When the first state consumer privacy law – California Consumer Privacy Act (CCPA) – passed, it applied to employees, but before it went into effect in 2020, 2019’s Assembly Bill 25 created a temporary exemption. By January 1, 2023, however, the exemption expired and the CCPA applied fully to personal information collected from or about employees and job applicants, including the CCPA’s anti-retaliation and anti-discrimination requirements. Last year, the CCPA’s Automated Decision-Making Regulations were finalized, with some special treatment applied to the HR context, as explained below. Other state legislatures, however, have mostly (but not completely, as discussed below) avoided extending their consumer privacy laws to employees and job applicants.
Instead, new laws were enacted to address employers’ use of technology to make recruiting and employment decisions with varying degrees of human involvement. Illinois’ Artificial Intelligence Video Interview Act (in force January 1, 2020) and New York City’s Local Law 144 (in force January 1, 2023) were among the earliest laws that focused on technology use in connection with employment-related decisions. The new laws enacted during 2025 and 2026 are focused on the most potentially harmful uses of technology for recruiting and employment decision-making. Key among these are the CCPA’s final Automated Decision-Making Technology (ADMT) Regulations (in force January 1, 2027), together with these new or amended laws in California, Colorado, Connecticut and Delaware:
| Law | Enacted / In Force |
| California’s Civil Rights Council (CRC) Employment Regulations Regarding Automated-Decision Systems (CCR § 11008 et seq.) (CRC ADS Regulations)
Overview: Addresses employment discrimination resulting from the use of artificial intelligence and other algorithms that it collectively refers to as Automated-decision Systems (ADS). (We wrote about the interplay of CRC ADS Regulations and the CCPA ADMT Regulations for employers here.) |
June 27, 2025 / October 1, 2025 |
| California Labor Code Amendment (AB 1883) (WST Law)
Overview: Amends the Labor Code to regulate “Workplace Surveillance Tools” |
September 30, 2026 / January 1, 2027 |
| California No Robo Bosses Act of 2026 (SB 947)(NRB Act)
Overview: Requires, among other things, “human in the loop” for termination and disciplinary actions. Also requires adverse decision notice if ADS is primarily relied upon for disciplinary or termination decision, which must include contact information to a human to inquire about the decision, the employees’ right to access, and how to make a request. |
September 30, 2026 / July 1, 2027 |
| Connecticut Artificial Intelligence Responsibility and Transparency Act (Public Act No. 26-15) (CART Act)
Overview: Sections 7 to 14 apply to the use of “Automated Employment-related Decision Technology” (defined in Section 1 below). |
May 27, 2026 / October 1, 2026 |
| Colorado Automated Decision-Making Technology Act (SB 26-189) (CO ADMT Act)
Overview: Applies to the use of “Covered ADMT” (defined in Section 1 below). Colorado’s Attorney General issued draft implementing rules, which must be effective January 1, 2027. |
May 14, 2026 / January 1, 2027 |
| Delaware’s Personal Data Privacy Act Amendment (HB 380) (Delaware Amendment)
Overview: Amends the Delaware Personal Data Privacy Act (DPDPA) to include new obligations when a controller provides a “report” used in furtherance of a decision that produces legal or similarly significant effects concerning a Delaware “resident.” The DPDPA no longer completely excludes personal data processed in the context of “an individual applying to, employed by, or acting as an agent or independent contractor” (§ 12D-103(c)(11)(a)). Rather, in scope (i.e., excluded from the exclusion) of the Delaware Amendment is “data processed in connection with profiling and reports” that the controller discloses to a third party “for use in connection with any decision that produces legal or significant effects concerning a resident.” (The term “consumer” is replaced with “resident” for the applicable provisions.) |
September 2, 2026 / January 1, 2027 |
This alert breaks down employer obligations with respect to use of AI technology under these new and amended laws, as well as best practices to apply nationally to avoid not only issues with employment-specific AI technology regulation, but also general anti-discrimination laws.
Requirements
1. Covered Technology
Assessing whether a particular technology is regulated by one or more of these laws (including, for example, any jurisdictional threshold) is the first step because the covered technologies differ among the laws. Please see Appendix 1 below for details.
