Episode 223 - How Privacy Agency’s Proposed AI Regulations Would Affect California Businesses

Welcome to the Workplace, a podcast by Cal Chamber. I'm Matthew Roberts, associate General Counsel with the California Chamber of Commerce. Hello, listeners. We're back today with a subject that we have been periodically discussing on this platform involving technology that variably is known as automated decision systems. Automated decision making technology, or sometimes just placed in a broad bucket of quote, unquote, artificial intelligence. Recently, the California Civil Rights Council, which approves regulations enforcing California's workplace discrimination laws, approved regulations confirming to all of us that the use of automated decision systems for work practices such as hiring or performance metrics can violate the law if it's used in a discriminatory manner. Doesn't really change the law, just confirms that if you use these tools for that purpose, you may violate California's Fair Employment and Housing Act. These new regulations will likely take effect later this year, probably either July 1 or October 1 of 2025. Now, in addition to those regulations, there are others moving through a different rulemaking process with the California Privacy Protection Agency, or cppa, which has issued draft regulations concerning business use of automated decision making technology under the California Consumer Privacy act, or ccpa. These regulations may potentially provide additional procedures for businesses if they are approved, and they are the subject matter of today's episode. To discuss this set of proposed regulations, we welcome two wonderful guests today. First, we are joined by Lindsey Tonsiger, a partner with international law firm Covington and Burling, who co chairs the firm's global data privacy and cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the the United States Congress, the California Privacy Protection Agency, again, the cppa, and state attorneys generals on proposed changes to data protection laws and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices. Lindsay also assists clients with launching new products and services in this complex and evolving legal landscape. And it is a real pleasure to welcome you to the show today, Lindsey.

Thanks so much for having me.

All right, and next we are joined by Jane Ponder, an associate attorney, also with Covington and Burling. Similar to Lindsey, Jane's practice focuses on helping clients launch and improve products and services that involve laws governing data privacy, artificial intelligence, sensitive data and biometrics, marketing and online advertising, connected devices and social media, including a focus on the ccpa, along with representing clients in related enforcement actions brought by the Federal Trade Commission and state attorneys general. Jane, I am very happy to have you here today.

Great to be here.

All right, Jane, so we're going to jump into it because we have a bunch of Things to talk about. I've used this Alphabet soup of acronyms already, the CPPA and the ccpa. And so really I kind of just want to do some basics here first. Really, what is the cppa? What's its purpose?

The CPPA is a regulatory agency responsible for, among other things, drafting rules to help enforce and interpret the ccpa to provide some additional color on how the agency is thinking about AI in the employment context. For today's conversation, the cppa, an unelected body, has initiated a rulemaking process where it has proposed regulations that would apply to employers in the state. Topics in that ongoing rulemaking process include monitoring of public areas and workers, as well as the use of ADMT for a broad range of employment related decisions.

Excellent. Now, we had a lot of questions when the California Consumer Privacy act or the CCPA was passed and subsequent laws amending that in terms of who's covered by it or really who does the law apply to? So, Jane, can you kind of spell out for us really, which businesses are we looking at who need to comply? Just with this statutory scheme that we.

Have, the CCPA applies to private for profit companies that collect personal information and meet certain thresholds for process. They have to meet certain revenue thresholds and process a certain amount of data each year. And Lindsey, do you want to talk a little bit about how the law applies to employers in the state?

Yeah. So there was a temporary exemption for employment related data that actually ended in 2023. So as we sit here today, the statute actually does cover people acting in their role as either an employee or applicant, as well as individual consumers.

So then, Lindsey, just to confirm on that, because this was always a question since it uses the word consumer in there when we say consumer, that is really including our employees here in California if you're covered by the ccpa, as Jane described.

Exactly. Right. Employees and applicants.

All right, Jane, we have those Civil Rights Council regulations that I mentioned there at the top. So what is the CPPA trying to do with their own version of these regulations as they relate to automated decision making technology?

The statute directs the CPPA to create regulations on opt out and access rights in the context of admt. The scope of ADMT in the current draft of the regulations is extremely broad. Specifically, the draft regulations define covered ADMT to encompass not only those technologies that make a decision or replace human decision making, but also technologies that substantially facilitate human decision making in practice. And depending on how technologies are used, this definition could capture uses of technology for things like facial recognition and resume scanning by employers. But Also benign uses of technology. In fact, there's been some pushback to the draft regulations that technologies like an Excel spreadsheet or a calculator could be classified as AD&T. And this creates a lot of uncertainty for employers in California businesses as to where the line should be drawn. Lindsey, what do you think about the real world implications for this broad ADMT definition?

