California's Proposed Protections on Automated Decision-Making Technology

In November 2023, the California Privacy Protection Agency (CPPA) made a public announcement proposing new regulations when using automated decision-making technology (ADMT) during hiring and employment. Following this, on November 8, 2024, the CPPA voted 4-1 to proceed with formal rulemaking regarding ADMT. This is one of the first protection policies of its kind drafted, marking another building block to regulate the use of automated decision-making in employment safely. The proposed guidelines intend to protect consumer rights, avoid bias without human intervention, and ensure fairness when using technology to assist employment decisions.

The Federal Consumer Financial Protection Bureau (CFPB) released a related announcement in October 2024 following the CPPA's announcement, clarifying guidelines on compliance with the Fair Credit Reporting Act (FCRA) when using automated decision-making technology throughout the hiring and employment process. In this article, we will take a look at some of the draft guidelines proposed for California's privacy protections on ADMT and how they relate to Circular 2024-06.

What is Circular 2024-06?

On October 24, 2024, the CFPB issued a policy statement advising employers to obtain employee consent when using background dossiers or other algorithmic scores to make employment decisions. The CFPB circular clarified that any background or third-party report should be considered a "consumer report" when used for hiring, promotion, reassignment, retention, or other employment purposes and are all, therefore, subject to rules that fall under the FCRA. These reports include but are not necessarily exclusive to:

• Biometric information
• Interactions with customers
• Number and quality of meetings attended
• Web browsing history
• Keystroke frequency

To read the full details of the Consumer Financial Protection 2024-06 Circular, take a closer look here.

An overview of California's proposed privacy protections on ADMT

Below are some of the highlights in the CPPA proposed rules on handling ADMT regarding employment decisions as of January 2025.

• Pre-Use Notice: Employers using ADMT for significant employment decisions must inform "consumers" (employees, independent contractors, and job applicants) about the use of ADMT. Consumers also reserve the right to opt-out and access ADMT before any personal information is processed.
• Bias Review: Employers using physical or biological identification or profiling for significant employment decisions must conduct a bias review to ensure the software does not discriminate based on protected classes.
• Opt-Out: Employers must allow consumers to opt out of ADMT use and request a qualified human review of significant employment decisions. Employers have the right to deny opt-out requests for hiring, work allocation, and compensation decisions if the ADMT has "accuracy and nondiscrimination safeguards," meaning the employer has actively evaluated and implemented policies, procedures, and training to ensure the ADMT works as intended and does not discriminate based on protected classes.
• Cybersecurity Audits: Employers using ADMT for significant employment decisions must complete an annual cybersecurity audit to ensure current data protection measures and address any gaps or weaknesses in the business's cybersecurity program. Businesses are required to use a qualified, objective, independent auditor, either internal or external.
• Annual Risk Assessment: Employers must complete a yearly risk assessment before processing personal information to determine if the risks to consumers' privacy outweigh the benefits to the consumer, business, stakeholders, and the public. Employers are required to submit the annual risk assessment to the CPPA.

No final decisions on the law have yet been made as of January 2025. The CPPA opened a public comment period for the draft on November 22, 2024, and was extended to February 19th on January 16, 2025. To learn more about the CPPA's proposed regulations on automated decision-making technology, take a closer look at the original draft released on November 27, 2023, or the CPPA's fact sheet on the draft.

Potentially the spark to the latest trend in data regulations

Closing out public commentary on the proposed regulations may mean that a final ruling for the California Privacy Protection Agency's proposed guidelines will soon be issued. Combined with the October 2024 circular from the Consumer Financial Protective Bureau clarifying guidelines when using background dossiers or other algorithmic scores to make employment decisions, other state-level regulations inspired by these announcements pop up in 2025. Employers that run employment operations or hire in the state of California should remain aware of the final ruling of the CPPA's decision on this issue. Employers should consult their legal counsel to navigate new regulations for decision-making technology and ensure their practices align with the new requirements.

This article is for informational purposes only and does not constitute legal advice or official predictions of future laws and regulations. Hiring professionals, HR professionals, and administrators should consult their legal counsel to ensure all actions comply with the law.