Regulon — MA-SB-35 · MA SB 35 (AI Employment Monitoring & Automated Decisions)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement and rulemaking authority. The Department of Labor Standards enforces the electronic monitoring and automated decision tool provisions. Private right of action available to individuals subjected to adverse employment actions based on conduct prohibited by this chapter. Actions may be brought against the employer and responsible officers in their individual capacity.

Private Right of Action

Private right of action available to individuals subjected to adverse employment actions based on conduct prohibited by this chapter.

Penalties

Restitution and consequential damages, plus liquidated damages constituting double the amount of restitution. Pre- and post-judgment interest. Reasonable attorneys' fees and costs. Punitive damages available where appropriate. Nothing in the section limits other remedies at law or in equity.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Ch. 149B, § 1

Definitions

(a) As used in this chapter, the following words shall have the following meanings unless the context clearly requires otherwise: "Authorized representative", any person or organization appointed by the worker to serve as a representative of the worker including, but not limited to, a labor organization as defined by section 1 of chapter 150E section 1 of chapter 150A of the General Laws, 29 U.S.C. § 152(5) and 5 USC § 7103(a)(4), and 45 U.S. 151. Authorized representative shall not include a worker's employer. "De-identified employee data", employee data that an employer has sought from their own electronic systems, from a vendor, or from a third-party source, aggregated, combined, or collected together, in a summary or other form so that the employee data cannot be identified as belonging to any specific employee. "Automated Decision System (ADS)," any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods that issues an output, including a score, classification, ranking, or recommendation, that is used to assist or replace human decision making on decisions that impact natural persons. "Automated decision tool" does not include a tool that does not assist or replace employment decision processes and that does not materially impact natural persons, including, but not limited to, a junk email filter, firewall, antivirus software, calculator, spreadsheet, database, data set, or other compilation of data. "Automated Decision System (ADS) output", any information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by an ADS. "Candidate", any natural person or their authorized representative seeking employment through an application, or who is screened or evaluated for recruitment, for a position of employment by a business operating in the commonwealth. "Continuous incremental time-tracking tool", any system, application or instrument that continuously measures, records and/or tallies increments of time within a day during which an employee is or is not doing a particular activity or set of activities. "Department", the department of labor standards. "Egregious misconduct", intentional or grossly negligent conduct that endangers the safety or well-being of the individual, co-workers, customers, or other persons, or that causes serious damage to the employer's or customers' property or business interests, including discrimination against or harassment of co-workers, customers, or other persons or violations of the law. "Electronic monitoring tool", any system, application, or instrument that facilitates the collection of data concerning worker activities or communications by any means other than direct observation by a natural person, including but not limited to the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic, or photo-optical system, or obtaining employee data from a third-party. "Employee Information", (also referred to as "information" or "employee data" or "data"), means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular employee, regardless of how the information is collected, inferred, or obtained. "Employee", shall have the same meaning as in section 148B of Chapter 149 of the General Laws. "Employer", any person who directly or indirectly, or through an agent or any other person, employs, exercises, or reserves control, individually or jointly, over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker, including the commonwealth, county, town, city, school district, public authority or other governmental subdivision of any kind. "Employer" includes any of the employer's agents, contractors, or subcontractors. "Employment-related decision", any decision made by the employer that affects wages, benefits, other compensation, hours, schedule, performance evaluation, hiring, recruitment, discipline, promotion, termination, duties, assignment of work, access to work opportunities, productivity requirements, workplace health and safety, or other terms or conditions of employment. "Essential job functions", the fundamental duties of a position based upon work duties actually performed over the duration of employment, as revealed by objective evidence. "Impact assessment", an impartial evaluation by an independent auditor that complies with sections two and three of this chapter. "Independent auditor", a person or entity that conducts an impact assessment of an automated employment decision tool in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment. "Meaningful human oversight", a process that includes, at a minimum: (a) the designation of at least one internal reviewer with sufficient expertise; (b) that sufficient authority and discretion be granted to the designated internal reviewer; and (c) that the designated internal reviewer has the time and resources available to review and evaluate the tool output. "Periodic assessment of worker performance", assessing worker performance over the course of units of time equal to or greater than one calendar day. "Vendor", any person or entity who sells, distributes, or develops for sale an automated employment decision tool to be used in an employment decision made by an employer in the commonwealth.

Section 1 establishes the definitional framework for the entire chapter. Key defined terms include Automated Decision System (ADS), Electronic monitoring tool, Employer (which includes government entities), Vendor, Employee Information (broadly defined to include biometric, health, workplace activity, and device usage data), and Meaningful human oversight (a three-part process requiring designated reviewers with expertise, authority to override, and sufficient time/resources). The Independent auditor definition imposes a five-year cooling-off period for conflicts of interest.

Ch. 149B, § 2

Electronic monitoring tools

Deployer

(a)(i)–(iv) 1 It shall be unlawful for an employer to use an electronic monitoring tool to collect employee information unless: (i) the electronic monitoring tool is primarily used to accomplish any of the following purposes: (A) allowing a worker to accomplish or facilitating the accomplishment of an essential job function; (B) ensuring the quality of goods and services; (C) conducting periodic assessment of worker performance; (D) ensuring or facilitating compliance with employment, labor, or other relevant laws; (E) protecting the health, safety, or security of workers, or the security of the employer's facilities or computer networks; or (F) administering wages and benefits. The department of labor standards may establish additional exceptions under clause (i) through notice and comment rulemaking in compliance with chapter 30A. (ii) the specific type and activated capabilities of an electronic monitoring tool must be narrowly tailored to accomplish the employer's intended, legitimate purpose specified under (i). (iii) the electronic monitoring tool may only be used to accomplish the employer's intended, legitimate purpose specified in (i), and must be customized and implemented in a manner ensuring that the execution of its duties undertaken in the manner least invasive to employees of the employer while accomplishing the employer's legitimate purposes as defined by (i); (iv) the specific form of electronic monitoring is limited to the smallest number of workers, collects the least amount of data and is collected no more frequently than is necessary to accomplish the purpose, and the data collected is deleted once the purpose has been achieved.