So you start with this really broad definition that Jane just described, and as a result, the substantive requirements end up applying to a broad range of technologies that are commonly used in the employment context. The requirements boil down to enabling an employee or applicant to opt out of having certain technologies used to process their personal information rights to get more information about how these technologies are used to process their personal data, and a pretty burdensome paperwork exercise where a company has to document lots of information about how the technologies work and how they're used.

Okay, so Lindsey, a key part of these regulations, of course, is actually when a CCPA covered business would be covered in their use of admt, because something that I noticed in the regulations as I was looking at is they're looking for specific types of usage of this kind of technology to really be covered under these rules. So what are the kinds of uses of ADMT that would be covered under these proposed regulations?

That's a really important point. We're not talking about all applications of admt. We'll start with significant decisions. The agency tees up a wide range of employment related activities that are considered meeting that significant decision threshold. So this includes use of these technologies that substantially facilitate decisions on hiring, on promotion, demotion, firing, and importantly, allocation of work or assignments or bonus compensation and a lot of other benefits. So if a business uses ADMT to make or facilitate those types of substantial decisions, it'd be subject to the rules.

Okay, so Jane Lindsey there described the significant decision making process, and when businesses use ADMT for those kinds of decisions. Are there other applications of the use of ADMT that would be covered by these proposed regulations?

There are. The use of ADMT for what the agency calls extensive profiling would also trigger the rules. The agency defines extensive profiling to include profiling individuals in a public place, such as the operation of the floor of a retail store, as an example. It would also encompass first party advertising activities and of particular relevance to employers, profiling a consumer through systematic observation when they act in their capacity as a job applicant, an employee, or an independent contractor. In addition, if employee personal information is used to train ADMT for the significant decisions that Lindsay was mentioning earlier, this would also Trigger the rules.

Great. So Lindsey, you had mentioned just previously about some of the things that businesses may have to do if they do use ADMT for those purposes. The opt out request of access to information and receive that information. But can you go into greater detail about all of the things that they would have to do? I did notice, and something that's really important for California employers all the time is what kind of notices do I have to do and what kind of other paperwork do I have to do? Those nitty gritty practical details. So Lindsey, if you can go into a little bit more detail for me about what businesses would have to do if they were covered. Yeah.

So first, a business would be required to present to that consumer a pre use notice. And that's before they begin using any ADMT technology. That pre use notice requires a lot of really prescriptive information, including information about the underlying technology, technical information about how it works, how the business intends to use the outputs, and the employer applicant's rights with respect to its use. And I think one open question is whether or not that really technical information is actually meaningful or understandable to the average employee or applicant and what purpose it's serving. Second, businesses would also need to provide a mechanism for employees or applicants to opt out of the regulated use of admt, so it couldn't even be used to substantially facilitate a human decision. You need to have a human even more actively in the loop making those decisions directly. And then finally, in response to consumer requests to access their personal information, the business would need to respond to those requests and provide explanations about how the technology reached a decision, including any assumptions that it made or limitations, the parameters of the technology, the range of outputs that it could have produced. So again, a lot of really technical information that might or might not be meaningful to the average consumer. There are also heightened obligations when these technologies are used for identity verification, which could have some important implications, particularly in the gig economy when companies need to figure out if the people who are doing the work and who are getting paid are actually who they say they are.

Excellent. Now, the opt out thing is really interesting for me, especially since we have gone through this period where employees are consumers under the law and they have all the same rights that any consumer would, including requests to access personal information, request to delete their personal information, things that cause problems for employers. But what I am aware of is that there are some proposed opt out exceptions, Jane, if certain criteria are met. So, Jane, could you walk us through what exceptions might exist for employers to avoid the opt out requirement?

So as an initial point, some important exceptions for employers in California businesses are in the statute itself. These include exemptions to exercise and defend legal claims, compliance with law, and protecting the rights of others. These broad exemptions are commonly used to protect against fraud and protect the safety of customers and employees. Separately, the draft regulations create some narrow exemptions specific to the ADMT opt out. Right. As you mentioned, some of these narrow exemptions specifically cover security, fraud prevention and safety. But this creates some ambiguity as to how the broad statutory exemptions interact with the ADMT specific exemptions.