Other than in the Delaware Amendment, whether a technology is covered is determined based on the ‘decision’ or output of the technology produces and the degree of human involvement in making the final decision. As detailed below, the CCPA ADMT Regulations require the covered technology (ADMT) to replace or substantially replace human decision-making. The CO ADMT Act and the CART Act apply when technology “materially influences,” or is a “substantial factor” in, human decision-making, respectively. The CRC ADS Regulations do not require a particular level of human involvement — facilitation is enough. The Delaware Amendment’s obligations apply whether or not technology is used, when a report (i.e., personal data inputs) is used for decision-making that produces legal or similarly significant effects.
2. Permitted Uses of Covered Technology
The permitted uses of covered technology in the employment context also differ among the laws.
The permitted uses are broader in the CRC ADS Regulations and CART Act and narrowest in the WST Law, which relates to either collecting neural data or recognizing or inferring emotional state. In the middle are the CCPA ADMT Regulations, which tie permitted uses to significant decisions, and the CO ADMT Act, which ties permitted uses to consequential decisions (with some exceptions in each case).
Specifically, the permitted uses are:
- CRC ADS Regulations: An employer or other covered entity is not permitted to use an automated-decision system or selection criteria (including a qualification standard, employment test, or proxy) that unlawfully discriminates against an applicant or employee or a class of applicants or employees, subject to any available defense. Relevant to a claim or available defense is evidence, or the lack thereof, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of an employer’s effort, the results of the testing or other effort, and the response to the results. (§11012(f).)
- CCPA ADMT Regulations: A business that uses ADMT to make a “significant decision” must comply with notice and opt-out rights. As detailed below, an employer can limit opt-out rights in the employment context.
A “significant decision” is a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, “employment or independent contracting opportunities or compensation,” or healthcare services. The phrase “employment or independent contracting opportunities or compensation” means: hiring; allocation or assignment of work for employees, salary, hourly or per-assignment compensation, incentive compensation such as a bonus, or another benefit; promotion; and demotion, suspension, and termination. (See §7001(ddd)).
- WST Law: An employer shall not use a workplace surveillance tool that uses artificial intelligence* on employees for either of the following:
- Recognizing, or making inferences or predictions about, an individual’s emotional state.
- Collecting neural data.**
* “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments (§1580(a).
** “Neural data” means information that is generated by measuring the activity of an employee’s central or peripheral nervous system, and that is not inferred from nonneural information (§1580(e).
- NRB Act: An employer is not permitted to use an automated decision system to do any of the following:
- Prevent compliance with or violate any federal, state, or local labor, occupational health and safety, employment, or civil rights laws or regulations.
- Infer an employee’s protected status under Cal. Gov. Code §12940
- Predict and take adverse action against a worker for exercising their legal rights, including, but not limited to, rights guaranteed by state and federal employment and labor law. (§1522(a).)
An employer also is not permitted to rely solely on an ADS when making a disciplinary or termination decision (§1522(b)(1).
If an employer primarily relies on an ADS output to make a disciplinary or termination decision, the employer must have a human corroborate the decision using data that was collected or used to produce the ADS output or other relevant corroborating or supporting information. The phrase “corroborating or supporting information” includes, but is not limited to supervisory or managerial evaluations, personnel files, work product of employees, peer reviews and witness interviews, that may include relevant online customer reviews. (§1522(b)(2).)
- CO ADMT Act: Starting January 1, 2027, an employer that deploys automated decision-making technology to materially influence a consequential decision must comply with notice requirements (notice at the point of interaction and within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome (§6-1-1704)) and certain rights requests (access to and correction of inaccurate personal data, right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome (§6-1-1705)). (See 4 – 6 below.)
- CART Act: An employer using “automated employment-related decision technology” (AEDT) that is a substantial factor used to make, or that materially influences, an employment-related decision must meet certain disclosure and other requirements, including as described in 4 – 6 below.
- Delaware Amendment: The Delaware Amendment brings certain use of AI in the HR context under the DPDPA but only when the controller is providing or receiving data for use in connection with a decision that results in provision or denial of employment opportunities. Opportunities should be read broadly since the Delaware Amendment’s definition of an adverse action is broad: “any denial, cancellation, unfavorable change, increase in charge, exclusion of a benefit, or other adverse action….”
