7 California Employee Privacy Rights You Need to Know
- Last Updated:
What California Law Actually Protects at Work
California gives employees some of the strongest workplace privacy protections in the country. Article I, Section 1 of the California Constitution explicitly guarantees a right to privacy that applies to you at work, not just at home. Layered on top of that constitutional floor are at least six additional statutes: Labor Code § 435 (banning surveillance cameras in restrooms and locker rooms), Labor Code § 980 (protecting your social media accounts), Penal Code § 632 (prohibiting secret recordings without everyone’s consent), Civil Code §§ 56 through 56.71 (keeping your medical information confidential), and Civil Code §§ 1798.100 et seq. (giving you rights over the personal data your employer collects). This article maps all seven rights to the specific law behind each one, so you can identify whether what happened to you crosses a legal line.
Why California Law Is Stronger Than Federal Law
Federal law has no single statute equivalent to Article I, Section 1 of the California Constitution covering employees in private workplaces. That constitutional text creates a baseline floor that every California employer must respect, regardless of industry or company size, and regardless of what a handbook or employment agreement says. That foundation is what makes the protections below enforceable as legal claims, not just policy preferences.
The constitutional right is not absolute. Courts apply a balancing test, weighing the employer’s legitimate business interest against the employee’s reasonable expectation of privacy in the specific context. That is why an attorney’s assessment of your particular facts matters: the same conduct can be legal in one context and actionable in another.
Right #1: No Surveillance Cameras in Restrooms or Locker Rooms
Labor Code § 435 prohibits employers from installing, maintaining, or using any audio or video surveillance equipment in any restroom, locker room, or other area designated for employee changing activities or similar activities. The prohibition is not limited to cameras that are actively recording. Installing or maintaining equipment in those spaces, even if the footage is never reviewed, violates the statute. Violations can result in civil penalties and, in some cases, criminal charges.
What to Do If You Find a Camera in a Private Area at Work
If you discover or suspect a surveillance device in a restroom, locker room, or changing area at your workplace, take the following steps immediately:
- Do not touch or move the device. Disturbing it could destroy evidence or expose you to separate liability.
- Photograph the location (not the device itself at close range) with your personal phone, capturing the area where it is installed and its relationship to the private space.
- Note the date, time, and exact location in writing the same day. Include your own observations about who had access to that area.
- Identify any witnesses who also observed the device, and ask them to write down what they saw independently before you compare notes.
- Report in writing to HR or your direct supervisor by email so you have a timestamped record of when the employer was notified.
- Preserve your own copy of that report. Forward the email to a personal account before any investigation begins.
- Contact law enforcement. Because violations of Labor Code § 435 can constitute criminal conduct, a report to local police or the county sheriff is appropriate in addition to any civil claim.
- Consult an employment attorney promptly. California’s statute of limitations for civil claims is time-sensitive, and early legal guidance preserves your options.
Right #2: Your Employer Cannot Demand Your Social Media Passwords
Labor Code § 980 prohibits employers from requiring or requesting that employees or job applicants disclose their social media usernames, passwords, or other account credentials. The protection applies both during the hiring process and throughout the employment relationship. The statute also prohibits employers from accessing employees’ private social media content without consent.
A common employer tactic is to frame the request as voluntary or “just part of our background screening.” Under Labor Code § 980, the request itself is prohibited regardless of how it is labeled. Consent obtained under threat of losing a job offer or facing discipline is legally contested territory, and employees who were pressured in this way should speak with an attorney about their options.
One important limit: § 980 protects personal accounts. Anything you post publicly can be viewed by your employer without restriction. The statute draws the line at private account credentials and private content.
Social Media Privacy vs. Work Devices and Work Accounts
Labor Code § 980 does not limit an employer’s ability to monitor activity on employer-issued devices or company-managed accounts. If your employer provides a laptop or phone, or if you log into a company email or collaboration platform, a different legal analysis applies to that activity. If your concern involves monitoring on a work device, consult an attorney to assess which protections, if any, cover your situation.
