Regulon — NY-AB-8328 · NY AB 8328 (Electronic Monitoring & Automated Employment Decision Tools)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Dual enforcement. The Attorney General may initiate an action in a court of competent jurisdiction for correction of any violation. Employees and candidates may also initiate a private civil action after requesting reevaluation from the employer, if the employer fails to respond or the employee continues to believe they were harmed. Civil penalties are recoverable through agency-designated tribunals. The Division of Human Rights retains independent authority under Article 15 of the Executive Law.

Private Right of Action

Penalties

Civil penalties: up to $500 for a first violation (and each additional violation on the same day), $500–$1,500 for each subsequent violation. Each day of unlawful use constitutes a separate violation; each failure to provide notice is a separate violation. In private actions, employer is liable for actual damages, reasonable attorneys' fees and costs, plus 100% liquidated damages (up to 300% if willful), unless the employer proves a good-faith compliance belief. Vendors and employers are jointly and severally liable. Where a vendor knowingly sells to an employer with fewer than 50 employees, the vendor bears sole liability. The AG may seek injunctive relief mandating compliance.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Labor Law § 203-g(1)

Definitions

(1)(a)–(i) "Automated employment decision tool" means any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods that issues a simplified output, including a score, classification, ranking, or recommendation, that is used to assist or replace decision making for employment decisions that impact natural persons. "Automated employment decision tool" does not include a tool that does not assist or replace employment decision processes and that does not materially impact natural persons, including, but not limited to, a junk email filter, firewall, antivirus software, calculator, spreadsheet, database, data set, or other compilation of data. (b) "Bias audit" means an impartial evaluation by an independent auditor...

This subdivision establishes the defined terms governing the bill's two principal regulatory regimes — electronic monitoring tools and automated employment decision tools. The definition of automated employment decision tool is notably broad, covering any computational process using machine learning, statistical modeling, data analytics, or AI that issues a simplified output used to assist or replace employment decisions. The carve-out for tools that do not assist or replace employment decision processes and do not materially impact natural persons provides a safe harbor for ordinary IT infrastructure. The definition of employee data is expansive, reaching biometric data, health information, workplace communications, geolocation, and even AEDT inputs and outputs linked to an individual.

Labor Law § 203-g(2)

Electronic monitoring: permissible use, notice, and data destruction

Deployer

(2)(a) 1 It shall be unlawful for an employer to use an electronic monitoring tool to collect employee data unless: (i) the electronic monitoring tool is primarily intended to accomplish any of the following purposes: (A) allowing a worker to accomplish an essential job function; (B) ensuring the quality of goods and services; (C) periodic assessment of worker performance; (D) ensuring compliance with employment, labor, or other relevant laws; (E) protecting the health, safety, or security of workers, or the security of the employer's facilities or computer networks; (F) administering wages and benefits; or (G) additional purposes to enable business operations as determined by the department; (ii) the specific type of electronic monitoring tool is strictly necessary to accomplish the purpose, exclusively used to accomplish the purpose, and is the least invasive means to the employee that could reasonably be used to accomplish the purpose; and (iii) the specific form of electronic monitoring is limited to the smallest number of workers and collects the least amount of data necessary to accomplish the purpose.

(2)(b) 2 Any employer that uses an electronic monitoring tool shall give prior written notice to all employees who may be subject to electronic monitoring and post said notice in a conspicuous place which is readily available for viewing by employees, pursuant to subdivision two of section fifty-two-e of the civil rights law. Such notice shall include, at a minimum, the following: (i) a description of the purpose for which the electronic monitoring tool will be used, as specified in subparagraph (i) of paragraph (a) of this subdivision; (ii) a description of the specific employee data to be collected, and the activities, locations, communications, and job roles that will be electronically monitored by the tool; (iii) a description of the dates, times, and frequency that electronic monitoring will occur; (iv) whether and how any employee data collected by the electronic monitoring tool will be used as an input in an automated employment decision tool; (v) whether and how any employee data collected by the electronic monitoring tool will alone or in conjunction with an automated employment decision tool be used to make an employment decision by the employer or employment agency; (vi) whether any employee data collected by the electronic monitoring tool will be used to assess employees' productivity performance or to set productivity standards, and if so, how; (vii) a description of where any employee data collected by the electronic monitoring tool will be stored and the length of time it will be retained; and (viii) an explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the monitoring purpose.

