California Workplace Privacy Lawyer

Reviewed by Michael Nourmand, a California workplace privacy attorney and Founding Attorney at The Nourmand Law Firm, APC. Last updated October 27, 2026.

Workplace privacy claims rarely begin with the word privacy. One starts with a lens above a locker room bench. Another starts when a supervisor scrolls through a nurse’s personal messages, or a manager tells the warehouse floor why someone went on medical leave. California law reaches each of these. A California workplace privacy lawyer usually begins by working out which statute or constitutional rule fits the facts.

The Nourmand Law Firm, APC handles workplace privacy claims for California employees only, and it has never represented an employer. Its privacy work sits next to its employee data breach claims, which arise when an employer or its payroll vendor loses workers’ personal information. A worker who was disciplined or fired for objecting to surveillance may also have a claim under the firm’s California wrongful termination practice. The firm reviews both at no charge, in English or Spanish.

What Privacy Rights Do California Employees Have at Work?

The constitutional right to privacy is the broadest protection California workers have. In Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, the California Supreme Court held that the privacy clause of Article I, section 1 creates a right of action against private entities as well as the government. A worker bringing that claim must prove a legally protected privacy interest, a reasonable expectation of privacy in the circumstances, and conduct by the employer amounting to a serious invasion of privacy. The employer may answer that the invasion substantively furthers a countervailing interest, such as safety or a misconduct investigation. The employee can reply by pointing to feasible and effective alternatives with a lesser impact on privacy. Hill itself upheld the NCAA’s drug testing of student athletes, so the standard is demanding.

California also protects certain kinds of information by statute. Those statutes do not require proof of a serious invasion. Medical records, personal social media, and bathroom and locker room privacy each have their own rule, and a worker can often rely on the statute and the constitutional claim together.

Hidden Cameras and Secret Recording

Labor Code § 435 bars an employer from causing an audio or video recording to be made of an employee in a restroom, locker room, or changing room. A court order is the only exception. The employer may not use a recording made in violation for any purpose. The rule covers private and public employers except the federal government, and a violation is an infraction.

Cameras outside those rooms are judged under the intrusion standard. In Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272, a residential facility hid a motion-activated camera in an office two clerical employees shared. It was aimed at one employee’s computer, to catch whoever was viewing pornography on it at night. The California Supreme Court held that the employees reasonably expected not to be secretly filmed in their office, even though they could see each other there. The court still ruled for the employer. The camera ran only three times, after hours, and never captured either employee, so the intrusion was not highly offensive.

Bathroom Surveillance Tools Starting in 2027

Assembly Bill 1331 adds a broader rule to the Labor Code on January 1, 2027. A workplace surveillance tool is any system, application, instrument, or device that collects employee data, activities, communications, actions, biometrics, or behaviors by means other than direct observation by a person. GPS, continuous time-tracking, and video all qualify. Under new Labor Code § 1561, an employer may not use one to monitor employees in a workplace bathroom unless a court orders it, and employees may leave such tools outside. The rule reaches public employers, labor contractors, and farm labor contractors. The Labor Commissioner enforces it, with a penalty of up to $500 per violation.

How Do Workplace Privacy Claims Usually Begin?

Most claims start with one of a handful of events. Which law applies depends on the details of each.

• A camera or microphone found in a restroom, locker room, changing area, or private office
• A badge, phone, or handheld scanner that keeps tracking a worker inside the restroom
• A manager or HR employee sharing a worker’s diagnosis, pregnancy, or treatment with coworkers
• A demand for a social media password, or an order to open a personal account during a meeting
• Testing or questioning that reaches into the worker’s private life, such as drug testing
• An employer’s refusal to say what personal data it collects about the people it employs

Drug testing is one of the oldest workplace privacy disputes in California. Whether a test is lawful turns on whether the person is an applicant or a current employee, and on the job’s safety demands, as the firm’s page on employer drug testing in California describes.

Social media demands fall under Labor Code § 980. An employer may not require or request that an employee or applicant disclose a personal social media password, open personal social media in front of the employer, or divulge it. The statute allows a narrow request tied to a misconduct investigation. It also lets an employer require the password to a device the employer issued.

What Can an Employee Recover for a Privacy Violation at Work?

Remedies depend on which law was broken. Several of these statutes carry their own fixed amounts.

Under Civil Code § 56.20, an employer that receives medical information must set up procedures to keep it confidential. It may not use or disclose an employee’s medical information without a signed authorization. The exceptions are narrow. They cover disclosures compelled by a court or another law, information relevant to a lawsuit or grievance in which the employee has put their own condition in issue, use in administering benefit plans, workers’ compensation, and medical leave, and disclosure to a health care provider where the employee cannot authorize it. An employee whose information was misused and who suffered economic loss or personal injury may recover under § 56.35. No employee may be discriminated against for refusing to sign an authorization.

The CCPA adds rights over the data itself. Subdivision (m) of Civil Code § 1798.145 had exempted data about job applicants and employees, and it became inoperative on January 1, 2023. An employee of a covered business may now ask for the categories and specific pieces of personal information collected about them, under § 1798.110. Section 1798.125 bars retaliation for exercising those rights. The CCPA’s own lawsuit right is narrower, reaching only data breaches caused by a failure to keep reasonable security.

