Data Processing in the Employment Context
Jump to
Data Processing in the Employment Context Start Comparison
Is an identified legal basis required in order to collect or process personal data or sensitive personal data in the employment context?

Last review date: 31 December 2024

No. In the US, collecting personal data about employees is generally seen as a legitimate activity, provided that it is carried out for non-discriminatory and legitimate business purposes. General restrictions to personal information processing under the CCPA apply in the employment context.

Can consent be validly obtained in the employment context?

Last review date: 31 December 2024

Yes.

☒  Yes, same as for data subjects outside the employment context.

Has the data privacy regulator issued guidance on use of artificial intelligence, automated decision making or profiling in an employment context – for example, relating to use in employee monitoring or hiring?

Yes

Yes, the FTC and EEOC have issued guidance on the use of artificial intelligence (AI). The California Privacy Protection Agency has commenced formal rulemaking to impose transparency, opt-out, privacy impact assessment and other requirements on the use of AI and automated decision-making tools in certain circumstances. Read our most recent update here.

In an employment context, certain local laws impose restrictions on the use of AI and automated decision-making. For example, New York City's Department of Consumer and Worker Protection (DCWP) adopted new rules regarding automated employment decision tools (AEDT), which took effect on 5 July 2023. Local Law 144 of 2021 prohibits employers and employment agencies from using AEDT tools unless the tool has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates. Read our alert here.

In August 2024, Illinois passed a law amending the Illinois Human Rights Act under which employers are subject to civil rights claims if they use AI tools in hiring and other employment decisions and cause discrimination. Employers will be required to notify employees whenever they use AI tools with respect to the "recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment." The amended law applies to discrimination based on the list of protected classes under Illinois law, as well as using "zip codes as a proxy for protected classes." The changes in law are set to take effect on 1 January 2026.