(2)(c) 3 An employer shall destroy any employee data collected via an electronic monitoring tool when the initial purpose for collecting the data has been satisfied or at the end of the employee's relationship with the employer, unless the employee has provided written and informed consent to the retention of their data by the employer.

(2)(d) 2 Notice of the specific form of electronic monitoring shall be clear and conspicuous and provide the worker with actual notice of electronic monitoring activities. A notice that states electronic monitoring "may" take place or that the employer "reserves the right" to monitor shall not be considered clear and conspicuous.

(2)(e) 4 An employer who engages in random or periodic electronic monitoring of employees shall inform the affected employees of the specific events which are being monitored at the time the monitoring takes place. Notice shall be clear and conspicuous. (ii) Notice of random or periodic electronic monitoring may be given after electronic monitoring has occurred only if necessary to preserve the integrity of an investigation of illegal activity or protect the immediate safety of employees, customers, or the public.

This subdivision establishes a purpose-limitation and proportionality framework for employer use of electronic monitoring tools. Employers may use such tools only for enumerated purposes — enabling essential job functions, quality assurance, performance assessment, legal compliance, health and safety, and wage and benefit administration — and must satisfy a three-part proportionality test: the specific tool must be strictly necessary, exclusively used for the stated purpose, and the least invasive means available.

Employers must provide prior written notice to all employees who may be monitored, specifying the monitoring purpose, data collected, activities and locations monitored, schedule, whether data feeds into an AEDT, storage location, retention period, and why the chosen method is the least invasive. Notices stating monitoring "may" occur or that the employer "reserves the right" to monitor are explicitly deemed insufficient. Data must be destroyed when the collection purpose is satisfied or the employment relationship ends, unless the employee provides written informed consent to continued retention. Random or periodic monitoring requires real-time notice to affected employees, with a narrow exception for investigations of illegal activity or immediate safety.

Compliance actions 4 items

Employers must not use an electronic monitoring tool to collect employee data unless the tool is primarily intended for an enumerated permissible purpose (essential job functions, quality assurance, performance assessment, legal compliance, health/safety, or wage administration), is strictly necessary and exclusively used for that purpose, is the least invasive means available, and is limited to the smallest number of workers and least amount of data necessary.

D-01.4

Employers must provide prior written notice to all employees who may be subject to electronic monitoring and post that notice conspicuously, including descriptions of the monitoring purpose, specific data collected, activities and locations monitored, dates and frequency, whether data feeds into an AEDT, storage location and retention period, and why the monitoring method is the least invasive available. Notices stating monitoring may occur or that the employer reserves the right to monitor are insufficient.

D-01.1

Employers must destroy employee data collected via electronic monitoring when the initial collection purpose has been satisfied or when the employment relationship ends, unless the employee provides written and informed consent to continued retention.

D-01.4

Employers conducting random or periodic electronic monitoring must inform affected employees of the specific events being monitored at the time monitoring takes place. Post-monitoring notice is permitted only when necessary to preserve the integrity of an investigation of illegal activity or protect immediate safety.

D-01.1

Labor Law § 203-g(3)

Electronic monitoring: prohibited practices

Deployer

(3)(a)(i)–(xi) 5 Notwithstanding the allowable purposes for electronic monitoring described in paragraph (a) of subdivision two of this section, an employer shall not: (i) use an electronic monitoring tool in such a manner that results in a violation of labor or employment law; (ii) use an electronic monitoring tool in such a manner as to threaten the health, welfare, safety, or legal rights of employees; (iii) use an electronic monitoring tool to monitor employees who are off-duty and not performing work-related tasks; (iv) use an electronic monitoring tool in order to obtain information about an employee's religious beliefs, health or disability status, or immigration status; (v) use an electronic monitoring tool in order to identify, punish, or obtain information about employees engaging in activity protected under labor and employment law; (vi) use an electronic monitoring tool in order to or with the effect of informing a dynamic wage-setting system; (vii) conduct audio-visual monitoring of bathrooms or other similarly private areas, including locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, areas designated to express breast milk, or areas designated for prayer or other religious activity, including data collection on the frequency of use of those private areas; (viii) conduct audio-visual monitoring of a workplace in an employee's residence, an employee's personal vehicle, or property owned or leased by an employee, unless that audio-visual monitoring is strictly necessary to ensure employee health and safety, to verify the security of company or client data, or to accomplish other similarly compelling purposes; (ix) use an electronic monitoring tool that incorporates facial recognition, gait, or emotion recognition technology; (x) discipline or terminate the employment of an employee solely on the basis of their opposition of or refusal to submit to a practice that the employee believes in good faith that violate this section; or (xi) where employees have union representation, refuse to bargain over the use of electronic monitoring tools.