In the HR context, controllers that furnish “reports” to others used for decision-making that produces legal or significant effects have new obligations. A “report” is “any written, oral, or other communication of personal data by a controller or processor, including recommendations, summaries, or automated decisions based on personal data or profiling” (emphasis added). Importantly, while a report includes profiling or automated-decision making outputs, even raw personal data seems to be in scope. This interpretation is supported by the fact that the obligations on recipients of reports apply not just to use for profiling or automated decision-making, but “for use in connection with any decision that produces legal or similarly significant effects concerning a resident.” (§12-D-106(f)).
The Delaware Amendment requires a controller furnishing a report to contractually pass down certain obligations to a third party (with no processing thresholds for applicability) receiving a report (§12-D-106(f)). A breach of those contractual obligations by a third party is deemed a violation by the third party of the DPDPA.
New adverse decisions notice obligations apply to decisions “based in whole or in part on any information in the report,” not just adverse decision based on profiling or automated decisions-making. (§12-D-106(f)(1)(a))
3. Risk Assessments and Anti-Bias Testing
While risk assessments are only specifically required by the CCPA ADMT Regulations, pre-use assessments and ongoing monitoring are practically necessary. Without pre-launch and on an ongoing assessing and testing, an employer does not have a basis to assess compliance – not only with the laws discussed in this update but also with the anti-discrimination requirements under general labor and civil rights laws.
| Law | Risk Assessments and Anti-Bias Testing |
| CRC ADS Regulations | Risk Assessment: Not required.
Anti-bias testing: Effectively required. “Relevant to any [discrimination] claim or available defense is evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination, including the quality, efficacy, recency, and scope of such effort, the results of such testing or other effort, and the response to the results.” (2 CA CCR §11009(f).) |
| CCPA ADMT Regulations | Risk Assessment: Required, with great specificity including the operational process and logic used and a risk benefit analysis. Beyond use for employment decisions, use to train AI for significant decisions must be assessed. (§7150)
Anti-bias testing: Not required. |
| WST Law | Not required. |
| NRB Act | Not required. |
| CO ADMT Act | Not required. |
| CART Act | Risk Assessment: Not required.
Anti-bias testing: Not required, but like the CRC ADS Regulations, anti-bias testing records can be used as a defense against discrimination claims. “The commission or court may consider evidence of anti-bias testing or similar proactive efforts to avoid such discriminatory practice, including, but not limited to, the quality, efficacy, recency and scope of such testing or efforts, the results of such testing or efforts and the response thereto.” (§46a-60(b)(1).) |
| Delaware Amendment | Risk assessment: An “Impact Assessment” is required, but only in the context of profiling of consumers, not to “residents” (i.e., not in the HR context).
Anti-bias Testing: Not required, but similar to the CRC ADS Regulations, “[e]vidence or lack of evidence concerning proactive anti-bias testing or any similar proactive effort to avoid processing personal data in violation the laws of this State, including evidence or lack of evidence concerning the quality, efficacy, recency, and scope of any such testing or effort, the results of such testing or effort, and the response to the results of such testing or effort, are relevant to any claim for a violation of the laws of this State and any available defense to such claims.” (§12D-106(a)(6)) |
4. Pre-Use Notice Requirement
Pre-use notice is required by CCPA ADMT Regulations, the CO ADMT Act and the CART Act, but the content requirements vary.
| Law | Pre-Use Notice |
| CRC ADS Regulations | Not required. |
| CCPA ADMT Regulations | Required, with great specificity, including available consumer rights and how to exercise them. (§ 7220) |
| WST Law | Not required. |
| NRB Act | Not required. The NRB explicitly does not preempt the CCPA-required notices. |
| CO ADMT Act | Required, with specificity including available consumer rights and how to exercise them. (Point-of-Interaction Notice, § 6-1-1704) |
| CART Act | Required, with less specificity (§ 10) |
| Delaware Amendment | Not required. |
5. Adverse Decision Notice Requirement
Proposals for adverse decision notice under the CCPA ADMT Regulations were considered but ultimately rejected and are instead required by the newer and more limited NRB Act. An adverse decision notice also is required in CO ADMT Act and by a third party in the Delaware Amendment, as described immediately below.