Right #3: Confidential Conversations Cannot Be Secretly Recorded
Penal Code § 632, the California Invasion of Privacy Act, makes it unlawful to intentionally record or eavesdrop on any confidential communication, including in-person conversations, phone calls, and electronic transmissions, without the consent of all parties. California’s all-party (sometimes called “two-party”) consent standard is stricter than federal law, which requires only one party’s consent. That difference matters in the workplace: a manager or coworker who secretly records a meeting on their phone may be committing a crime under California law, even if the recording would be legal under federal standards.
Both employers and individual coworkers can violate § 632. The statute is not limited to conduct by the company. Violations carry penalties under California law; consult the statute directly for current penalty amounts, as those figures are subject to legislative amendment.
When Recording Is Allowed at Work in California
All-party consent means that your own consent is not enough if the other party has not agreed. A narrow exception exists for conversations in settings where no reasonable expectation of confidentiality exists, such as a genuinely public or open area where any passerby could overhear. That exception is legally narrow and fact-specific. If you are considering recording a workplace conversation for evidence purposes, speak with an attorney before doing so.
Right #4: Your Medical Information Must Stay Confidential
California’s Confidentiality of Medical Information Act (CMIA), codified at Civil Code §§ 56 through 56.71, prohibits employers who receive employee medical information from disclosing it without the employee’s written authorization. Limited exceptions exist for legal proceedings and government actions. Covered information includes drug test results, physician notes, disability records, workers’ compensation records, and documents created under the FMLA, ADA, and OSHA frameworks.
Internally, an employer may use employee medical information only to administer and maintain employee benefit plans (including health care, short-term and long-term disability, and workers’ compensation plans) and to determine eligibility for paid or unpaid medical leave. Using medical information for any other internal purpose, such as sharing a diagnosis with a team manager who has no role in benefits administration, is a violation.
Consider this illustrative example: an HR manager learns through a workers’ compensation filing that an employee has a chronic back condition, and then tells the employee’s direct supervisor so the supervisor can “plan around” expected absences. That disclosure falls outside the permitted uses under the CMIA. The employee would have a private right of action against the employer for the unauthorized disclosure, even without proving that the disclosure caused a specific financial harm.
The CMIA provides a private right of action, meaning you can sue directly without first filing a complaint with a government agency. If you believe your medical information was shared without your written authorization, you may have an actionable claim under Civil Code § 56.
Rights #5 and #6: Your Right to Know, Access, Correct, and Delete Your Personal Data
Effective January 1, 2023, the California Privacy Rights Act (CPRA) extended full data privacy rights to California workers, including current and former employees, job applicants, independent contractors, officers, and directors. The prior employee exemption under the California Consumer Privacy Act expired, and workers are now fully covered.
The CPRA applies to employers that meet at least one of the following thresholds:
- Annual gross revenues exceeding $25 million
- Annually buying, receiving, selling, or sharing the personal information of 100,000 or more consumers or households
- Deriving 50% or more of annual revenues from selling or sharing consumers’ personal information
If your employer meets any of these thresholds, you have the following rights over the personal information it collects about you:
|
Right |
What It Means in Practice
|
|---|---|
|
Right to Know |
Your employer must tell you what categories of personal information it collects and why |
|
Right to Access |
You can request and receive a copy of the personal information your employer holds about you |
|
Right to Correct |
You can require your employer to correct inaccurate personal information it holds |
|
Right to Delete |
You can request deletion of your data; your employer may deny the request where retention is required for payroll, benefits, or legal obligations |
|
Right to Restrict Sensitive Data |
You can limit how your employer uses sensitive personal information beyond what is necessary for the employment relationship |
|
Right to Opt Out |
You can opt out of the sale or sharing of your personal information |
|
Right Against Retaliation |
Your employer cannot penalize you for exercising any of the above rights |
Covered employers must respond to a data privacy request within 45 calendar days of receipt, with a possible extension of an additional 45 days (90 days total) for complex or numerous requests. The up-to-$2,500-per-violation and up-to-$7,500-per-intentional-violation fine is set out in Civil Code §1798.155, not §1798.140 (which is the definitions section).