(3)(b) 6 An employer shall not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided pursuant to paragraph (b) of subdivision two of this section.

(3)(c) 7 An employer shall not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless it is required to do so under state or federal law, or necessary to do so to comply with a bias audit of an automated employment decision tool pursuant to subdivision four of this section.

(3)(d) 8 An employer shall not require employees to either install applications on personal devices that collect or transmit employee data or to wear, embed, or physically implant those devices, including those that are installed subcutaneously or incorporated into items of clothing or personal accessories, unless the electronic monitoring is strictly necessary to accomplish essential job functions and is narrowly limited to only the activities and times necessary to accomplish essential job functions. Location tracking applications and devices shall be disabled outside the activities and times necessary to accomplish essential job functions.

(3)(e) 9 An employer shall not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

(3)(f) 10 The information and judgments involved in an employer's use of electronic monitoring data shall be documented and communicated to affected employees prior to the hiring, promotion, termination, or disciplinary decision going into effect.

(3)(g) Data that provides evidence of criminal activity, when independently corroborated by the employer, or captured through the use of reasonable security measures that comply with paragraph (a) of subdivision two of this section, is exempt from this subdivision.

This subdivision establishes a set of categorical prohibitions on employer use of electronic monitoring tools, supplementing the permissible-purpose framework in subdivision 2. The prohibitions address monitoring that violates labor law, threatens employee welfare, targets off-duty employees, seeks sensitive personal information (religious beliefs, health/disability status, immigration status), or is used to identify or punish protected labor activity. Particularly notable is the ban on monitoring that informs a dynamic wage-setting system, the prohibition on facial recognition, gait, and emotion recognition technologies, and the restrictions on audio-visual monitoring of private areas and employee residences.

The subdivision also prohibits secondary uses of monitoring data beyond the purposes specified in the notice, bars sale or transfer of monitoring data to third parties (with narrow exceptions for legal requirements and bias audits), and prohibits requiring employees to install monitoring applications on personal devices or wear monitoring devices except where strictly necessary for essential job functions. Employers may not rely solely on monitoring data for employment decisions and must document and communicate to affected employees the information and judgments used before any adverse decision takes effect. The subdivision provides an anti-retaliation protection for employees who oppose monitoring practices they believe violate the section.

Compliance actions 6 items

Employers must not use electronic monitoring tools in any manner that violates labor or employment law, threatens employee welfare, monitors off-duty employees, obtains information about religious beliefs or health/disability/immigration status, identifies or punishes protected labor activity, informs a dynamic wage-setting system, monitors private areas (bathrooms, locker rooms, breakrooms, lactation areas, prayer areas), or incorporates facial recognition, gait, or emotion recognition technology. Employers must not discipline or terminate employees for good-faith opposition to practices they believe violate this section and must not refuse to bargain over monitoring where employees have union representation.

S-02

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the prior written notice provided to employees.

D-01.4

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any third party unless required by state or federal law or necessary to comply with a bias audit of an automated employment decision tool.

D-01

Employers must not require employees to install monitoring applications on personal devices or to wear, embed, or physically implant monitoring devices unless the monitoring is strictly necessary for essential job functions and is narrowly limited to the activities and times necessary for those functions. Location tracking must be disabled outside those times.

S-02

Employers must not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

H-01.6

Employers must document the information and judgments involved in their use of electronic monitoring data and communicate that documentation to affected employees before any hiring, promotion, termination, or disciplinary decision takes effect.