| Law | Adverse Decision Notice |
| CRC ADS Regulations | Not required |
| CCPA ADMT Regulations | Not required. |
| WST Law | Not required. |
| NRB Act | Required if ADS is primarily relied upon for disciplinary or termination decision. Must include contact information to a human to inquire about the decision, the employees’ right to access, and how to request such data. (Automated Decision System Post-use Notice) (§1524) |
| CO ADMT Act | Required, with specificity including individual rights and how to exercise them. (Post-Adverse Outcome Disclosure) (§6-1-1704(3)) |
| CART Act | Not required. |
| Delaware Amendment | Required. The controller is required to obligate the third-party recipient of a report to provide notice to a resident of any adverse action that is based in whole or in part on any information contained in the report. Must include a description of the personal data relied upon, the resident’s right to obtain the information and seek human review, and the contact information to make such a request. (§12D-106(f)(1)) |
6. Individual Rights
Anti-discrimination obligations and transparency are a common thread among these laws. Notably, however, none of them provide an opt-out right in the HR context (subject to some conditions under CCPA noted below).
The CO ADMT Act provides the most rights, including human review and correction. It also, along with the CCPA ADMT Regulations, the NRB Act and the Delaware Amendment, provides certain information access rights.
| Law | Individual Rights |
| CRC ADS Regulations | None, other than not to be discriminated against through the use of ADS. |
| CCPA ADMT Regulations | No right to opt-out of ADMT if human appeal is offered and, for employment-related use, if the system does not discriminate and works for the intended business purposes. (§7221)
Include robust rights to access information about the ADMT. (§7222) |
| WST Law | None, other than not to be subjected to the prohibited AI uses. |
| NRB Act | No rights to opt-out, correct or appeal.
The right to obtain a meaningful description of the employee’s own data used to make a disciplinary or termination decision is provided (§1522(d)). A decision primarily reliant on ADS requires an adverse decision notice explaining how to request that information. |
| CO ADMT Act | No right to opt-out.
The rights to access, seek human review and correction are available. (§6-1-1705) |
| CART Act | No rights to opt-out, access, seek human review or correction.
The notice rights described above and the right to be free from discrimination are available. |
| Delaware Amendment | A third-party recipient of a report must (a) provide an adverse action notice; (b) provide a description of the personal data relied upon in making the adverse action; (c) identify the source of the report and explain the resident’s rights available through the controller; and (d) provide an opportunity for human review unless not in the best interest of the resident (e.g., delay could risk life or safety). (§12D-106(f)(1).)
A controller that furnishes a report must, upon request from a resident: (a), provide personal data maintained; (b) disclose the sources of personal data used for profiling; (c) and identify third-party recipients of reports. (§ 12D-106(f)(2).) A controller must provide the resident with the opportunity to correct personal data. (§12D-106(f)(3).) |
7. Recordkeeping
Some of the laws have specific record keeping obligations. For those that do not, certain recordkeeping will be necessary to support a showing of compliance and to support a defense against claims of discrimination.
| Law | Recordkeeping |
| CRC ADS Regulations | ADS data and related records, including bias testing, must be maintained for 4 years from the date of the making of the record or the date of the personnel action involved, whichever occurs later. (§11013(c).) |
| CCPA ADMT Regulations | Risk Assessments must be maintained for as long as the processing continues or for 5 years after the completion of the risk assessment, whichever is later. (§7155(c).) Must be reviewed and updated at least every 3 years, or if there is a material change, updated no later than 45 calendar days after. (§7155(a).)
Consumer request records must be maintained for 24 months. (§7101(a)) |
| WST Law | Not required. |
| NRB Act | Not required. |
| CO ADMT Act | Records must be maintained for 3 years after the date of a consequential decision, including notices, decision-making data, consumer requests, human review documentation and technical documentation. (For a developer, §6-1-1702; for a deployer, § 6-1-1703.) |
| CART Act | Not required, but like the CRC ADS Regulations, anti-bias testing records can be used as a defense against discrimination claims. |
| Delaware Amendment | Not required but in order to respond to a resident’s request, a controller should maintain a list of identification of all third parties that obtained a report concerning the resident within the previous 24 months. (§12D-106(f)(1).) |
8. Exceptions and Exclusions
Exceptions and exclusions may apply under these laws:
| Law | Exceptions and Exclusions |
| CRC ADS Regulations | None. |
| CCPA ADMT Regulations | Standard CCPA general exceptions, and specific exceptions regarding pre-use notice and access that would compromise ability to address safety, fraud, malicious or illegal activity, security, integrity, etc. As noted above, there is no right to opt-out of use for employment decisions if the ADMT is free of bias and functions properly. |
| WST Law | Using a workplace surveillance tool to ensure safety (§1581(b)), or to develop aircraft or products or services for national security, military space or defense purposes (§1583). |
| NRB Act | Where waived in a collective bargaining agreement that has protections from algorithmic management (§1526.5) and where required by law of federal contract regarding development of aircraft or products or services for national security, military space or defense purposes. (§1526.6) |
| CO ADMT Act | Creditors that have FCRA or ECOA (Reg B) adverse action notice requirements may combine the ADMT Act notice with that notice. (§6-1-1704(6)(a).)