(a)(v)–(vii) 1 the employer must ensure that any employee data that is collected utilizing an electronic monitoring tool that is not necessary to accomplish the employer's intended, legitimate purpose is not disclosed to the employer and is promptly disposed of by the vendor; (vi) the employer must ensure that employee data is not collected when the employee is off-duty; and (vii) the employer must ensure that any employee data collected utilizing an electronic monitoring tool that is necessary to accomplish the employer's intended, legitimate purpose, is stored consistent with the commonwealth's data- and cyber- privacy laws, promptly disposed of as soon as the data is no longer needed, and is not utilized by the employer, the vendor or any other third party for any reason except as provided in section 2(c) and section 3(c) of this chapter.

(b) 2 Any employer that uses an electronic monitoring tool shall give prior written notice and must obtain written consent from all candidates and employees subject to electronic monitoring and must also post said notice in a conspicuous place which is readily available for viewing by candidates and employees, pursuant to sections 19B, 52C, and 190(i) of chapter 149 and section 99 of chapter 272. Such notice shall include, at a minimum, the following: (i) a description of the purpose for which the electronic monitoring tool will be used, as specified in subparagraph (i) of paragraph (a) of this subdivision; (ii) a description of the specific employee data to be collected, stored, secured, and disposed of (and the schedule therefore), and the activities, locations, communications, and job roles that will be electronically monitored by the tool; (iii) a description of the dates, times, and frequency that electronic monitoring will occur; (iv) whether and how any employee data collected by the electronic monitoring tool will be used as an input in an automated employment decision tool; (v) whether and how any employee data collected by the electronic monitoring tool will alone or in conjunction with an automated employment decision tool be used to make an employment decision by the employer or employment agency; (vi) whether and how any employee data collected by the electronic monitoring tool may be stored and utilized in discipline, in internal policy compliance, in administrative agency adjudications, and in litigation (whether or not it involves the employee as a party); (vii) whether any employee data collected by the electronic monitoring tool will be used to assess employees' productivity performance or to set productivity standards, and if so, how; (viii) a description of where any employee data collected by the electronic monitoring tool will be stored and the length of time it will be retained; (ix) an explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the monitoring purpose; (x) a statement that an employee is entitled to notice and maintains the right to refuse the sale, transfer, or disclosure of the employee's employee data subject to the provisions of section 2(f); and (xi) a clear and reasonably understandable description of how an employee can exercise the rights described in this chapter.

(c) 3 An employer shall establish, maintain, and preserve for three years contemporaneous, true, and accurate records of data collected via an electronic monitoring tool to ensure compliance with employee or commissioner requests for data. The employer shall destroy any employee information collected via an electronic monitoring tool no later than thirty-seven months after collection unless the employee has provided written and informed consent to the retention of their data by the employer. An employer shall establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of employee data appropriate to the volume and nature of the employee data at issue. An employee shall have the right to request corrections to erroneous employee data.

(d)(i)–(ix) 4 Notwithstanding the allowable purposes for electronic monitoring described in paragraph (a) of subdivision one of this section, an employer shall not: (i) use an electronic monitoring tool in such a manner that results in a violation of labor, employment, civil rights law or any other law of the commonwealth; (ii) use an electronic monitoring tool or data collected via an electronic monitoring tool in such a manner as to threaten the health, welfare, safety, or legal rights of employees or the general public; (iii) use an electronic monitoring tool to monitor employees who are off-duty and not performing work-related tasks; (iv) use an electronic monitoring tool in order to obtain information about an employee's health, including health status and health conditions, the race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran or membership in any group protected from employment discrimination under chapter 151B or any other applicable law; (v) use an electronic monitoring tool in order to identify, punish, or obtain information about employees engaging in activity protected under labor or employment law; (vi) conduct audio or visual monitoring of bathrooms or other similarly private areas, including locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, areas designated to express breast milk, or areas designated for prayer or other religious activity, including data collection on the frequency of use of those private areas; (vii) conduct audio or visual monitoring of a workplace in an employee's residence, an employee's personal vehicle, or property owned or leased by an employee; (viii) use an electronic monitoring tool that incorporates facial recognition, unless such technology is necessary to protect the security of workers or the security of the employer's facilities; (ix) use an electronic monitoring tool that incorporates gait, voice analysis, or emotion recognition technology;

(d)(x)–(xii) 4 take adverse action against an employee based in whole or in part on their opposition or refusal to submit to a practice that the employee believes in good faith violates this article; (xi) take adverse employment action against an employee on the basis of data collected via continuous incremental time-tracking tools except in the case of egregious misconduct; or (xii) take adverse employment action against an employee based on any data collected via electronic monitoring if such data measures an employee's performance in relation to a performance standard that has not been previously, clearly, and unmistakably disclosed to such employee as well as to all other classes of employees to whom it applies in violation of subparagraph (vi) of paragraph (b) of subdivision one of this section, or if such data was collected without proper notice to employees or candidates pursuant to sections 19B, 52C, and 190(i) of chapter 149 and section 99 of chapter 272.

(e) 6 An employer shall not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided pursuant to paragraph (c) of subdivision one of this section.

(f) 7 An employer shall not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless it is required to do so under federal law or the laws of the commonwealth, or necessary to do so to comply with an impact assessment of an automated employment decision tool pursuant to section one thousand twelve of this article.

