Workplace Privacy Rights in California

Overview

California provides strong privacy protections to employees, extending beyond federal law. The California Constitution explicitly recognizes the right to privacy, and California statutes impose significant limitations on employer surveillance, monitoring, and information collection. This guide covers California's privacy framework as it applies to the workplace.

Unlike federal law, which provides limited privacy protections, California law restricts employers' ability to monitor communications, collect personal information, conduct drug testing, and conduct background investigations. Employees in California have stronger privacy rights than employees in most other states.

California Constitution Right to Privacy

California Constitution Article 1, Section 1 explicitly provides that individuals have an inalienable right to privacy. This provision has been interpreted broadly by California courts to protect employees from invasive employer monitoring and information collection.

The right to privacy applies to both private employers and government employers. This is broader than the Fourth Amendment, which applies only to government action. Under California law, employees may bring tort claims for invasion of privacy against private employers in certain circumstances.

Reasonable Expectation of Privacy

An employee has a legally recognized privacy interest in situations where the employee has a reasonable expectation of privacy. Courts examine whether the employee's reasonable expectation of privacy is outweighed by the employer's legitimate business interest. Relevant factors include:

• The nature of the information sought
• The method of surveillance or collection
• The scope of the monitoring (targeted vs. blanket)
• Whether the employee was notified of the monitoring
• The workplace context and industry standards
• The employer's stated business justification

Email and Internet Monitoring

Under California law, employers have some ability to monitor work-related email and internet usage on employer-owned devices. However, California law provides stronger protections than federal law, particularly regarding:

Work Email on Employer Systems

An employee may have a reduced expectation of privacy in email sent through an employer's email system, particularly if the employer has clearly notified the employee that email is monitored. However, the employer's ability to monitor is not unlimited. California courts have found privacy violations even in monitored workplace email systems when:

• Monitoring is performed secretly, without employee notice
• The employer intercepts personal communications unrelated to work
• The monitoring is extraordinarily broad and not limited to work-related matters
• The employer accesses password-protected personal email accounts

Personal Email and Devices

Employers have significantly less authority to monitor personal email accounts or personal devices, even if those devices are used at work. Accessing a personal email account or personal device without consent may violate California law regardless of whether the device is used for work purposes.

BYOD and Personal Device Policies

Many employers allow or encourage employees to bring personal devices (smartphones, laptops, tablets) to work. California law restricts employers' ability to monitor personal devices even when used at work.

Employer Limitations

An employer generally may not:

• Require an employee to disclose passwords to personal devices or accounts
• Install monitoring software on a personal device without explicit consent
• Search or review personal data on a personal device
• Require remote wiping or deletion capability on a personal device as a condition of employment

Clear Policies Required

If an employer wishes to monitor or restrict access to personal devices at work, the employer must provide clear, written notice to the employee in advance. The policy must specify:

• The types of monitoring or access that will occur
• The scope and frequency of monitoring
• Which employees are subject to the policy
• The business justification for the monitoring
• How data will be protected and used

Social Media Privacy

California Labor Code Section 980 protects employee privacy in social media activities. Under LC 980:

Prohibited Employer Conduct

An employer may not:

• Require or request an employee to disclose usernames, passwords, or access credentials for social media accounts
• Require or request an employee to add the employer (or employer representative) as a friend or contact on a personal social media account
• Require or request an employee to allow the employer to monitor the employee's social media accounts
• Take adverse employment action against an employee based on the employee's refusal to comply with these prohibited requests

Exceptions

LC 980 provides limited exceptions:

• Employers may conduct reasonable investigations or monitoring of employee conduct using publicly available social media information
• Employers may require disclosure of accounts used for work purposes
• Employers may access accounts that are clearly business accounts or used for work

Non-Work Social Media Activity

Even if an employee's social media activity is discovered through lawful means, employers have limited authority to discipline or terminate employees based on non-work-related social media activity. Such discipline may constitute wrongful termination or violation of public policy under California law.

Drug Testing Limitations

California law imposes stricter limitations on employer drug testing compared to federal law. Drug testing raises significant privacy concerns and must comply with California legal standards.