Certain exclusions for certain federally regulated activities are limited to those activities and do not extend to the company’s HR usage. (FERPA, §§ 6-1-1704(9), 6-1-1705(2))(Insurers, HIPAA, FDA, and GLBA, § 6-1-1708.) |
| CART Act | None. |
| Delaware Amendment | Standard DPDPA exceptions apply, including GLBA and HIPAA regulated entities, higher education institutions, and certain non-profits. (§12D-103) |
9. Enforcement
While these new and amended laws are enforced by the state, the CRC ADS Regulations and the WST Law offer a potential path to a private right of action.
| Law | Enforcement |
| CRC ADS Regulations | Civil Rights Department (CRD). Private actions under the California Fair Employment and Housing Act may cite to non-compliance with CRC ADS Regulations as evidence of discrimination.[JBJ1] [ALF/SPB2] |
| CCPA ADMT Regulations | California Attorney General and CalPrivacy |
| WST Law | California Labor Commissioner and potential private right of action under the California Labor Code’s Private Attorney General Act. |
| NRB Act | California Labor Commissioner and public prosecutors. |
| CO ADMT Act | Colorado Attorney General. |
| CART Act | Connecticut Attorney General. |
| Delaware Amendment | Delaware Attorney General. |
Bringing it all together
- While risk assessments or anti-bias testing may not always be explicitly necessary, they will help establish lack of bias, or at least lack of discriminatory intent, and help ensure that the system works as intended. This should be both a prelaunch and ongoing exercise.
- The CCPA ADMT Regulations, CO ADMT Act and CART Act require pre-use notices, but the level of transparency and disclosures differs. The pre-use notice requirements in the CCPA ADMT Regulations, CO ADMT Act are more detailed than the CART Act. Only the CO ADMT Act, NRB Act, and the Delaware Amendment require adverse action notices.
- The CCPA ADMT Regulations and the CO ADMT Act create the greatest levels of individual rights, but they differ materially. The Delaware Amendment’s extension of rights to HR data subjects is limited to certain furnishers and receivers of data used to make consequential HR decisions.
- When required, record keeping obligations should be met. Further, regardless of any requirements, anti-bias testing, system due diligence and risk assessments and records of ongoing monitoring for non-bias and efficacy may prove helpful in addressing claims and establishing responsible use of AI.
- Exceptions are narrow and circumscribed.
- Even where there is not a private right of action, failure to meet the standards of these regimes could be the basis for traditional discrimination or unfair practice claims, and state authorities seem focused on AI harms especially in the HR context.
Conclusion
The laws discussed above, as well as general employment and civil rights laws, necessitate that technology use is free of bias that could discriminate against a protected class (age, race, religion, disability, etc.). Accordingly, bias and risk assessments are prudent even when not expressly required. The CCPA ADMT Regulation’s assessment requirements are detailed and can serve as a high-water mark. (By contrast, an employer may not wish to apply the much more burdensome bias testing requirements in New York City Local Law 144 beyond when expressly required for New York City employees and applicants.) An employer may wish to consider pre-use transparency as a best practice nationally, but limit adverse action notices, which are more burdensome and potentially disruptive, to when required, i.e., when the CO ADMT Act applies; for disciplinary and termination decisions subject to the NRB Act; and when decisions are based on personal information received from others, as per the Delaware Amendment. Likewise, an employer may want to limit access rights to what is expressly required, given the effort required to comply and that requests are likely seeking pre-claim discovery.
Looking for a deeper dive into the rapidly evolving regulation of AI in the workplace?