(g) 5 An employer shall not require employees to: (i) physically implant devices that collect or transmit data, including devices that are installed subcutaneously or incorporated into items of clothing or personal accessories; (ii) install applications on personal devices that collect or transmit employee data or to wear or embed those devices; or (iii) carry or use any device with location tracking applications or services enabled unless the location tracking is: (A) conducted during work hours only; and (B) strictly necessary to accomplish essential job functions and narrowly limited to only the activities and times necessary to accomplish essential job functions.

(h) 8 An employer shall not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, disciplinary decisions up to and including termination, or compensation decisions. For an employer to satisfy the requirements of this paragraph: (i) An employer shall establish meaningful human oversight of such decisions based in whole or in part on data collected through electronic monitoring. (ii) A human decision-maker must actually review any information collected through electronic monitoring, verify that such information is accurate and up to date, review any pending employee requests to correct erroneous data, and exercise independent judgment in making each such decision; and (iii) The human decision-maker must consider information other than information collected through electronic monitoring when making each such decision, such as but not limited to, supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

(i) 9 When an employer makes a hiring, promotion, termination, disciplinary or compensation decision based in whole or part on data gathered through the use of electronic monitoring, it shall disclose to affected employees no less than thirty days prior to the decision going into effect: (i) that the decision was based in whole or part on data gathered through electronic monitoring; (ii) the specific electronic monitoring tool or tools used to gather such data, how the tools work to gather and analyze the data, and the increments of time in which the data is gathered; (iii) the specific data, and judgments based upon such data, used in the decision-making process; and (iv) any information used in the decision-making process gathered through sources other than electronic monitoring.

(j) 10 It shall be unlawful for an employer to use electronic monitoring, alone or in conjunction with an automated employment decision system, unless the employer's proposed use of electronic monitoring has been the subject of an impact assessment. Such impact assessments must: (i) be conducted no more than one year prior to the use of such electronic monitoring, or where the electronic monitoring began before the effective date of this article, within six months of the effective date of this article; (ii) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (iii) evaluate whether the data protection and security practices surrounding the electronic monitoring are consistent with applicable law and cybersecurity industry best practices; (iv) identify which allowable purpose(s) described in this chapter; (vi) consider and describe any other ways in which the electronic monitoring could result in a violation of applicable law and, for any finding that a violation of law may occur, any necessary or appropriate steps to prevent such violation of law; and (vii) consider and describe whether the electronic monitoring may negatively impact employees' privacy and job quality, including wages, hours, and working conditions.

Section 2 is the most extensive section of the bill, establishing a comprehensive regulatory framework for employer use of electronic monitoring tools. It operates on multiple axes: (1) purpose limitation — monitoring is only lawful for six enumerated purposes and must be narrowly tailored; (2) data minimization — the least number of workers, least amount of data, least frequent collection, and prompt deletion; (3) notice and consent — detailed written notice with eleven mandatory disclosure elements plus written consent; (4) recordkeeping — three-year retention and data security; (5) categorical prohibitions — monitoring private areas, off-duty employees, protected activity, and use of gait/voice/emotion recognition; (6) meaningful human oversight of employment decisions based on monitoring data; (7) individual decision disclosure — thirty days' notice before an employment decision based on monitoring data; (8) impact assessment — independent audit before monitoring begins; and (9) transfer restrictions on employee data.

The section also prohibits requiring implanted devices or personal-device monitoring apps, and restricts adverse action based on continuous incremental time-tracking data (except for egregious misconduct). The cumulative effect is to make electronic monitoring in Massachusetts workplaces subject to a rigorous proportionality and transparency regime.

Compliance actions 10 items

Employers must not use an electronic monitoring tool to collect employee information unless the tool is primarily used for one of six enumerated legitimate purposes (facilitating essential job functions, ensuring quality, periodic performance assessment, legal compliance, health/safety/security, or wage/benefit administration). The tool's type and activated capabilities must be narrowly tailored to accomplish the stated purpose, customized and implemented in the manner least invasive to employees, limited to the smallest number of workers, collecting the least amount of data no more frequently than necessary, with data deleted once the purpose is achieved. Data not necessary for the stated purpose must not be disclosed to the employer and must be promptly disposed of by the vendor. Employee data must not be collected when the employee is off-duty. Necessary data must be stored consistent with the commonwealth's data and cyber privacy laws, promptly disposed of when no longer needed, and not used by the employer, vendor, or any third party for any unauthorized reason.

D-01.4

Employers must give prior written notice to and obtain written consent from all candidates and employees subject to electronic monitoring, and must post the notice in a conspicuous place readily available for viewing. The notice must include at minimum: (1) a description of the monitoring purpose; (2) a description of the specific employee data to be collected, stored, secured, and disposed of, and the activities, locations, communications, and job roles monitored; (3) the dates, times, and frequency of monitoring; (4) whether and how collected data will be used as input to an automated employment decision tool; (5) whether and how collected data will be used to make an employment decision; (6) whether and how data may be used in discipline, compliance, adjudications, or litigation; (7) whether data will be used for productivity assessment or standards-setting; (8) where data will be stored and how long retained; (9) an explanation of how the monitoring practice is the least invasive means available; (10) a statement of the employee's right to refuse sale, transfer, or disclosure of their data; and (11) a description of how the employee can exercise rights under this chapter.

D-01.1

Employers must establish, maintain, and preserve for three years contemporaneous, true, and accurate records of data collected via electronic monitoring tools to ensure compliance with employee or commissioner data requests. Employers must destroy employee information collected via electronic monitoring no later than thirty-seven months after collection unless the employee provides written informed consent to retention. Employers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of employee data. Employees have the right to request corrections to erroneous employee data.

