The California Privacy Protection Agency (CPPA) has released proposed draft automated decisionmaking technology (ADMT)[i] regulations defining protections related to businesses’ use of these AI-related technologies.

The proposed draft regulations would implement consumers’ rights to opt out of, and access information about, a business’s uses of ADMT, as provided for by the California Consumer Privacy Act (CCPA). The definition of ‘consumers’ under the CCPA includes employees and job applicants.

The use of ADMT decisionmaking technologies and artificial intelligence tools has continued to accelerate in the human resources space, especially in the areas of recruiting and onboarding.

The draft regulations outline how these new privacy protections could be implemented. Specifically, the draft regulations propose requirements for businesses using ADMT in any of the following ways:

• For decisions that tend to have the most significant impacts on consumers’ lives. (e.g., decisions about their employment or compensation).
• Profiling an employee or applicant. (e.g., using a keystroke logger to analyze performance and/or tracking location).

The draft also proposes potential options for additional consumer protections around the use of their personal information to train these technologies.

Suggested protections for the use of ADMT would include:

• The requirement to provide “Pre-use Notices” to inform consumers about how the business intends to use ADMT, so that the consumer can decide whether to opt-out or to proceed, and whether to access more information.
• The ability to opt-out of the business’s use of ADMT (except in certain cases, such as to protect life and safety).
• The ability to access more information about how the business used ADMT to make a decision about the consumer.

These regulations are proposed in draft format only and have not yet gone through the CPPA’s formal rulemaking processes. However, given the support the CPPA is receiving in its efforts to maintain California’s status as a leader in privacy-protective innovation, employers are well advised to consider how such regulations may impact current practices when it comes to ADMT and AI technologies.

Feedback on the proposed draft regulations will be provided at the CPPA’s December 8, 2023 board meeting. Formal rulemaking is not anticipated to begin until next year.

[i] ADMT refers to any system, software, or process—including one derived from machine-learning, statistics, or other data-processing or artificial intelligence—that processes personal information and uses computation as whole or part of a system to make or execute a decision or facilitate human decisionmaking. ADMT includes profiling.