Join Alan Friel, Partner (Atlanta/Los Angeles), Michael Kelly, Partner (San Francisco/Palo Alto), and Sammuel Kim, Associate (New York), for the webinar, “ADMT Rules for Employers” on October 13, 2026, from 2:30-4:40 p.m. ET. The program will explore new and emerging requirements governing employers’ use of automated decision-making technology (ADMT), including significant developments in California, Colorado and Connecticut that take effect in 2027. The session will also address broader AI compliance considerations in the human resources context.
For additional details and registration, visit ADMT Rules for Employers. Complimentary passes are available. To reserve yours, please contact Elizabeth Roby.
Appendix 1: Covered Technology
| Law | Covered Technology |
| CRC ADS Regulations | Covered Technology: “Automated-Decision System” means “[a] computational process that makes a decision or facilitates human decision making regarding an employment benefit, as defined in section 11008(i) of these regulations. An Automated-Decision System may be derived from and/or use artificial intelligence, machine-learning, algorithms, statistics, and/or other data processing techniques. An Automated-Decision System performs tasks such as:
Using computer-based assessments or tests, such as questions, puzzles, games, or other challenges to make predictive assessments about an applicant or employee; Measure an applicant’s or employee’s skills, dexterity, reaction time, and/or other abilities or characteristics; Measure an applicant’s or employee’s personality trait, aptitude, attitude, and/or cultural fit; and/or screen, evaluate, categorize, and/or recommend applicants or employees. Directing job advertisements or other recruiting materials to targeted groups; Screening resumes for particular terms or patterns; Analyzing facial expression, word choice, and/or voice in online interviews; or Analyzing employee or applicant data acquired from third parties. “Automated-Decision System” excludes word processing software, spreadsheet software, map navigation systems, web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, database, or similar technologies, provided that these technologies do not make a decision regarding an employment benefit…” |
| CCPA ADMT Regulations | “Automated decision-making technology” means any technology that processes personal information [emphasis added] and uses computation to replace or substantially replace human decision-making.
To “substantially replace human decision making” means a business uses the technology’s output to make a decision without “human involvement”. Human involvement requires a human reviewer to: Know how to interpret and use the technology’s output to make the decision; ADMT includes profiling that replaces or substantially replaces human decision-making but excludes web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, databases, and spreadsheets, provided that they do not replace human decision making. |
| WST Law | “Workplace surveillance tool” means any system, application, instrument, or device that collects or facilitates the collection of employee data, activities, communications, actions, biometrics, or behaviors by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means. |
| NRB Act | “Automated decision system” or “ADS” means any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision making and materially impacts natural persons. An automated decision system does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data. |
| CO ADMT Act | “Covered ADMT” means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual used to materially influence a consequential decision. “Materially influence” means (i) an ADMT output is a non-de minimis factor [a standard for which broad and narrow proposals have been offered for comment in the ongoing rulemaking] that is used in making a “consequential decision”; and (ii) an ADMT output affects the outcome of a consequential decision, including by meaningfully altering how a consequential decision is made. “Consequential decision” means a (i) a decision, determination, or action made about a consumer that relates to the provision of or a consumer’s access to, eligibility for, selection for, or compensation for a “covered domain” (including employment); or (ii) a decision, determination, or action about a consumer that relates to … cost sharing, compensation, or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer’s access, eligibility, or opportunity for a covered domain. |
| CART Act | “Automated Employment-related Decision Technology” (AEDT) is defined as “any technology that processes personal data and uses computation to generate any output, including any prediction, recommendation, classification, ranking, score or other information, that is a “substantial factor”used to make or materially influence [not defined] an employment-related decision.”
“Substantial factor”means a factor, a constraint, ranking, score, recommendation or classification, that meaningfully alters the outcome of an employment-related decision. “Employment-related decision” means a decision, made based on any individual’s personal data, to hire, promote, discipline or discharge such individual, to renew such individual’s employment, to select such individual for any training or apprenticeship or with respect to such individual’s tenure or terms, privileges or conditions of employment |
| Delaware Amendment | The new obligations introduced by the Delaware Amendment are technology agnostic. While the Delaware Amendment captures automated decision-making, its obligations apply when a controller supplies or receives personal data for use in connection with HR decision-making, regardless of whether technology is used. |
For more information, contact the authors.
Stay Ahead on Consumer Privacy News
Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.
Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.