G-01.3

Employers must not use electronic monitoring tools in any manner that: violates labor, employment, or civil rights law; threatens employee health, welfare, safety, or legal rights; monitors off-duty employees not performing work tasks; obtains information about an employee's health status, race, color, religion, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy, ancestry, or veteran status; identifies, punishes, or gathers information about employees engaging in protected activity; monitors bathrooms, locker rooms, breakrooms, smoking areas, cafeterias, lounges, breast-milk expression areas, or prayer areas (including frequency-of-use data); monitors a workplace in an employee's residence, personal vehicle, or employee-owned property; uses facial recognition (unless necessary for worker or facility security); or uses gait, voice analysis, or emotion recognition technology. Employers must not take adverse action against employees who in good faith oppose or refuse to submit to a practice they believe violates this chapter. Employers must not take adverse employment action based on continuous incremental time-tracking data except for egregious misconduct. Employers must not take adverse action based on monitoring data measuring performance against a standard not previously and clearly disclosed.

S-02

Employers must not require employees to: (1) physically implant devices that collect or transmit data, including subcutaneous devices or devices incorporated into clothing or personal accessories; (2) install data-collecting applications on personal devices or wear or embed such devices; or (3) carry or use any device with location tracking enabled unless tracking is conducted during work hours only and is strictly necessary to accomplish essential job functions.

S-02

Employers must not use employee data collected via electronic monitoring for purposes other than those specified in the notice provided to employees.

D-01.4

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any other entity unless required by federal or state law, or necessary to comply with an impact assessment of an automated employment decision tool.

D-01.4

Employers must not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, disciplinary (including termination), or compensation decisions. To satisfy this requirement, employers must: (1) establish meaningful human oversight of such decisions — including designating at least one internal reviewer with sufficient expertise, familiarity with the most recent impact assessment, and understanding of tool outputs to identify biases, errors, discrepancies, or inaccuracies; (2) ensure a human decision-maker actually reviews the monitoring data, verifies its accuracy and currency, reviews any pending correction requests, and exercises independent judgment; and (3) require the human decision-maker to consider information beyond monitoring data, such as supervisory evaluations, personnel files, employee work products, or peer reviews.

H-01.6

When an employer makes a hiring, promotion, termination, disciplinary, or compensation decision based in whole or part on electronic monitoring data, the employer must disclose to affected employees no less than thirty days before the decision takes effect: (1) that the decision was based in whole or part on electronic monitoring data; (2) the specific monitoring tools used, how they gather and analyze data, and the time increments of data collection; (3) the specific data and judgments used in the decision-making process; and (4) any non-monitoring information used in the decision.

H-01.1

Employers must not use electronic monitoring, alone or with an automated employment decision system, unless the monitoring has been the subject of an impact assessment. The assessment must: (1) be conducted no more than one year before use (or within six months of the effective date for pre-existing monitoring); (2) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (3) evaluate whether data protection and security practices are consistent with applicable law and cybersecurity best practices; (4) identify the allowable purpose(s); (5) consider and describe any other ways the monitoring could violate applicable law and steps to prevent such violations; and (6) consider and describe whether the monitoring may negatively impact employees' privacy and job quality, including wages, hours, and working conditions.

H-02.3

Ch. 149B, § 3

Automated decision tools used for employment-related decisions

DeployerDeveloper

(a) 11 a) It shall be unlawful for an employer to use an automated employment decision tool for an employment decision, alone or in conjunction with electronic monitoring, unless such tool has been the subject of an impact assessment. Impact assessments must: (i) be conducted no more than one year prior to the use of such tool, or where the tool was in use by the employer before the effective date of this article, within six months of the effective date of this article; (ii) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (iii) identify and describe the attributes and modeling techniques that the tool uses to produce outputs; (iv) evaluate whether those attributes and techniques are a scientifically valid means of evaluating an employee or candidate's performance or ability to perform the essential functions of a role, and whether those attributes may function as a proxy for belonging to a protected class under chapter 151B or any other applicable law; (v) consider, identify, and describe any disparities in the data used to train or develop the tool and describe how those disparities may result in a disparate impact on persons based on their race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran, and what actions may be taken by the employer or vendor of the tool to reduce or remedy any disparate impact; (vi) consider, identify, and describe any outputs produced by the tool that may result in a disparate impact on persons based on their race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran, and what actions may be taken by the employer or vendor of the tool to reduce or remedy that disparate impact; (vii) evaluate whether the use of the tool may limit accessibility for persons with disabilities, or for persons with any specific disability, and what actions may be taken by the employer or vendor of the tool to reduce or remedy the concern; (viii) consider and describe potential sources of adverse impact against individuals or groups based on race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran that may arise after the tool is deployed; (ix) identify and describe any other assessment of risks of discrimination or a disparate impact of the tool on individuals or groups based on race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran that arise over the course of the impact assessment, and what actions may be taken to reduce or remedy that risk; (x) for any finding of a disparate impact or limit on accessibility, evaluate whether the data set, attribute, or feature of the tool at issue is the least discriminatory method of assessing a candidate's performance or ability to perform job functions; (xi) consider and describe any other ways in which the tool could result in a violation of applicable law and, for any finding that a violation of law may occur, any necessary or appropriate steps to prevent such violation of law; (xii) consider and describe whether use of the tool may negatively impact employees' privacy and job quality, including wages, hours, and working conditions; and (xiii) be submitted in its entirety or an accessible summary form to the department for inclusion in a public registry of such impact assessments within sixty days of completion and distributed to employees who may be subject to the tool.

(b) 12 An employer shall conduct or commission subsequent impact assessments each year that the tool is in use to assist or replace employment decisions. Subsequent impact assessments shall comply with the requirements of paragraph (a) of this section, and shall assess and describe any change in the validity or disparate impact of the tool.

