- Virginia and Colorado have passed similar privacy laws around data automation, and they both include exemptions for employee/employer data
- There are other laws and regulations that may emerge to cover these exclusions
- There is ambiguity in how these laws exclude employees, and there may be instances where bias from automated employment tools may still be covered
Laws in place – and what they cover
Virginia and Colorado both passed laws that would regulate automated tools leveraging algorithms, and they both go into effect in 2023. While New York City was the first to act with its NYC Local Law 144, targeting bias in the employment process, the Virginia and Colorado laws differ. They are more focused on consumer privacy rights as they pertain to automated data tools, specifically regarding privacy.
As a result, those laws have excluded employment. For the Virginia Consumer Data Protection Act (VCDPA), the law defines consumers as “acting only in an individual or household context”, and specifies that consumers are not those acting in a “commercial or employment context.” The Colorado Privacy Act (CPA) takes a similar stance, excluding those “acting in the commercial or employment context, including job applicants”.
What does this mean for employees concerned about employment bias in these states?
These exclusions in the Virginia and Colorado laws will not shield employers from exposure to bias in their automated employment tools. The Equal Employment Opportunity Commission is poised to release the Strategic Enforcement Plan (SEP), which in its current draft form counts among its top priorities “Eliminating Barriers in Recruitment and Hiring”, specifically those that arise from “the use of automated systems”.
In addition, these exclusions may not necessarily eliminate all employment-related exposure. The VCDPA contains some ambiguity, mentioning “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” However, under that law, according to The National Law Review, “the phrase ‘decisions that produce legal or similarly significant effects’ encompasses a decision made by the controller that ‘results in the provision or denial by the controller of … employment opportunities.’”
The Colorado Privacy Act is still drafting final rules, with a hearing scheduled for February 1st, 2023. However, the latest draft includes language similar to the VCDPA, where there is mention of employment data and employment right considerations listed in the text of the rules.
How do I prepare?
Keep posted for all the latest developments by signing up for our newsletter. You can also contact us directly for more guidance at ken@proceptual.com