California Consumer Privacy Act (CCPA) Notice at Collection of Personal Information and Privacy Policy — Employment
Last updated: April 2026
Download privacy notice (PDF, 270 KB) Opens a new window.
Scope of this Policy
The California Consumer Privacy Act (CCPA) Notice at Collection of Personal Information and Privacy (Policy) applies to the personal information of California residents (hereinafter referred to as “you”), collected by the Canadian Imperial Bank of Commerce (hereinafter referred to as “CIBC” or “we”) including the personal information collected when you visit CIBC’s website, in your capacity as an employee or as a prospective employee.
Personal information does not include:
- Information publicly available from government records or made publicly available by you or with your permission.
- Deidentified or aggregated information.
- Information excluded from the scope of the California Consumer Privacy Act (CCPA), such as protected health information covered by the Health Insurance Portability and Accountability Act or the Health Information Technology for Economic and Clinical Health Act, medical information covered by the California Confidentiality of Medical Information Act or personal information covered by certain sector-specific privacy laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.
California Notice at Collection
CIBC collects the personal information identified in the section “What we collect and how we collect it,” for the purposes identified in the section below titled “How we use and retain your information,” and for the time periods identified in the section. CIBC may disclose personal information for cross-context behavioral advertising (hereinafter referred to as “sharing”) as described in the section “What we disclose and to whom.” CIBC does not sell your personal information or collect or process sensitive personal information for the purpose of inferring characteristics about you.
California residents — your privacy rights regarding your actual or prospective employment
What we collect and how we collect it
CIBC may collect the following categories of personal information from you in your capacity as an employee or prospective employee. Not all categories may be collected about every individual. Over the past 12 months CIBC has collected, and may continue to collect on an ongoing basis, the following categories of information:
| Category | Examples/Purpose of Collection |
|---|---|
| Identifiers | A real name, alias, email, telephone number, residential or business address, employee identification number for data and benefits analysis |
| Characteristics of Protected Classifications Under California or Federal Law for employees | Age, marital status, gender, national origin, disability, veteran status, collected as part of inclusion and diversity initiatives or as necessary to comply with applicable laws. Disability, medical condition, and pregnancy, childbirth, breastfeeding, and related conditions, as necessary to comply with applicable laws related to leaves of absence and accommodation |
| Professional employment-related information | Current or past job history related to an individual, professional credentials, training, seniority, job titles, education, business travel and expense records, compensation (salary, bonus and commission, equity compensation) |
| Benefits information | Information necessary to administer short and long-term benefits as well as other benefit plans, beneficiary information |
| Internet or other similar network activity | Browsing history, cookie information and log in/out and activity on CIBC's electronic resources |
| Preferences | Hobbies and leisure activities, membership in voluntary/charitable/public organizations, and preferences regarding work tools, travel, hours, food for company events, etc. |
| Geolocation | To help serve the appropriate CIBC website or provide suggestions based on physical location |
| Audio, electronic, visual, or similar information | Audio or visual recordings of workplace conversations (e.g., telephone conversations), business meetings or training sessions may be captured by CIBC for various reasons, such as to facilitate accurate information gathering, provide absent parties with access to meeting content or respond to workplace accommodation needs; images on building and ATM security cameras; voice message recordings, photos and other images or videos (i.e., events, promotions) |
| Prospective employee assessments | Inferences drawn from any of the personal information provided as part of an employment application to create a profile about a prospective employee reflecting the prospective employee’s preferences, characteristics, predispositions, behavior, attitudes, abilities and aptitudes |
| Category | Examples/Purpose of Collection |
|---|---|
| Government issued identification numbers | Social Security Number or Social Insurance Number, driver’s license, state identification card, or passport number, including issue and expiration dates and personal address, as applicable |
| Financial information | Bank details for payroll and reimbursement purposes. |
| Race, ethnicity, sex life or sexual orientation | Demographics collected as part of inclusion initiatives or as necessary to comply with applicable laws |
| Biometrics | Fingerprints to manage physical access to secure areas |
| Health information | To manage health and safety in the workplace, meet accommodation needs, and administer health benefits plans |
| Citizenship and immigration status | To ensure employment eligibility and comply with immigration law |
CIBC may obtain the categories of personal information listed above as follows:
- Directly from you. For example, from forms you complete or benefit selections you may choose.