(c) 13 An employer or its vendor shall retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool that may be necessary to conduct an impact assessment. To the extent held by a vendor, the employer shall be granted a license to access this documentation and share this documentation with a labor organization to the extent required by federal or state law, or to the extent required by a court or agency in connection with employment or labor litigation. This includes but is not limited to the source of the data used to develop the tool, the technical specifications of the tool, individuals involved in the development of the tool, and historical use data for the tool. Such documentation must include a historical record of versions of the tool, such that an employer shall be able to attest in the event of litigation disputing an employment decision, the nature and specifications of the tool as it was used at the time of that employment decision. Such documentation shall be stored in accordance with such record-keeping, data retention, and security requirements as the commissioner may specify, and in such a manner as to be legible and accessible to the party conducting an impact assessment.

(d) 13 If an initial or subsequent impact assessment requires the collection of employee data to assess a tool's disparate impact on employees, such data shall be collected, processed, stored, retained, and disposed of in such a manner as to protect the privacy of employees, and shall comply with any data retention and security requirements specified by the commissioner. Employee data provided to auditors for the purpose of an impact assessment shall not be shared with the employer, nor shall it be shared with any person, business entity, or other organization unless strictly necessary for the completion of the impact assessment.

(e) 14 If an initial or subsequent impact assessment concludes that a data set, feature, or application of the automated employment decision tool results in a disparate impact on individuals or groups based on race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran, or unlawfully limits accessibility for persons with disabilities, an employer shall refrain from using the tool until it: (i) takes reasonable and appropriate steps to remedy that disparate impact or limit on accessibility and describe in writing to employees, the auditor, and the department what steps were taken; and (ii) if the employer believes the impact assessment finding of a disparate impact or limit on accessibility is erroneous, or that the steps taken in accordance with subparagraph (i) of this paragraph sufficiently address those findings such that the tool may be lawfully used in accordance with this article, describes in writing to employees, the auditor, and the department how the data set, feature, or application of the tool is the least discriminatory method of assessing an employee's performance or ability to complete essential functions of a position.

(f) 15 It shall be unlawful for an independent auditor, vendor, or employer to manipulate, conceal, or misrepresent the results of an impact assessment.

(g) Nothing in this article shall be construed as prohibiting an employer from implementing a lawful affirmative action plan or engaging in otherwise lawful efforts to reduce or eliminate bias in employment-related decisions.

Section 3 establishes the impact assessment regime for automated employment decision tools. It requires a pre-deployment independent audit that evaluates scientific validity, proxy variables, training data disparities, output disparate impact, disability accessibility, post-deployment discrimination risks, and privacy impacts. Assessments must be annual, submitted to the Department of Labor Standards for a public registry, and distributed to affected employees. Employers must cease use of any tool found to produce disparate impact until remedied. The section also requires full documentation retention by employers and vendors, including historical version records for litigation purposes.

The data-privacy protections for the assessment process itself are notable: employee data provided to auditors may not be shared back with the employer. The prohibition on manipulating or misrepresenting assessment results applies to auditors, vendors, and employers alike.

Compliance actions 5 items

Employers must not use an automated employment decision tool unless the tool has been the subject of an independent impact assessment conducted no more than one year before use (or within six months of the effective date for tools already in use). The assessment must be conducted by an independent, impartial party with no financial or legal conflicts of interest and must: identify the tool's attributes and modeling techniques; evaluate scientific validity and proxy-variable risk for protected classes; identify training data disparities and their potential disparate impact; identify output disparate impacts; evaluate disability accessibility limitations; consider post-deployment adverse impact sources; assess all other discrimination risks arising during the assessment; evaluate whether any feature causing disparate impact is the least discriminatory method available; consider other potential legal violations and prevention steps; consider privacy and job-quality impacts; and be submitted in its entirety or accessible summary form to the Department of Labor Standards for a public registry within sixty days of completion and distributed to employees subject to the tool.

H-02.1

Employers must conduct or commission subsequent impact assessments annually for each year the automated employment decision tool remains in use. Subsequent assessments must meet all requirements of the initial assessment and must additionally assess and describe any change in the tool's validity or disparate impact since the prior assessment.

H-02.8

Employers or their vendors must retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool necessary to conduct an impact assessment, including source data, technical specifications, developer information, and historical use data. Documentation must include a historical version record enabling the employer to attest to the tool's specifications at the time of any disputed employment decision. Vendor-held documentation must be licensed to the employer and shareable with labor organizations and courts. Documentation must be stored per commissioner-specified requirements and must be legible and accessible to the auditor. Employee data collected for impact assessments must be processed and stored to protect privacy, must not be shared with the employer, and must not be shared with anyone unless strictly necessary for the assessment.

G-01.3

If an impact assessment finds that any data set, feature, or application of an automated employment decision tool results in a disparate impact based on protected characteristics or unlawfully limits accessibility for persons with disabilities, the employer must refrain from using the tool until it: (1) takes reasonable and appropriate steps to remedy the disparate impact or accessibility limitation and describes those steps in writing to employees, the auditor, and the department; and (2) if the employer believes the finding is erroneous or that remedial steps sufficiently address the findings, describes in writing how the feature at issue is the least discriminatory method of assessing performance or ability to perform essential job functions.

H-02.3

Independent auditors, vendors, and employers must not manipulate, conceal, or misrepresent the results of an impact assessment.

H-02

Ch. 149B, § 4

Notice requirement

Deployer

(a) 16 Any employer that uses an automated employment decision tool to assess or evaluate an employee or candidate shall notify employees and candidates subject to the tool no less than ten business days before such use: (i) that an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate; (ii) the job qualifications and characteristics that such automated employment decision tool will assess, what employee or candidate data or attributes the tool will use to conduct that assessment, and what kind of outputs the tool will produce as an evaluation of such employee or candidate; (iii) what employee or candidate data is collected for the automated employment decision tool, the source of such data and the employer's data retention policy. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation; (iv) the results of the most recent impact assessment of the automated employment decision tool, including any findings of a disparate impact and associated response from the employer, or information about how to access that information if publicly available; (v) information about how an employee or candidate may request an alternative selection process or accommodation that does not involve the use of an automated employment decision tool and details about that alternative process or accommodation process; and (vi) information about how the employee or candidate may: (A) request reevaluation of the employment decision made by the automated employment decision tool in accordance with section one thousand thirteen of this article; and (B) notification of the employee or candidate's right to file a complaint in a civil court in accordance with section seven of this chapter or otherwise exercise the rights described in this chapter.

