Though enforcement of the California Privacy Rights Act (CPRA) which amended the California Consumer Privacy Act (CCPA) has been paused for now, the State of California is not resting when it comes to compliance with the CCPA.

On July 14, 2023, California’s Attorney General announced an “investigative sweep” regarding compliance with the CCPA. The Attorney General plans to send inquiry letters to large California employers requesting information on compliance with CCPA with respect to the personal information of employees and job applicants. Effective January 1, 2023, the CCPA extended coverage to employees and applicants.  

If a business is uncertain about whether it needs to comply with the CCPA requirements or related issues, review Jackson Lewis’ California Consumer Privacy Act, California Privacy Rights Act FAQs for Covered Businesses.

If you have specific questions about responding to the Attorney General’s investigative sweep or related issues please reach out to a member of our Privacy, Data, and Cybersecurity practice group.

Tags: applicants, Attorney General, CCPA, CPRA, employees, investigative sweep
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Jason C. Gavejian Jason C. Gavejian

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy…

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

As a Certified Information Privacy Professional (CIPP/US), Jason focuses on the matrix of laws governing privacy, security, and management of data. Jason is co-editor of, and a regular contributor to, the firm’s Privacy blog.

Jason’s work in the area of privacy and data security includes counseling international, national, and regional companies on the vast array of privacy and security mandates, preventive measures, policies, procedures, and best practices. This includes, but is not limited to, the privacy and security requirements under state, federal, and international law (e.g., HIPAA/HITECH, GDPR, California Consumer Privacy Act (CCPA), FTC Act, ECPA, SCA, GLBA etc.). Jason helps companies in all industries to assess information risk and security as part of the development and implementation of comprehensive data security safeguards including written information security programs (WISP). Additionally, Jason assists companies in analyzing issues related to: electronic communications, social media, electronic signatures (ESIGN/UETA), monitoring and recording (GPS, video, audio, etc.), biometrics, and bring your own device (BYOD) and company owned personally enabled device (COPE) programs, including policies and procedures to address same. He regularly advises clients on compliance issues under the Telephone Consumer Protection Act (TCPA) and has represented clients in suits, including class actions, brought in various jurisdictions throughout the country under the TCPA.

Read more about Jason C. Gavejian
Show more Show less
Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the…

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Read more about Joseph J. Lazzarotti
Show more Show less
Photo of Damon W. Silver Damon W. Silver

Damon W. Silver is a principal in the New York City, New York, office of Jackson Lewis P.C. and co-leader of the firm’s Privacy, AI & Cybersecurity practice group. He is a Certified Information Privacy Professional (CIPP/US).

Damon helps clients across various industries—with…

Damon W. Silver is a principal in the New York City, New York, office of Jackson Lewis P.C. and co-leader of the firm’s Privacy, AI & Cybersecurity practice group. He is a Certified Information Privacy Professional (CIPP/US).

Damon helps clients across various industries—with a focus on financial services, healthcare, and education—handle their data safely. He works with them to pragmatically navigate the challenges they face from cyberattacks, technological developments including AI, a fast-evolving data privacy and security legal compliance landscape, and an active and innovative plaintiffs’ bar.

Damon recognizes that needs vary from one client to the next. Large, mature organizations, for instance, may need assistance managing multi-jurisdictional and multi-faceted compliance obligations. Others may be in a stage of development where their greatest need is to triage what must be done now and what can more safely be left for later. Damon takes the time to understand each client’s circumstances and priorities and then works with it to develop tailored approaches to effectively managing risk without unnecessarily hindering business operations.

Read more about Damon W. Silver
Show more Show less
Photo of Mary T. Costigan Mary T. Costigan

Mary T. Costigan is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a core member of the firm’s Privacy, Data and Cybersecurity practice group. She holds a Certified Information Privacy Professional/US designation from the International Association of…

Mary T. Costigan is a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a core member of the firm’s Privacy, Data and Cybersecurity practice group. She holds a Certified Information Privacy Professional/US designation from the International Association of Privacy Professionals (iapp).

Mary advises regional, national and multinational clients across various industries on data privacy and cybersecurity laws and best practices including employee monitoring, internet privacy, biometric data collection, artificial intelligence, the California Consumer Privacy Act (CCPA), HIPAA, and the EU General Data Protection Regulation.

Mary has extensive experience helping clients respond to cybersecurity incidents including ransomware attacks.