- Indirectly from you. For example, from observing your actions on CIBC’s website.
- From publicly available sources. Public records or widely available sources, including information from the media, and other records and information that are made available by federal, state and local government entities. CIBC may collect personal information that you intentionally choose to make public, including via social media (for example, CIBC may collect information from public social media profile(s) to the extent individuals choose to make their profile(s) publicly visible and accessible).
- From business partners. For example, CIBC may rely on professional employer organizations or staffing agencies for recruiting purposes; other employees may provide information about CIBC , such as performance or evaluation information from a people leader or other member of management. CIBC may combine information collected from different sources.
How we use and retain your information
CIBC may use the personal information collected for one or more business purposes as described below:
- To administer the employment relationship, including recruitment, human resources administration, timekeeping, disciplinary matters and facilitating employee communication and collaboration’
- To create, maintain, customize and secure your payroll and benefits with us.
- For performance management, internal reporting and other administrative processes.
- To defend CIBC company, property, and others.
- To manage and secure CIBC assets and premises and maintain the health and safety of others.
- To respond to law enforcement requests and as required by applicable law, court order or governmental regulations.
- As otherwise permitted by law, or for the purposes expressed to you when collecting your personal information.
In the 12 months preceding the date of the Policy, CIBC has not “sold” personal information subject to the CCPA nor have CIBC “sold” personal information of minors under the age of 16. As defined by CCPA, “sold” means the disclosure of personal information to a third party for monetary or other valuable consideration. CIBC does not use or disclose sensitive personal information, as defined by California law, for inferring characteristics about an individual.
CIBC keeps personal information as long as it is necessary or relevant for the purposes for which it was collected. For employees, CIBC retains information in accordance with CIBC’s Records Retention Schedule, available on the CIBC Intranet. For prospective employees, if hired, we will retain your personal information for the duration of the employment relationship, and as described above. CIBC will retain information of prospective employees who are not hired for seven years after the record is collected, for our internal recordkeeping and reporting purposes in compliance with California Government Code § 12946. We may keep information for a longer period than as described above, where required by law.
What we disclose and to whom
Over the past 12 months CIBC has disclosed, and may continue to disclose on an ongoing basis, personal information to the categories of third parties listed below, for the following “business purposes” as that term is defined by California law:
- Service providers: CIBC may disclose to its service providers any of the categories of personal information listed in the section “What we collect and how we collect it,” for the business purpose of performing services on CIBC’s behalf, and for the specific purposes described in the section “How we use and retain your information.”
- Auditors, lawyers, consultants, and accountants engaged: CIBC may disclose the categories of personal information listed in the section “What we collect and how we collect it,” for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on CIBC’s behalf.
- Affiliated companies: CIBC may disclose any of the categories of personal information listed in the section “What we collect and how we collect it,” to other companies within the CIBC group of companies, for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research and (f) activities to maintain or improve the quality or safety of a service or device.
In addition, CIBC has also disclosed over the past 12 months and may continue to disclose, personal information to the following categories of third parties for purposes other than a “business purpose” as defined by California law:
- Your direction: CIBC may disclose your personal information to third parties at your direction.
- Clients and customers: For example, CIBC may disclose your business contact information to a CIBC customer for customer support purposes.
- Business partners: For example, CIBC may disclose your business contact information to a co-developer of a new product or service with which you will be working.
- Government or administrative agencies: For example the Internal Revenue Service to pay taxes or the California Department of Industrial Relations as required to resolve workers’ compensation claims.
- Public: CIBC may disclose personal information of employees to the public as part of a press release, for example, to announce promotions or awards or in marketing and promotional materials with your authorization.
- Legal compliance and required disclosures: CIBC may disclose personal information if thought to have in order to comply with the law or to protect CIBC. For example, CIBC may disclose information in response to a court order or subpoena or to a request made by a government agency or investigatory body, including U.S. and non-U.S. law enforcement or regulatory authorities.
- Protections: CIBC may disclose personal information when believed disclosure is necessary to protect the rights, property, or safety of CIBC, individuals, or others.