(b) 16 The notice required by this section shall be: (i) written in clear and plain language; (ii) included in each job posting or advertisement for each position for which the automated employment decision tool will be used; (iii) posted on the employer's website in any language that the employer regularly uses to communicate with employees; (iv) provided directly to each candidate who applies for a position in the language with which that candidate communicates with the employer; (v) made available in formats that are reasonably accessible to and usable by individuals with disabilities; and (vi) otherwise presented in a manner that ensures the notice clearly and effectively communicates the required information to employees.

Section 4 establishes a detailed pre-use notice requirement for automated employment decision tools, separate from the electronic monitoring notice in Section 2. Employers must notify employees and candidates at least ten business days before an automated tool is used to assess or evaluate them. The notice must cover six substantive categories including tool functionality, data inputs and outputs, impact assessment results, alternative process availability, and employee rights. The notice must be delivered in plain language, included in job postings, posted on the employer's website in all languages used with employees, provided directly to candidates, and made accessible to persons with disabilities.

Compliance actions 1 item

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool to assess or evaluate them. The notice must include: (1) that an automated tool will be used; (2) the qualifications and characteristics the tool assesses, the data or attributes used, and the types of outputs produced; (3) what data is collected, its source, and the data retention policy; (4) results of the most recent impact assessment including any disparate impact findings and employer response; (5) how to request an alternative selection process or accommodation not involving the automated tool; and (6) how to request reevaluation of the tool's decision and the right to file a civil complaint. The notice must be written in plain language, included in job postings, posted on the employer's website in all employee-communication languages, provided directly to each candidate in their language, accessible to persons with disabilities, and otherwise presented to ensure clear and effective communication.

H-01.1

Ch. 149B, § 5

Restricted uses of automated decision tools

Deployer

(a) 17 Notwithstanding the provisions of subdivision one of this section, an employer shall not, alone or in conjunction with an electronic monitoring tool, use an automated decision tool: (i) in such a manner that results in a violation of labor, employment, or civil rights law or any other law of the commonwealth; (ii) in a manner that harms or is likely to harm the health or safety of employees, including by setting productivity quotas in a manner that is likely to cause physical or mental illness or injury; (iii) to make predictions about an employee or candidate for employment's behavior, beliefs, intentions, personality, emotional state, or other characteristic or behavior; (iv) to predict, interfere with, restrain, or coerce employees engaging in activity protected under labor and employment law; (v) to subtract from an employee's wages time spent exercising their legal rights; (vi) in a manner that deviates from the specification of the automated employment decision tool as implemented after the incorporation of any alterations made pursuant to the impact assessment required by subdivision one of this section; or (vii) that involves facial recognition, gait, or emotion recognition technologies.

(b)–(c) 18 An employer shall not rely primarily on output from an automated decision tool when making hiring, promotion, termination, disciplinary, or compensation decisions. For an employer to satisfy the requirements of this paragraph: (i) An employer must establish meaningful human oversight of such decisions based in whole or in part on the output of automated employment decision tools. In determining whether an internal reviewer employs the requisite knowledge and skill to provide meaningful human oversight, relevant factors include the relative complexity and specialized nature of the automated decision tool, the reviewer's general experience, the reviewer's training and experience in the field, the preparation and study the reviewer is able to give the matter and whether it is feasible to refer the matter to, or associate or consult with, an expert with established competence in the field automated decision tools. (ii) A human decision-maker must actually review any output of an automated employment decision tool and exercise independent judgment in making each such decision; (iii) The human decision-maker must consider information other than automated employment decision tool outputs when making each such decision, such as but not limited to supervisory or managerial evaluations, personnel files, employee work products, or peer reviews; and (iv) An employer shall consider information other than automated employment decision tool outputs when making hiring, promotion, termination, disciplinary, or compensation decisions, such as supervisory or managerial evaluations, personnel files, employee work products, or peer reviews. (c) An employer shall not require employees or candidates to consent to the use of an automated employment decision tool in an employment decision in order to be considered for an employment decision, nor shall an employer discipline or disadvantage an employee or candidate for employment as a result of their request for accommodation.

Section 5 establishes two categories of restrictions on automated decision tools in employment: categorical prohibitions and human-oversight requirements. The prohibitions cover use that violates existing law, harms employee health/safety (including via dangerous productivity quotas), predicts employee behavior/beliefs/personality/emotional state, interferes with protected labor activity, deducts wages for exercising legal rights, deviates from post-assessment specifications, and employs facial recognition, gait, or emotion recognition. The human-oversight requirement mirrors Section 2(h) but applies specifically to ADS output rather than monitoring data, requiring meaningful human oversight, independent judgment, consideration of non-ADS information, and a prohibition on requiring employee consent to ADS use as a condition of being considered for employment decisions.

Compliance actions 2 items

Employers must not use an automated decision tool in the employment context to: (1) violate labor, employment, civil rights, or other commonwealth law; (2) harm or likely harm employee health or safety, including by setting productivity quotas likely to cause physical or mental illness or injury; (3) predict an employee's or candidate's behavior, beliefs, intentions, personality, emotional state, or other characteristic; (4) predict, interfere with, restrain, or coerce employees engaging in protected labor activity; (5) subtract from wages time spent exercising legal rights; (6) deviate from the tool's post-assessment specifications; or (7) employ facial recognition, gait, or emotion recognition technologies.

