California workers – What you need to know about your data rights

Imagine you show up to work. You’re excited; today is your performance review, you’ve been crushing it at work, and all you have to do is meet with your manager for that salary raise to be official. You walk into the office, take a seat, and your boss says, “We need to have a serious talk. You haven’t been performing well this past year.” 

It turns out that those new cameras they installed in the warehouse monitored you every time you went to the bathroom, even that time you had a bad stomach ache. They had been measuring how fast you were moving your hands on the assembly floor, even after you just worked back-to-back 16-hour shifts the previous week. The new system management uses has flagged you as an inefficient, underperforming employee, regardless of your circumstances. Therefore, they’ve decided that it’s time to let you go. 

Recently, employers have introduced return-to-office mandates, where workers are subject to “behavioral monitoring and profiling” in their workplaces. Clicks, scrolling, keystrokes, and idle activity are just some of the ways employers track and evaluate employees who work remotely. Employers are rolling out algorithms in the workplace to record and collect data on workers, such as in Amazon warehouses, and use that data to discipline workers. 

Employers are increasingly collecting data about workers. But what data are they collecting, and how is this information being used? Workers and researchers highlight how data collected by employers can impact access to work, wages and benefits, health and safety, discipline and retaliation, and so much more. Do companies sell worker data to the highest bidder? Is this data being used to train workplace algorithms, or something worse? 

As Kung Feng, Senior Researcher at the UC Berkeley Labor Center, puts it: “Data is the common denominator for an incredibly broad range of digital technologies that are at work today. There’s this common phrase: data is the new oil.” 

On January 31st, 2025, TechEquity and the UC Berkeley Labor Center convened with impacted workers to discuss what data rights workers have in California and how to exercise those rights. 

Here’s what we learned from Jason Munderloh, an app-based gig worker, and Kung Feng, Senior Researcher at the UC Berkeley Labor Center. 

NOTE: This webinar and explainer blog provide information for educational purposes only and do not constitute legal advice.

How do employers collect data & what do they do with it?

Kung Feng explained the three main stages of worker data usage: data collection, algorithmic pattern recognition, and output-driven employer decisions.

1. Data collection

So, how do employers collect data? In the first stage, employers can collect or buy worker data in various ways. This can include your job activity, biometric data, work speed data, and more. It can be simple, such as how often you badge into a workplace or how much time you spend on your email, or more complex, like how often you’re seen hanging out by the water cooler on the company’s cameras. Electronic monitoring enables employers to actively collect your data when you fill out forms, or your boss can buy your data directly from data brokers. 

2. Algorithmic pattern recognition

Second, algorithms analyze the data and generate an output based on the patterns they identify. This is what most people think of as AI these days, like machine learning and large language models. Essentially, a computer program is searching for patterns. After it’s been fed large amounts of data, the algorithm spits out things like a productivity score or a performance review. 

3. Output-driven employer decisions

Finally, based on the outputs, employers can make decisions such as promoting, hiring, or firing a worker. Throughout this stage, employers use these technologies to make real-life choices. They may decide that you’re slacking off at work and need to be let go, or maybe you’re not seen as a productive employee. Technologies have biases and never paint a complete picture of what we, as humans, experience and produce in the workplace.

Harms of data collection

The impacts of data collection can be detrimental to workers. Some harms include surveillance, exploitation, and automation.  

Surveillance

Studies have shown that electronic monitoring, regardless of how it’s done, consistently leads to increased worker stress. 

This monitoring can have psychological effects, like depression, anxiety, emotional exhaustion, burnout, or physiological effects, like higher rates of back pain, headaches, neck and shoulder stiffness.

Exploitation

Data can be used to micromanage workers, extracting more work from them, sometimes beyond what is humane. This is no surprise to many Amazon warehouse workers, whose productivity is reportedly consistently being monitored and used by Amazon as a way to discipline its workforce. In Los Angeles, Amazon drivers allege that they have resorted to urinating in plastic water bottles to meet productivity expectations.  