Wonderful. Now, Lindsey, we've talked about some of the problems you've alluded to already throughout the course of this discussion, but I kind of want to put this now all into a nice big bow. As you know, this puts a lot on the plates of employers. So what are the business community's major concerns with the current state of the regulations?

One comes back to what you teed up at the beginning. Other California agencies like the Civil Rights Council are looking at these issues. They're enacting regulations. This creates the risk of conflicting rules or conflicting interpretations about how these various laws should apply in the workplace under these different regulatory regimes. Relatedly, the California legislature, of course, has been really active in this space and is looking at what's the rational, reasonable AI regulation that the state should think about that doesn't jeopardize innovation and us now the world's fourth largest economy, and we've risen from fifth to fourth. So there's tremendous risk that we kind of get ahead of ourselves too much and cut off that innovation and economic opportunity.

To piggyback on those reflections and amplify those a bit, the proposed regulations also create inconsistencies not only within the state of California, but also with other states. For example, a business using ADMT with human involvement could be subject to rules in California, but not in Colorado as an example for the exact same use of the technology. Additionally, there are some concerns that the draft regulations are unconstitutionally vague as drafted and infringe on constitutionally protected speech of California businesses.

Great. So it's good then that what we've been talking about this whole time are just proposals. At this point, nothing has been enacted because there does sound to be some room for improvement, especially from the business community's perspective. So, Lindsey, I'll start with you. Really. What are the next steps that the business community are looking for in terms of where this rulemaking process is going? When might we see these actually take effect in the future?

Yeah. At the last board meeting, the agency indicated that they'd like to get it wrapped up by this November. But every time they change the rules, they change that proposal. They need to provide the public more time to comment. And depending on how substantial those changes are, that comment period can be as short as 15 days or longer, like 45 days. Coming out of the last board meeting, the next step appears to be that staff will revise the draft proposals to include some feedback they got from the board members, and then the board would decide whether or not to move those updated rules forward for public comment or not.

But importantly, if the draft regulations are finalized this year, that doesn't mean that California businesses or employers need to come into compliance immediately. Specifically, the latest draft of the regulations proposed that entities subject to the CCPA would need to be in compliance with the AD&T requirements by January 1, 2027.

All right, wonderful. So we do have some time, but I do know businesses are starting to increase their usage of this kind of technology and it's good just to be aware of what's out there and be prepared in the event that these do finally get finalized. So then I will conclude, Jane, with a talk about the California legislative session, which of course is right next door to us here at California Chamber. And we know we have a lot of ongoing bills and ideas that they do every year. So we've talked about the regulatory agencies and we know that they made efforts to regulate artificial intelligence technologies last year. Are there any bills that may impact these regs or the Civil Rights Council regs that we've been talking about that may add to what Lindsey's concern was, which was just the confusion around, you know, an inconsistency around the rules.

Yeah. The legislature is extremely active in considering AI and ADMT legislation, just to name a few examples in this session, AB1008 and SB7 focus on automated decision making in the workplace. Other bills could apply to employers use of AI and ADMT as well, such as SB420, which imposes risk assessment like and notice requirements for high risk AI systems, which include the use of technologies for employment related disabilities decision making. In effect, this could, as we've talked about throughout this podcast, lead to overlapping and possibly inconsistent requirements for employers, particularly around topics like notice and risk assessments and consumer rights.

It's such a good point. I think that's why I think industry's encouraging the agency to proceed with caution in this space and make sure they don't get ahead of the legislature or the governor on this really important topic for California businesses.

Great. And you know, because of those reasons. Cal Chamber has identified these bills as cost drivers, ones that will increase costs under what we've termed as our 2025 affordability agenda as well this year. So there's some serious concerns about all of the actions that are taking place in this space. Well, Lindsay and Jane, thank you both so much for taking some time out of your very busy schedules to share your knowledge and expertise on these emerging technology issues for employers anytime.

Happy to be here. Thanks for having us, and thank you.

Listeners for joining this discussion on the workplace. Please share and subscribe to Cal Chambers podcast by visiting calchamber.com.