S-02

Employers must not rely primarily on automated decision tool output when making hiring, promotion, termination, disciplinary, or compensation decisions. To satisfy this requirement: (1) employers must establish meaningful human oversight, considering the tool's complexity, the reviewer's experience and training, preparation time, and feasibility of expert consultation; (2) a human decision-maker must actually review each automated output and exercise independent judgment; (3) the human must consider non-automated information such as supervisory evaluations, personnel files, work products, or peer reviews; and (4) the employer must consider non-automated information in each such decision. Employers must not require employee or candidate consent to automated tool use as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone for requesting accommodation.

H-01.4

Ch. 149B, § 6

Anti-retaliation provisions for impacted workers

Deployer

(a) 19 a) An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an artificial intelligence system, automated decision system, algorithm, or other similar technology if the following conditions are met: i) The employee holds independent judgment and discretion in executing their work duties, or the work duties to be performed by the employee require licensure or certification by the commonwealth as a condition of employment, independent accreditation by the employer; ii) The employee has notified a supervisor, manager, or their employer that the output from the artificial intelligence system, automated decision system, algorithm, or other similar technology may, in the employee's professional opinion and/or educational or work related- experience, lead to harm of a natural person, damage to physical property, an illegal action, an action contrary to the licensure or certification requirements of the Federal government, commonwealth, or an applicable private licensing or certifying authority, or an outcome contrary to the goal of the employer, and the employer refused or otherwise failed to adjust the output; iii) The employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon training, education, or experience, that the output would cause harm or have an adverse impact; and iv) Due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through department action.

(b) b) The Office of the Attorney General shall promulgate additional procedures, rules, or regulations in order to further the Commonwealth's interest in protecting consumers and the public good from violations of privacy rights and harms resulting from the use of artificial intelligence and automated-decision systems. Such regulations shall consider, including but not limited to, bias testing, appropriate disclosures, clear, conspicuous, and reasonably understandable notice, whether there exists a client-professional relationship, best and current practices and models utilized by other states and the federal government to ensure regulations are responsive to emerging technologies, and appropriate additional documentation that is reasonably necessary to assist the Office to evaluate the inputs and outputs and monitor the performance of artificial intelligence and automated decision-making systems for the risk of bias and consumer harm.

Section 6 creates a conditional anti-retaliation protection for employees who refuse to follow AI system outputs. The protection requires four conditions: the employee holds independent judgment/discretion or requires licensure/certification; the employee notified the employer that the output may cause harm and the employer failed to adjust; the employee refused in good faith based on training, education, or experience; and urgency precluded correction through normal channels. The section also directs the Attorney General and Division of Licensing to promulgate regulations, and separately directs the AG to promulgate broader regulations on AI consumer and privacy protection including bias testing, disclosures, and monitoring for consumer harm.

Compliance actions 1 item

Employers must not terminate, discipline, retaliate against, or take any other adverse employment action against an employee who refuses to follow AI or automated decision system output, provided: (1) the employee holds independent judgment/discretion or requires licensure/certification; (2) the employee notified the employer that the output may lead to harm, illegal action, certification violation, or outcome contrary to the employer's goals, and the employer failed to adjust; (3) the employee refused in good faith with reasonable belief based on training, education, or experience that the output would cause harm; and (4) urgency prevented correction through normal channels.

G-03.3

Ch. 149B, § 7

Civil claims for adverse employment action based on prohibited conduct

20 No employee shall be penalized by an employer in any way as a result of any action on the part of an employee to seek the employee's rights under the provisions of this chapter. Any employer who discharges or in any other manner discriminates against any employee because such employee has made a complaint to the attorney general or any other department, agency, or person, or assists the attorney general or department in any investigation under this chapter, or has instituted, or caused to be instituted any proceeding under or related to this chapter, or has testified or is about to testify in any such proceedings, shall have violated this section and shall be punished or shall be subject to a civil citation or order as provided in section 27C. An individual subjected to an adverse employment action based on conduct prohibited by this Act may file a civil action against an employer, as well as the president, treasurer, and any responsible managers of the employer in their individual capacity. If liability is found, the employee shall be entitled to restitution and consequential damages, as well as liquidated damages constituting double the amount of restitution, pre- and post- judgment interest, reasonable attorneys' fees and costs. Where appropriate, a court may also impose punitive damages. Nothing in this section shall limit the availability of other remedies at law or in equity.

Section 7 establishes the enforcement mechanism for the chapter. It contains three layers: (1) a general anti-retaliation provision prohibiting employers from penalizing employees for seeking rights under the chapter; (2) a specific prohibition on retaliation for filing complaints with the AG or other agencies, assisting investigations, or testifying in proceedings; and (3) a private right of action for individuals subjected to adverse employment actions, with remedies including restitution, consequential damages, liquidated damages at double restitution, pre- and post-judgment interest, attorneys' fees, and discretionary punitive damages. Liability extends to the employer and responsible officers individually.

M.G.L. ch. 30, § 66

Government ADS use prohibition without specific authorization

Government

21 Any agency or department of the commonwealth, or any entity acting on behalf of an agency or department, shall be prohibited from, directly or indirectly, utilizing or applying any automated decision system in performing any function that: (i) is related to the delivery of any public assistance benefit; (ii) will have a material impact on the rights, civil liberties, safety, or welfare of any individual within the commonwealth; or (iii) affects any statutorily or constitutionally provided right of an individual; unless such utilization or application is specifically authorized in law.

Section 66, added to Chapter 30 (general provisions on state administration), creates a blanket prohibition on government use of automated decision systems in three categories of functions unless specifically authorized by law: delivery of public assistance benefits, functions materially impacting individual rights, civil liberties, safety, or welfare, and functions affecting statutory or constitutional rights. This is an extremely broad restriction — it effectively creates a legislative-authorization prerequisite for any government AI deployment in consequential contexts.

