participation in pretrial or post-trial diversion programs.
4) Convictions that have been sealed, dismissed, expunged, or statutorily eradicated.

This means applicants usually get to apply and interview first. They are initially evaluated based on their qualifications and skills. The potential stigma of a past record is considered later in the process, if at all.

What if an employer makes a conditional job offer and then wants to withdraw it based on criminal history revealed in a subsequent background check? They must follow a strict, multi-step process:

1) Individualized Assessment: The employer must first assess the conviction’s relevance to the specific job. They must consider the nature and gravity of the offense, how much time has passed, and the duties of the job.
2) Preliminary Decision Notice: If they plan to revoke the offer based on the assessment, they must give the applicant written notice. This notice identifies the disqualifying conviction(s). It usually includes a copy of any report used.
3) Opportunity to Respond: The applicant must be given at least five business days to respond. They can submit evidence challenging the report’s accuracy or evidence of rehabilitation or mitigating circumstances.
4) Final Decision Notice: If the employer still decides to rescind the offer after considering the applicant’s response, they must provide a final written notice of this decision.

Think an employer violated your Fair Chance Act rights during hiring? Consulting an experienced employment lawyer is also highly recommended. They can help you understand and protect your rights and, if appropriate, file a complaint with the California Civil Rights Department (CRD).

Other Miscellaneous Employment Background Check Laws in California

A few other key California laws restrict background checks further. They limit what information employers can gather and use.

Photographs and Fingerprints: Employers generally can’t share employee photos or fingerprints gathered during employment with third parties if the intent or effect is to blacklist the employee (Labor Code § 1051). Internal collection for identification or security purposes may be allowed under specific circumstances.12
Genetic Information: Employers cannot request, require, purchase, or use genetic information in making any employment decisions (FEHA). This includes genetic test results or family genetic history.13
Arrests Without Conviction: Employers generally can’t ask about or use information concerning arrests that didn’t result in a conviction. An exception applies for arrests where the person is currently out on bail or released on their own recognizance while awaiting trial (Labor Code § 432.7).14
Marijuana Convictions: Employers typically can’t ask about or use information about marijuana convictions that are more than two years old (Labor Code § 432.8). (Separate laws also protect most off-duty cannabis use from discrimination).15
Salary History: California employers cannot ask job applicants about their past salary history. They also cannot rely on salary history information to decide whether to offer employment or what salary to offer (Labor Code § 432.3).16
Sex Offender Records: Employers generally cannot use information from California’s registered sex offender website (Megan’s Law) when making employment decisions. Using this information is permissible only if federal or state law specifically requires or authorizes it for that particular job (e.g., certain jobs working with children).17

What to Do If Your Employer Has Violated Your Privacy Rights

California’s employee privacy laws contain many complex rules. Hopefully, this guide has provided a clearer understanding of your basic rights.

What should you do if you believe your employer violated those rights? Taking prompt, informed action is key.

Documenting your experience thoroughly is a critical first step. Keep detailed written notes of any concerning incidents or practices.

Record specific dates, times, and locations involved. Note who was involved (including witnesses). Write down exactly what happened or was communicated. Save copies of supporting evidence. This includes emails, work messages, screenshots, memos, or relevant company policies.

Consulting an experienced California employment lawyer early on is highly recommended, whether or not you first raised concerns internally. A lawyer can help you understand how the law applies to your specific facts. They can explain your potential legal options clearly.

Many employment lawyers offer a free initial consultation. This allows you to discuss your situation confidentially. It’s typically offered with no obligation to hire the firm or pursue a case. This meeting helps you gather information and make informed decisions.

Ask potential lawyers if they handle cases on contingency. This fee arrangement usually means you owe no attorney fees unless and until they recover compensation for you.

A lawyer can also guide you on filing formal complaints if necessary. Depending on the type of privacy violation, this might involve the state Civil Rights Department (CRD), the federal EEOC, or the California Privacy Protection Agency.

Remember that privacy violations can sometimes connect to other legal issues. Illegal surveillance or data misuse might lead to wrongful termination or retaliation. An attorney will assess all potential claims arising from the situation.

Acting quickly is crucial because strict legal deadlines apply. These deadlines are called statutes of limitations. They limit the time you have to file a formal complaint or lawsuit. If you miss the deadline, you usually lose your right to seek legal remedy permanently.

These deadlines vary significantly based on the specific law and type of claim. For example, claims under FEHA (like retaliation involving a protected characteristic) generally must be filed with the CRD within 3 years of the illegal conduct.

But other privacy-related claims can have much shorter deadlines. Common law invasion of privacy claims (like those involving background check issues) often have a two-year deadline.

Claims under federal laws like the FCRA also have their own specific time limits. Determining the applicable deadline requires careful legal analysis. Consulting a lawyer promptly ensures you don’t accidentally miss your window to take action.

Our team helps California employees navigate complex workplace privacy issues. We also handle related claims like wrongful termination or retaliation. Contact us using the button above (on desktop) or below (mobile) for a free, confidential consultation.

Citations

  1. 18 U.S.C.A. § 2510 (The Electronic Communications Privacy Act of 1986) (Go back)
  2. Cal. Const. art. I, § 1 (Go back)
  3. Cal. Penal Code §§ 630 -638.55 (Go back)
  4. Cal. Lab. Code § 435 (Go back)
  5. Cal. Bus. & Prof. Code §§ 22947 -22947.6 (Go back)
  6. Cal. Bus. & Prof. Code (§§ 17200 -17208) (Go back)
  7. Cal. Lab. Code § 1198.5 (Go back)
  8. Cal. Lab. Code § 980 (Go back)
  9. 15 U.S.C. §§1681 et seq. (Go back)
  10. Cal. Civ. Code § 1786 (Go back)
  11. Cal. Gov. Code § 12952 (Go back)
  12. Cal. Lab. Code § 1051 (Go back)
  13. Cal. Gov’t Code § 12940(o) (Go back)
  14. Cal. Lab. Code § 432.7 (Go back)
  15. Cal. Lab. Code § 432.8 (Go back)
  16. Cal. Lab. Code § 432.3 (Go back)
  17. Cal. Pen Code § 290.46 (Go back)

Related Posts

Scroll to Top