The CCPA covers a for-profit business that does business in California and meets a size threshold. One threshold is annual gross revenue above $26,625,000, the inflation-adjusted figure the California Privacy Protection Agency set for 2025. Public agencies and nonprofit employers generally fall outside it.

How Does a Workplace Privacy Claim Move Forward?

The route depends on the law involved. A Labor Code privacy violation can be reported to the Labor Commissioner, the agency that will enforce the bathroom surveillance rules from 2027. Constitutional, intrusion, and medical privacy claims go to the superior court, where the employee seeks damages directly. Many cases pair a privacy claim with a retaliation or wrongful termination claim. The worker who objects to surveillance is often the one who is later pushed out.

Retaliation complaints carry a firm deadline. Under Labor Code § 98.7, a complaint to the Labor Commissioner over retaliation that breaks a law the agency enforces must be filed within one year after the violation. The employee does not have to file there before suing. The Nourmand Law Firm, APC brings privacy and workplace retaliation claims together for California employees. Its class action results for groups of workers range from $1.35 million to $7.25 million. Call 800-700-WAGE (9243) to have the facts reviewed at no charge.

What Evidence Decides a Workplace Privacy Case?

Privacy cases turn on the details of the intrusion. Where a device sat, what it captured, when it ran, who saw the result, and why the employer says it needed it are the facts the court weighed in Hernandez. They are easiest to prove when they are preserved early.

The personnel file often supplies the rest. Under Labor Code § 1198.5, current and former employees may inspect and copy personnel records about their performance or any grievance. The employer must provide them within 30 calendar days of a written request, or within 35 days if both sides agree in writing.

Building a Workplace Privacy Case Before the Evidence Changes

The Nourmand Law Firm, APC starts a California workplace privacy case by fixing the physical facts before the employer can change them. Its attorneys document the device and its location, identify who could see what it recorded, and request the personnel file and any CCPA disclosures early. They then match the claim to the right statutes. A medical disclosure, a hidden camera, and a password demand each carry a different remedy and a different defense.

Some practices affect a whole workforce, such as tracking that follows every warehouse worker into the restroom. In those cases the firm considers whether the claim belongs among its employment class action lawsuits, brought for the group. It has represented only employees for more than 20 years, works on a no recovery, no fee basis, and serves clients in English and Spanish from the Inland Empire to the Central Valley.

Steps to Take When You Suspect Surveillance at Work

• Photograph any camera, microphone, or tracker where you find it, without moving or damaging it.
• Write down the date you found it and who else uses that space.
• Save every message in which a manager asked about your personal accounts or repeated your medical information.
• Keep copies of the handbook, the monitoring policy, and anything you signed about medical records.
• Make the § 1198.5 personnel file request in writing, since the employer’s 30-day period runs from that request.
• Ask the employer in writing what personal information it holds about you if it is a CCPA-covered business.
• Do not hand over a personal social media password, and note who asked and when.

Questions About Workplace Privacy in California

Can My Employer Ask for My Social Media Password?

Not for a personal account. Labor Code section 980 bars an employer from requiring or requesting a username or password for personal social media, from asking a worker to open it in front of the employer, and from demanding that the worker divulge it. An employer may ask for social media relevant to a misconduct investigation, used only for that investigation. It may also require the password to a device it issued, and it may not retaliate against a worker who refuses an unlawful request.

Can My Employer Tell Coworkers About My Medical Condition?

Generally, it cannot. Civil Code section 56.20 bars an employer from using or disclosing an employee’s medical information without a signed authorization. The exceptions cover disclosures a court or another law compels, legal proceedings in which the employee has placed their condition in issue, and the administration of benefits, workers’ compensation, and medical leave. Telling coworkers why someone is on leave fits none of them.

Can My Employer Put Cameras in the Break Room?

Labor Code section 435 bans audio or video recording only in restrooms, locker rooms, and rooms designated for changing clothes. A camera anywhere else is judged under the constitutional and common law privacy standard. That standard asks whether the employee reasonably expected privacy in that space and whether the intrusion was highly offensive. A visible camera over a shared break room is much harder to challenge than a hidden one in a private area.

Do These Privacy Rights Apply to Government Employees?

Most of them do. The constitutional privacy right reaches government and private employers alike, and section 435 applies to every employer except the federal government. The new bathroom surveillance rules expressly cover state agencies, cities, counties, and school districts. The exception is the CCPA, which covers only for-profit businesses that meet its size thresholds, so it gives a public employee no right to request data from a government employer.

Related Practice Areas

• California data breach claims cover consumers, patients, and workers whose personal information a business exposed through poor security.
• Whistleblower retaliation protects an employee who reports a suspected violation of law, including unlawful surveillance, to an agency or a supervisor.
• Employee background checks explain the written authorization an employer generally needs before ordering a report on an applicant from a screening company.

If you found a camera where one should not be, were tracked into the restroom, or learned that your medical information was shared at work, call The Nourmand Law Firm, APC at 800-700-WAGE (9243) or contact the firm online. The firm represents only California employees in workplace privacy and other employment claims, works in English and Spanish, and offers a free consultation on a no recovery, no fee basis.