Right #7: Your Employer Must Notify You Before Collecting Your Personal Data
Before or at the time a covered employer collects your personal information, it must provide a Notice at Collection. That notice must identify the categories of personal information and sensitive personal information being collected, the purposes for which the data is used, whether the data is sold or shared, and how long the data will be retained. Employers must also maintain a privacy policy explaining your rights and how to exercise them. If you never received any such notice at hiring or onboarding, and your employer meets the CPRA thresholds, that is a compliance failure worth documenting.
What This Means If You Think Your Employer Crossed a Line
If anything in this article describes a situation you have already experienced, timing matters. California statutes of limitations for employment privacy claims vary by theory, and delay in consulting an attorney can limit your remedies. Document what happened now: write down dates, names, what was said or discovered, and who else witnessed it. Preserve any emails, texts, or notices you received. If your concern involves a potential criminal violation such as a surveillance camera in a restroom or a secret recording, a report to law enforcement is appropriate in addition to any civil claim. The fact that your employer acted as though its conduct was routine does not make it legal. California’s protections exist precisely because employers sometimes treat these rights as optional.
Frequently Asked Questions
Can my employer read my personal text messages on my own phone?
Generally, Labor Code § 980 protects your private social media accounts, and Penal Code § 632 prohibits secret interception of confidential electronic communications. Whether a specific form of phone monitoring is lawful depends on whether your phone is employer-issued, whether you used it for work, and whether you were given notice. An attorney can assess your specific facts.
Does the CPRA apply to small employers?
The CPRA applies only to businesses meeting at least one of three thresholds: annual gross revenues over $25 million; processing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing consumer data. Employees of smaller employers are not covered by the CPRA, though other California privacy statutes may still apply.
My employer shared my medical diagnosis with my team. What do I do?
If your employer disclosed your medical information without your written authorization outside the narrow permitted uses under the CMIA (Civil Code §§ 56 through 56.71), you may have a private right of action. Document exactly what was disclosed, to whom, when, and how you found out. Then contact a California employment attorney to evaluate whether the disclosure falls within any exception.
Can a coworker legally record me without my knowledge in California?
No. Penal Code § 632 applies to all parties, not just employers. A coworker who secretly records a confidential conversation without the consent of all participants may be violating the California Invasion of Privacy Act.
What if I was fired for asking about my data rights under the CPRA?
The CPRA expressly prohibits retaliation against employees who exercise their data privacy rights. If your employer took an adverse action after you made a data access or deletion request, that retaliation may itself be a separate violation. Consult an employment attorney about both the underlying privacy claim and any retaliation claim. If your termination also raises broader wrongful termination questions, a California employment attorney can evaluate whether you may have a claim related to your job loss. Setareh Law Group also handles serious personal injury matters, including situations handled by an auto accident lawyer in California, a bicycle accident lawyer in California, and a burn injury lawyer in California.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship between you and Setareh Law Group or any of its attorneys. California law is complex and fact-specific; the information here may not apply to your individual situation. Do not rely on this article as a substitute for consultation with a licensed California employment attorney.
Contact Setareh Law Group: If you believe your employer has violated your privacy rights under California law, the attorneys at Setareh Law Group are available to evaluate your situation. Contact the firm for a consultation. No outcome or recovery is guaranteed.
Contact us today:
📞 Phone: 310-888-7771
✉️ Email: help@setarehlaw.com
🌐 Address: 420 N Camden Dr, Beverly Hills CA, 90210
Disclaimer: This information is provided for educational purposes and does not constitute legal advice. Each case is unique, and outcomes depend on specific facts and circumstances. Consult with a qualified California employment attorney to discuss your individual situation.
Sources and Additional Resources
Authoritative sources cited
- Article I, Section 1 of the California Constitution
- Labor Code § 435
- Labor Code § 980
- Penal Code § 632
- Civil Code §§ 56 through 56.71
- Civil Code §§ 1798.100 et seq.
- Civil Code § 1798.140
Related Setareh Law Group resources
- Auto Accident Lawyer in California
- Bicycle Accident Lawyer in California
- Burn Injury Lawyer in California
Practice Areas:
Table of Contents
- verified by Trustindex
