Privacy notices and disclosures regulation

The preliminary review should clarify whether existing CCPA notice requirements adequately address the distinction between consumer personal information and employee personal information, as financial services firms currently apply a single disclosure framework across both categories despite their different regulatory contexts.

CalPrivacy's assessment of disclosure mechanisms should evaluate the practical compliance burden of maintaining separate notice standards for financial institutions subject to both state privacy laws and federal banking regulations, particularly regarding timing and channel requirements for employee data disclosures.

The regulatory review presents an opportunity to establish explicit standards for how financial services employers disclose the use of employee financial data for internal compliance monitoring, risk management, and regulatory reporting—activities distinct from consumer marketing and currently addressed through fragmented guidance.