A MoFo Privacy Minute Q&A (5 January 2022)

This is A MoFo Privacy Minute, where we will answer the questions our clients are asking us in sixty seconds or less.

Question: My company has a location in New York City. What are the requirements for employers under New York City’s new law about automated employment decision tools, and what happens if my business fails to meet the requirements?

Answer: The New York City Council passed a bill that prohibits the use of automated employment decision tools to screen candidates for hire or employees for promotion unless employers (including employment agencies) meet certain requirements. The bill was approved on November 10, 2021, and became law on December 10, 2021. The law takes effect on January 1, 2023, and requires the following:

• Bias Audit: An employer cannot use an automated employment decision tool unless: (1) the tool undergoes a bias audit before it is used; and (2) a summary of the results of the bias audit are made public on the employer’s website before the tool is used. A bias audit is an impartial evaluation by an independent auditor as to the tool’s disparate impact on protected classes of individuals. The bias audit must be conducted within one year before the employer’s use of the tool.
• Notice to Employee/Candidate: An employer using an automated employment decision tool to screen employment candidates must notify candidates who reside in New York City of (1) the use of the tool in connection with the assessment of the candidate; (2) the qualifications and characteristics considered by the tool to make such assessment; and (3) the type of data collected for the tool, the source of the data, and the employer’s policy on how long the data is kept.

Employers must notify candidates who reside in New York City of the use of an automated employment decision tool and the qualifications and characteristics considered by the tool at least 10 days before the tool is used. Resident candidates must have an opportunity to request an alternative selection process or accommodation. The rest of the required notices must be made to a resident candidate within 30 days of a written request unless it is already disclosed on the employer’s website.

Under the law, employers face the difficult task of distinguishing between New York City resident and non-resident candidates for the purposes of providing notice to them. To mitigate risk and reduce administrative burden, some businesses may consider providing the required notices to every employee or candidate who is, or will be, subject to assessment by such tools, regardless of where they reside.

A failure to comply with the law may result in a civil penalty up to $500 for the first violation and each additional violation on the same day, and a $500-$1,500 fine for each subsequent violation. Please note that each day of non-compliance with the law, and each specific notice requirement not made to a particular candidate, counts as a separate violation.

This NYC legislation follows a trend in the regulation of automated decisions about individuals that impact their lives in important ways, such as employment. This regulatory trend began in Europe, was adopted in other countries that have followed Europe’s general framework, and has more recently been followed by some U.S. state privacy laws such as those in California, Virginia and Colorado.

Visit our A MoFo Privacy Minute Series page to view our collection of Q&As. Explore our Privacy + Data Security page for additional information from our Privacy Library and Resource Centers on Cybersecurity, State Privacy Laws, and the GDPR + European Privacy.