Read more about Mary T. Costigan
Show more Show less
Photo of Sean Paisan Sean Paisan

Sean Paisan is of counsel in the Orange County, California, office of Jackson Lewis P.C. He is the leader of the firm’s Cal/OSHA practice subgroup and co-leader of the firm’s Construction industry group. His practice focuses on assisting employers with Cal/OSHA compliance, investigations…

Sean Paisan is of counsel in the Orange County, California, office of Jackson Lewis P.C. He is the leader of the firm’s Cal/OSHA practice subgroup and co-leader of the firm’s Construction industry group. His practice focuses on assisting employers with Cal/OSHA compliance, investigations, and fighting citations. Additionally, Sean also assists employers in data privacy and traditional employment matters, including litigation and counseling.

Sean’s first exposure to OSHA regulations occurred during his undergraduate studies while working for a construction company that helped build Disney’s California Adventure. After attending law school and working for the Los Angeles County District Attorney’s Office and the United States Attorney’s Office, Sean moved into private practice, where he focused on general liability matters, including serious injuries and fatalities. Through this experience, Sean became very knowledgeable on the myriad of Cal/OSHA regulations imposed on businesses, especially in the construction, manufacturing, and healthcare industries, and the consequences for violations of those regulations. From there, Sean became OSHA 30 certified and began assisting employers with all workplace safety matters, from compliance, to investigations and inspections, to the appeals of citations in California, Arizona, Washington, and Hawaii.

Throughout his career, Sean has been called upon to try cases that cannot be settled. He has handled trials in the United States District Court, California Superior Court, Cal/OSHA Appeals Board, Workers Compensation Appeals Board, and the US Department of Labor OALJ, as well as binding arbitrations. Sean has tried cases involving the following subjects: general employment, wrongful death, premises liability, unfair competition (B&P § 17200), false advertising (Lanham Act), misappropriation of trade secret, restrictive covenants, and whistleblower (AIR21).

In addition to his trial experience, he is routinely called on to assist his clients with workplace crises such as catastrophic injuries, fatalities, data breaches, and ransomware incidents. Drawing on his years of in both civil and criminal law, Sean’s unique background allows him to anticipate and proactively manage issues, rather than simply reacting to requests and inquiries by investigating agencies such as law enforcement, OSHA, Cal/OSHA, California Bureau of Investigations (BOI), Federal Aviation Administration (FAA), National Transportation Safety Board (NTSB), as well as opposing counsel in litigation matters.

In addition to his litigation experience, Sean has earned the CIPP/US credential through the International Association of Privacy Professionals (IAPP). He helps organizations manage rapidly evolving privacy threats and mitigate the potential loss and misuse of information assets. He has an in-depth understanding of how privacy laws can impact business operations. These laws include the Health Insurance Portability and Accountability Act (HIPAA), Federal Trade Commission Act (FTC Act), Health Information Technology for Economic and Clinical Health Act (HITECH), Genetic Information Nondiscrimination Act (GINA), Fair Credit Reporting Act (FCRA), Gramm-Leach-Bliley Act (GLBA), Fair and Accurate Credit Transaction Act (FACTA), Dodd-Frank Wall Street Reform and Consumer Protection Act, California Financial Information Privacy Act, Family Educational Rights and Privacy Act (FERPA), Telemarketing Sales Rule, Telephone Consumer Protection Act (TCPA), Junk Fax Prevention Act, Controlling Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), Cable Communications Policy Act, Video Privacy Protection Act, Children’s Online Privacy Protection Act (COPPA), California Online Privacy Protection Act (CalOPPA), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). With respect to laws affecting the ability of the government to obtain information, Sean can assist employers in understanding their obligations under the Federal Wiretap Act, Electronic Communications Privacy Act (ECPA), Communications Assistance for Law Enforcement Act (CALEA), Right to Financial Privacy Act, Privacy Protection Act, Foreign Intelligence Surveillance Act (FISA), and USA PATRIOT Act.

Before becoming an attorney, Sean earned his bachelor’s degree in accounting from the University of Southern California, where he also played varsity ice hockey in the ACHA. When not practicing law, Sean enjoys spending time with his wife and three young children, playing adult league ice hockey, mountain biking, and motorsports.

Read more about Sean Paisan
Show more Show less
Related Posts
New CCPA Regulations Go Into Effect, Updated FAQs Summarize Key Compliance Requirements
January 22, 2026
Understanding California’s New CCPA Cybersecurity Audit Requirements
December 8, 2025
The CCPA and Automated Decision-Making Technologies (ADMT)
November 25, 2025