How can a business distribute an employee privacy notice to current employees?

Beginning in 2020, the CCPA required that businesses subject to the Act provide their employees with a privacy notice that identified (1) the type of personal information collected about California employees and (2) the purpose of the collection.1  Beginning on January 1, 2021, employers are required to include twelve additional topics in employee privacy notices.

While the CCPA does not dictate the manner in which a privacy notice is distributed to employees, many employers consider using one, or more, of the following distribution techniques:

  1. Computer log-in notice.  Some employers add a link to the employee privacy notice on the log-in screen of all workstations.
  2. Email.  Some employers email a copy (e.g., PDF) or a link (e.g., internal SharePoint) of the employee privacy notice to all employees at least once a year.
  3. Employee handbook. Some employers include a copy of the employee privacy notice in the employee handbook.
  4. Open enrollment.  Some employers include a link to the employee privacy notice on the page or portal used by employees to select, or confirm, their benefits elections each year.
  5. Paper Distribution.  Some employers distribute a hard copy of the privacy notice to each employee, or post a copy of the privacy notice in a public space available to employees (e.g., break rooms).

It is important to note that, regardless of the distribution manner selected, if the Modified Proposed Regulations to the CCPA are adopted, an employer should also take steps to make the privacy notice “reasonably accessible” to employees with disabilities.2 As a result, if some employees do not have access to some format as a result of a disability (e.g., visually impaired employees might not utilize computers or email), a business may need to consider alternative methods of communicating.  It is also important to note that the Modified Proposed Regulations imply that even if a business elects to distribute a privacy notice in hard copy (e.g., paper distribution) it may still need to post an electronic copy of the privacy notice “online.”3

The distribution technique that is best suited for a particular company may depend on a number of factors, including whether employees have access to computers at work, maintain work email addresses, receive benefits, or have access to an employee handbook.