Pre-Employment Drug Testing

Pre-employment drug testing is permitted under California law, but employers should note:

• All employees subject to testing must be tested (no selective testing based on protected characteristics)
• Testing must be performed by a certified laboratory
• Applicants must be notified in writing that drug testing is a condition of employment
• Results must be kept confidential

Post-Employment Drug Testing

Post-employment (random or for-cause) drug testing is more restricted under California law. Employers may conduct post-employment drug testing only in limited circumstances:

• When there is reasonable suspicion of impairment at work
• After an accident or workplace injury (in some contexts)
• For certain safety-sensitive positions (with advance notice and clear policies)
• When required by federal law or regulation

Random, suspicionless drug testing of current employees is generally unlawful under California privacy law, even for safety-sensitive positions.

Background Check Restrictions

California's "Ban the Box" law and other statutes restrict employer background checks. These restrictions relate to privacy and protect applicants from discrimination based on sealed or minor records.

Pre-Offer Restrictions

Under the Fair Chance Act (AB 1008, Government Code Section 12952, effective 2018), employers with five or more employees may not conduct background checks on job applicants until after making a preliminary offer of employment (contingent on the background check results).

What Happens If They Want to Withdraw the Offer

This is the part of the Fair Chance Act that actually protects an applicant, and it is the part least often explained. An employer that decides to rescind a conditional offer because of conviction history cannot simply do it.

First, section 12952 requires an individualized assessment of whether the conviction has a direct and adverse relationship with the duties of the job. It must consider three things:

• The nature and gravity of the offense or conduct
• The time that has passed since the offense or conduct and completion of the sentence
• The nature of the job held or sought

Second, the employer must give written notice that identifies the specific disqualifying conviction, includes a copy of the conviction history report, and explains the right to respond.

Third, and most importantly, the applicant has at least five business days to respond before the decision becomes final. That response may include evidence challenging the accuracy of the report, or evidence of rehabilitation or mitigating circumstances. If the applicant disputes accuracy and is gathering supporting evidence, they get five additional business days.

If you receive that notice, the five business days are the whole opportunity. An employer that withdraws an offer without the assessment, without the written notice, or without waiting out the response period has not complied, and that is separate from whether the conviction itself would have justified the decision.

Scope Limitations

Employers must limit background checks to information relevant to the job. Two different bodies of law are at work here and they are easy to run together:

• Under the Fair Chance Act (Gov. Code § 12952), an employer may not consider arrests that did not lead to conviction, referrals to or participation in diversion programs, or convictions that have been sealed, dismissed, expunged, or statutorily eradicated. There is no seven-year cutoff in section 12952.
• Under the reporting rules (Civ. Code § 1786.18), a background check company is separately barred from reporting most adverse information older than seven years, with the clock on a conviction running from the date of disposition, release, or parole. A full pardon removes it altogether. Records of arrest or indictment may be reported only while judgment is pending, and not once the matter fails to produce a conviction.
• Certain non-criminal history is separately restricted, and credit reports may be obtained only for the narrow categories of position the law specifies.

The distinction matters in practice. A conviction older than seven years may be outside what a reporting agency can hand the employer, while a recent conviction is fair to report and still cannot lawfully be acted on without the assessment and notice steps above.

Consent and Disclosure

Employers must obtain written consent before conducting background checks and must disclose the results to the applicant. If the employer intends to deny employment based on the background check, the employer must provide a copy of the report and an opportunity to dispute inaccuracies.

Medical Information Privacy

California's Confidentiality of Medical Information Act (CMIA) imposes strict privacy protections on medical information. Medical information includes any information regarding an individual's medical history, mental or physical condition, or medical treatment.

Limitations on Disclosure

Employers may not disclose medical information without express written authorization from the employee, except:

• To healthcare providers treating the employee
• To insurance providers handling claims
• To government agencies as required by law
• To emergency responders in appropriate circumstances

Workplace Accommodations and Medical Inquiries

Employers must limit medical inquiries to what is necessary. Under the Americans with Disabilities Act and FEHA, employers may not:

• Ask disability-related questions before making a job offer
• Require medical examinations before making a job offer
• Ask overly broad questions about medical history
• Disclose disability or medical information to coworkers

Workplace Surveillance and GPS Tracking

Employers have authority to manage workplace productivity, but California law restricts the methods by which employers can monitor employee location and activities.