Automation

Algorithmic management tools and AI systems use vast amounts of data for training. Some employers say they plan to use this data to replace human workers entirely in efforts to maximize profits. We’ve recently seen this play out in the film and gaming industry, where corporations have threatened to replace voice actors. The imminent harm here is job loss. Technologies that are supposed to make our lives better are instead being used by corporate executives to replace us for profit. 

What data rights do I have?

There’s no comprehensive federal regulation of data and privacy rights. There’s actually only one state that provides worker data rights: California, with the California Consumer Privacy Act.

The expansion of the California Consumer Privacy Act to include workers in 2023 paved the way for more people to gain basic data rights, including the ability to request their collected information from companies across sectors, from employment to housing to the consumer market. For the first time in the US, workers in California have rights around their data at work.

Your data rights include:

1. The right to know
2. The right to access
3. The right to correct or delete 
4. The right to opt out of selling or sharing
5. The right to limit sensitive personal information

Who is covered under the CCPA?

Both workers and consumers are covered under the CCPA in California. Unlike many other worker rights laws, their definition of a worker is expansive. It includes employees, independent contractors, former employees, and job applicants. Labor subcontractors or service providers are also covered under CCPA. Additionally, the law only applies to workers in California at large for-profit businesses in the state.

Why should I access my data?

There are many reasons why workers can and should access their data. During the conversation, Jason Munderloh, an app-based gig worker, explained:

“I ask myself: who am I to Lyft? I’m just data, right? That’s basically what they think of me…a lot of the drivers should know the nature of the surveillance that we’re under. Every driver knows that we’re being monitored through our phone, etc. But knowing, for example, that they’re collecting the accelerometer data and other such things can help us protect ourselves.”

For Jason, the ability to look at his data gave him a clearer understanding of how his employer was monitoring his work. From location data, conversations with customers, and personal information, Jason was able to catch a glimpse of the various levels of data monitoring during the workday. 

Jason can also see the power in numbers. In our discussion, he imagined what we’d learn if we pooled together 200 drivers’ requests, for example. If more workers can exercise their rights like Jason, we can identify more patterns or trends on how companies use worker data—and how we can address the harms that can come from it. 

How do I access my data?

You can exercise your data rights in California under the CCPA by following the steps described in the UC Berkeley Labor Center’s toolkit, “Your Work, Your Data”:

1. Deciding who will make the data request. You can make the request yourself or designate an authorized agent. Authorized agents include worker centers, unions, or other organizations. If you are interested in pursuing a request through an authorized agent, please feel free to reach out to us at TechEquity.
2. Evaluating the risk of retaliation and preparing yourself for that risk. The CCPA does have legal protections against retaliation from companies or employers, but keep in mind that making a data request will identify you with the company, even if you use an authorized agent. 
3. Selecting your method of request. Businesses must provide two methods for making a CCPA request. These methods could include a toll-free number or an online web form. 
4. Writing your data request. You can utilize the sample letter in the toolkit and fill in your information. 
5. Verifying your request and identity with the company. You will need to verify your identity for the request to go through. 
6. Tracking the company’s responses to your request. The CCPA has strict requirements about when and how a company responds to data, so be sure to track when you submit a request, as well as any information coming from the request. 
7. Analyzing the response: Did the company comply with the CCPA? Look at the timing of the response to ensure it meets the CCPA requirements. Identify whether or not the data you requested is complete and accurate. 

If you find that your company or employer violated any of these steps, the CCPA has enforcement mechanisms in place. You can file a complaint with the CPPA, the California Privacy Protection Agency. 

Ready to submit a request?

We know that this process can be tedious or confusing, but TechEquity is available as a resource if you are interested in submitting a CCPA request. 

Workers who exercise their rights build worker power by holding companies and employers accountable. Who knows, maybe the information you and your coworkers collect can help change your company’s practices at scale. At the end of the day, our data belongs to us, and we deserve to exercise our rights around it. 

If you are ready, you can reach out to German Calderon, TechEquity’s Senior Manager of Community Outreach & Engagement, at german@techequity.us. Or you can fill out the form below, and we’ll be in touch!