This is A MoFo Privacy Minute, where we will answer the questions our clients are asking us in sixty seconds or less.
Question: My company has a location in New York City. What are the requirements for employers under New York City’s new law about automated employment decision tools, and what happens if my business fails to meet the requirements?
Answer: The New York City Council passed a bill that prohibits the use of automated employment decision tools to screen candidates for hire or employees for promotion unless employers (including employment agencies) meet certain requirements. The bill was approved on November 10, 2021, and became law on December 10, 2021. The law takes effect on January 1, 2023, and requires the following:
Employers must notify candidates who reside in New York City of the use of an automated employment decision tool and the qualifications and characteristics considered by the tool at least 10 days before the tool is used. Resident candidates must have an opportunity to request an alternative selection process or accommodation. The rest of the required notices must be made to a resident candidate within 30 days of a written request unless it is already disclosed on the employer’s website.
Under the law, employers face the difficult task of distinguishing between New York City resident and non-resident candidates for the purposes of providing notice to them. To mitigate risk and reduce administrative burden, some businesses may consider providing the required notices to every employee or candidate who is, or will be, subject to assessment by such tools, regardless of where they reside.
A failure to comply with the law may result in a civil penalty up to $500 for the first violation and each additional violation on the same day, and a $500-$1,500 fine for each subsequent violation. Please note that each day of non-compliance with the law, and each specific notice requirement not made to a particular candidate, counts as a separate violation.
This NYC legislation follows a trend in the regulation of automated decisions about individuals that impact their lives in important ways, such as employment. This regulatory trend began in Europe, was adopted in other countries that have followed Europe’s general framework, and has more recently been followed by some U.S. state privacy laws such as those in California, Virginia and Colorado.
Visit our A MoFo Privacy Minute Series page to view our collection of Q&As. Explore our Privacy + Data Security page for additional information from our Privacy Library and Resource Centers on Cybersecurity, State Privacy Laws, and the GDPR + European Privacy.