GPS Tracking and Location Monitoring

GPS tracking of employees is restricted under California privacy law. Relevant issues include:

• Personal vehicles: Employees have a strong privacy expectation in their personal vehicles. Installing GPS trackers on personal vehicles without consent may violate California privacy law.
• Company vehicles: Employers have greater authority to track company vehicles, but should provide notice to employees.
• Mobile devices: Tracking personal mobile devices without employee knowledge and consent is likely unlawful.
• Work hours: Employers may track location during work hours more readily than during off-duty hours.

Workplace Video Surveillance

Employers may conduct video surveillance in workplace areas where employees have a reduced expectation of privacy (such as customer service areas), but may not:

• Install cameras in restrooms, locker rooms, or changing areas
• Conduct secret surveillance in areas where employees have a reasonable expectation of privacy
• Use surveillance as a pretext for discriminatory treatment

Employee Remedies and Enforcement

Employees who experience privacy violations have several potential remedies and enforcement mechanisms under California law:

Tort Claims

Employees may bring civil lawsuits for invasion of privacy based on California common law. Remedies may include compensatory damages for emotional distress and punitive damages.

Statutory Claims

Some privacy statutes carry their own money remedy and some do not, and the difference matters when you are deciding what a claim is worth:

• Penal Code Section 637.2 (the civil remedy for the Invasion of Privacy Act, which covers recording and intercepting communications): recovery is the greater of $5,000 per violation or three times actual damages. The $5,000 is a floor rather than a cap, so a plaintiff with substantial actual damages can recover more, and the statute says actual damages are not a prerequisite to suing at all. Conduct in this chapter can also carry criminal liability.
• Labor Code Section 980 (employer demands for personal social media credentials): the section prohibits the conduct and, in subdivision (e), prohibits retaliation for refusing an unlawful demand, but it sets no damages figure and creates no express private right of action. A worker in this situation should expect the remedy to come from somewhere other than Section 980 itself.
• CMIA (Confidentiality of Medical Information Act, Civil Code Section 56 and following): two different remedy provisions, and which one applies depends on what happened. Section 56.36(b) covers a negligent release and allows nominal damages of $1,000, stating expressly that to recover them "it is not necessary that the plaintiff suffered or was threatened with actual damages," plus actual damages if there were any. Section 56.35 is the other route, for a use or disclosure violating Section 56.10, 56.104, 56.107, 56.20 or 56.26(a); it allows compensatory damages, punitive damages capped at $3,000, attorney's fees capped at $1,000, and costs, but it is available only to someone who "has sustained economic loss or personal injury" from the violation, and it authorises no nominal damages. Section 56.20 is the provision aimed at employers, and a violation of it is one of the triggers for Section 56.35. Note how small the fee cap is: $1,000 will not fund a case, so CMIA is usually a claim that travels alongside others rather than one worth bringing alone.

Administrative Complaints

Employees may file complaints with:

• California Division of Labor Standards Enforcement (DLSE)
• California Attorney General's Office
• California Public Utilities Commission (for electronic surveillance)

Best Practices for Employees

Employees concerned about privacy in the workplace may consider:

• Maintaining separation between personal and work communications and devices
• Using personal email and devices sparingly for work purposes
• Reviewing employer policies and understanding what monitoring occurs
• Refusing requests that violate California privacy law and documenting refusal
• Documenting privacy violations if they occur
• Consulting an employment attorney if violations are suspected

Conclusion

California law recognizes and protects employee privacy in multiple contexts. Employees have the right to expect privacy in personal communications, personal devices, social media accounts, medical information, and location data. Employers who monitor, surveil, or collect information in violation of California law expose themselves to significant liability. Employees who believe their privacy rights have been violated are encouraged to consult with a qualified employment attorney.