- Corporate Transactions: As part of a merger, acquisition or other sale or transfer of all or some of our assets or as part of a bankruptcy or financing, CIBC may disclose all categories of personal information.
CIBC may share personal information for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising. Review the CIBC Digital Banking Privacy Notice and Cookie Policy to learn more about how CIBC uses online tracking technologies, such as cookies, to conduct personalization, analytics and targeted advertising.
How to exercise your rights
You can exercise your CCPA rights or ask for more information in two ways:
- Fill out and submit the CIBC Individual Rights Form
- Call one of our agents at 1-800-662-7748 Opens your phone app.
Submit a request
All requests must be verified prior to receiving a response. To verify a request, each request must include certain criteria:
- Enough information that lets CIBC reasonably confirm you are the person about whom personal information has been collected or an authorized representative.
- Enough detail in your request that lets CIBC properly understand, evaluate and respond to it.
CIBC will search existing information to confirm your identity or authority to make the request. Please note that for certain requests, you may be asked to provide a signed declaration under penalty of perjury affirming that you are the consumer whose personal information is the subject of the request. Information submitted for verification purposes will only be used to verify your identity and/or authority to make a request on another’s behalf.
If CIBC cannot verify your request, it may be denied. Additionally, CIBC will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another California resident or where the personal information that CIBC maintains about you is not subject to the CCPA's access or deletion rights.
Upon submission of a request, you will receive an initial confirmation of receipt within 10 business days. We will respond to your request within 45 calendar days. If we need an extension for up to an additional 45 calendar days is required in order to process your request, you will be provided with an explanation for the delay.
Under CCPA, you may only make a verifiable request for access twice within a 12 month period.
Designate an Agent
You may directly exercise these rights or designate an authorized agent to make a request on your behalf. If you are a minor under 16 years of age, your parent or guardian may make a verifiable request on your behalf.
Requests made on another person’s behalf can only be accepted upon receipt of documentation that the requestor is an authorized agent, parent or legal guardian of the consumer whose information is being requested. This will require the submission of a valid Power of Attorney, Birth Certificate, Guardianship Order or other court order granting authority to receive information, as appropriate.
Your California privacy rights
As a California resident, you have certain rights with respect to your personal information.
Access to specific information rights
Subject to certain exceptions, you have the right to know what personal information CIBC has collected about you, as well as how personal information is being used and the retention period of same for business purposes. Once CIBC receives and confirms your verifiable request you will be provided with the following:
- The categories of personal information CIBC collected about you.
- The categories of sources for the personal information CIBC collected about you.
- CIBC’s business or commercial purpose for collecting that personal information.
- The categories of third parties with whom CIBC has or may have disclosed that personal information.
- The specific pieces of personal information CIBC has collected about you.
- If CIBC disclosed your personal information for a business purpose, you will be provided with separate list of disclosures for a business purpose. CIBC will identify the personal information categories that each category of recipient received.
Deletion request rights
You have the right to ask CIBC to delete any of the personal information collected from you and retained , with certain exceptions. Once CIBC receives and confirms your verifiable request, your personal information will be deleted from CIBC’s records, unless there’s an exception.
Correction rights
Subject to certain exceptions, you also have the right to ask CIBC to correct any inaccurate personal information collected from you and retained . Once CIBC receives and confirms your verifiable request, your personal information within CIBC’s records will be corrected.
Antidiscrimination rights
CIBC does not discriminate or retaliate against you for exercising your privacy rights as described in this Policy.
Do not sell or share rights
CIBC does not sell personal information, meaning under California law, that CIBC does not provide personal information to a third party for monetary or other valuable consideration. CIBC does not sell personal information of minors under the age of 16.
CIBC may share personal information as defined by CCPA as the disclosure of personal information to a third party for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising in the following ways:
- You can enable the Global Privacy Control (GPC) in your browser. GPC is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When CIBC detects a GPC signal from a browser our Digital Banking services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.
- You can opt out of cross-context behavioral advertising by going to Manage cookie preferences and switching the toggle to the left and clicking save, indicating that you do not want CIBC to share your personal information for cross-context behavioral advertising.