California Privacy Agency Brings Enforcement Action Protecting Worker Privacy for the First Time 

On Tuesday, September 30, the California Privacy Protection Agency (CPPA) fined Tractor Supply Company for violations of the California Consumer Privacy Act (CCPA). This is the CPPA’s first enforcement action for a privacy violation that harms California workers. Specifically, Tractor Supply Company was fined for violations that included failing to notify California job applicants of their privacy rights and how to exercise them. 

EPIC welcomes the CPPA’s attention to the privacy rights of Californians as workers as well as consumers. Over-collection of worker data, inappropriate downstream uses of such data, and the uses of automated decisionmaking systems impact workers’ ability to get hired, fairly assessed for performance, receive fair compensation, and protect job security. This enforcement action is a welcome step to ensure that California workers can understand and exercise their privacy rights under the CCPA. 

EPIC has consistently engaged with the CPPA on its regulatory rulemaking process, and published a report on risk assessments that touch on harms to workers.