Compliance actions 1 item

State agencies and departments (and entities acting on their behalf) must not use automated decision systems for any function related to public assistance delivery, materially impacting individual rights, civil liberties, safety, or welfare, or affecting statutory or constitutional rights, unless such use is specifically authorized by law.

PS-01

M.G.L. ch. 30B, § 24

Government ADS procurement restrictions and impact assessments

Government

(a) 22 a) No executive office, department, division, agency, or commission of the commonwealth shall authorize any procurement, purchase, or acquisition of any service or system utilizing, or relying on, automated decision systems, except where the use of such system is specifically authorized in law. An automated decision system is any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods that issues an output, including a score, classification, ranking, or recommendation, that is used to assist or replace human decision making on decisions that impact natural persons.

(b) 23 b) No state agency shall utilize or apply any automated decision system unless the agency, or an entity acting on behalf of such state agency, shall have conducted an impact assessment for the application and use of such automated decision system. Following the first impact assessment, an impact assessment shall be conducted at least once every two years. An impact assessment shall be conducted prior to any material change to the automated decision-making system that may change the outcome or effect of such system. Such impact assessments shall include: i) a description of the objectives of the automated decision system; ii) an evaluation of the ability of the automated decision system to achieve its stated objectives; iii) a description and evaluation of the objectives and development of the automated decision system including: 1) A summary of the underlying algorithms, computational modes, and artificial intelligence tools that are used within the automated decision system; and 2) The design and training data used to develop the automated decision-making process. iv) testing for: 1) Accuracy, fairness, bias, and discrimination, and an assessment of whether the use of the automated decision-making system produces discriminatory results on the basis of a consumer's or a class of consumers' actual or perceived race, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, source of income, or disability and outlines mitigations for any identified performance differences in outcomes across relevant groups impacted by such use; 2) Any cybersecurity vulnerabilities and privacy risks resulting from the deployment and use of the automated decision-making system, and the development or existence of safeguards to mitigate the risks; 3) Any public health or safety risks resulting from the deployment and use of the automated decision-making system; 4) Any reasonably foreseeable misuse of the automated decision-making system and the development or existence of safeguards against such misuse; v) the extent to which the deployment and use of the automated decision-making system requires the input of sensitive and personal data, how that data is used and stored, and any control users may have over their data; and vi) the notification mechanism or procedure, if any, by which individuals impacted by the utilization of the automated decision-making system may be notified of the use of such automated decision-making system and of the individual's personal data, and informed of their rights and options relating to such use.

(c) 24 c) Notwithstanding the provisions of this section or any other law, if an impact assessment finds that the automated decision-making system produces discriminatory or biased outcomes, the state agency shall cease any utilization, application, or function of such automated decision-making system, and of any information produced using that system.

(d) 25 d) Any impact assessment conducted pursuant to this section shall be submitted to the governor, the president of the senate, and the speaker of the house at least 60 days prior to the implementation of the automated decision-making system that is the subject of such assessment. The impact statement of an automated decision-making system that is approved and utilized, shall be published on the website of the relevant agency. If the state agency makes a determination that the disclosure of any information required in the impact assessment would result in a substantial negative impact on health or safety of the public, infringe upon the privacy rights of individuals, or significantly impact the state agency's ability to protect its information technology, it may redact such information, provided that an explanatory statement on the process by which the state agency made such determination is published along with the redacted impact assessment.

Section 24, added to Chapter 30B (procurement), creates two major obligations for state government: (1) a procurement prohibition — no state entity may procure any service or system utilizing automated decision systems unless specifically authorized by law; and (2) a mandatory impact assessment regime — state agencies must conduct impact assessments before using any ADS, with biennial reassessments and reassessment before material changes. The impact assessment must cover objectives, effectiveness, algorithmic summary, training data, bias/discrimination testing, cybersecurity/privacy risks, public health/safety risks, foreseeable misuse, sensitive data handling, and notification mechanisms. Agencies must cease use of any system found to produce discriminatory outcomes, and assessments must be submitted to the governor, senate president, and house speaker at least 60 days before implementation, with publication on the agency website (with limited redaction authority).

Compliance actions 4 items

No executive office, department, division, agency, or commission of the commonwealth may procure, purchase, or acquire any service or system utilizing or relying on automated decision systems unless the use of such system is specifically authorized by law.

PS-01.4

State agencies must conduct an impact assessment before using any automated decision system, with reassessments at least every two years and before any material change. The assessment must include: (1) description of objectives; (2) evaluation of ability to achieve objectives; (3) description of underlying algorithms, computational modes, AI tools, design, and training data; (4) testing for accuracy, fairness, bias, and discrimination across protected characteristics with mitigation plans; (5) cybersecurity and privacy risk assessment with safeguards; (6) public health and safety risk assessment; (7) foreseeable misuse assessment with safeguards; (8) assessment of sensitive/personal data requirements, use, storage, and user controls; and (9) notification mechanisms for impacted individuals.

PS-01.2

If an impact assessment finds that an automated decision-making system produces discriminatory or biased outcomes, the state agency must immediately cease all use of that system and all information produced by that system.

PS-01

State agencies must submit each impact assessment to the governor, president of the senate, and speaker of the house at least 60 days before implementing the assessed automated decision-making system. Approved and utilized systems' impact assessments must be published on the relevant agency's website. An agency may redact information if disclosure would substantially harm public health/safety, infringe privacy rights, or significantly impact information technology protection, provided the agency publishes an explanatory statement describing its determination process alongside the redacted assessment.

PS-01.3

Public Sector Procurement restrictions · government use

5 items

PS-01

PS-01.4

PS-01.2

PS-01

PS-01.3