H-01.1

Labor Law § 203-g(4)

Automated employment decision tools: bias audit requirements

DeployerDeveloper

(4)(a) 11 It shall be unlawful for an employer to use an automated employment decision tool for an employment decision unless such tool has been the subject of a bias audit. Bias audits for automated employment decision tools must: (i) be conducted no more than one year prior to the use of such tool, or where the tool was in use by the employer before this act became a law, within six months of this act becoming a law; and (ii) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (iii) identify and describe the attributes and modeling techniques that the tool uses to produce outputs; (iv) evaluate whether those attributes and techniques are a scientifically valid means of evaluating an employee or candidate's performance or ability to perform the essential functions of a role, and whether those attributes may function as a proxy for belonging to a protected class; (v) consider, identify, and describe any disparities in the data used to train or develop the tool and describe how those disparities may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy any disparate impact; (vi) consider, identify, and describe any disparities in the outputs produced by the tool that may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy that disparate impact; (vii) evaluate whether the use of the tool may limit accessibility for persons with disabilities, or for persons with any specific disability, and what actions may be taken by the employer or vendor of the tool to reduce or remedy the concern; (viii) identify and describe any other assessment of risks of discrimination or a disparate impact of the tool on members of a protected class that arise over the course of the bias audit, and what actions may be taken to reduce or remedy that risk; (ix) for any finding of a disparate impact or limit on accessibility, evaluate whether the data set, attribute, or feature of the tool at issue is the least discriminatory method of assessing a candidate's performance or ability to perform job functions; and (x) be submitted in its entirety or an accessible summary form to the department for inclusion in a public registry of such audits within sixty days of completion and distributed to employees who may be subject to the tool.

(4)(b) 12 An employer shall conduct or commission subsequent audits each year that the tool is in use to assist or replace employment decisions. Subsequent audits shall comply with the requirements of paragraph (a) of this subdivision, and shall assess and describe any change in the validity or disparate impact of the tool.

(4)(c) 13 An employer or vendor shall retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool that may be necessary to conduct a bias audit. This includes but is not limited to the source of the data used to develop the tool, the technical specifications of the tool, individuals involved in the development of the tool, and historical use data for the tool. Such documentation must include a historical record of versions of the tool, such that an employer shall be able to attest in the event of litigation disputing an employment decision, the nature and specifications of the tool as it was used at the time of that employment decision. Such documentation shall be stored in such a manner as to be legible and accessible to the party conducting a bias audit.

(4)(d) 14 If an initial or subsequent bias audit requires the collection of sensitive employee data to assess a tool's disparate impact on employees, such data shall be collected, processed, stored, and retained in such a manner as to protect the privacy of employees. Employee data provided to auditors for the purpose of a bias audit shall not be shared with the employer, nor shall it be shared with any person, business entity, or other organization unless strictly necessary for the completion of the bias audit.

(4)(e) 15 If an initial or subsequent bias audit concludes that a data set, feature, or application of the automated employment decision tool results in a disparate impact on persons belonging to a protected class, or unlawfully limit accessibility for persons with disabilities, an employer shall: (i) take reasonable and appropriate steps to reduce or remedy that disparate impact or limit on accessibility and describe in writing to employees, the auditor, and the department what steps were taken; and (ii) if the employer believes the audit finding of a disparate impact or limit on accessibility is erroneous, or that the steps taken in accordance with subparagraph (i) of this paragraph sufficiently address those findings such that the tool may be lawfully used in accordance with this section, describe in writing to employees, the auditor, and the department how the data set, feature, or application of the tool is the least discriminatory method of assessing an employee's performance or ability to complete essential functions of a position; or (iii) if the employer believes the audit finding of a disparate impact or limit on accessibility is part of a lawful affirmative action plan or other lawful effort to reduce or eliminate bias in employment decisions, describe such plan or effort in writing to employees, the auditor, and the department.

(4)(f) 16 It shall be unlawful for an independent auditor, vendor, or employer to manipulate, conceal, or misrepresent the results of a bias audit.

This subdivision establishes the bill's central AEDT compliance requirement: no employer may use an automated employment decision tool for employment decisions unless the tool has undergone a comprehensive bias audit by an independent, impartial auditor with no financial or legal conflicts of interest. The audit must have been conducted within one year of use (or within six months of the effective date for tools already in use).

The audit requirements are among the most prescriptive in any U.S. AEDT statute. Beyond disparate impact testing, auditors must identify modeling techniques and attributes, evaluate scientific validity, assess proxy-variable risk for protected classes, evaluate training data disparities, consider disability accessibility limitations, and for any finding of disparate impact, determine whether the feature at issue is the least discriminatory method available. Completed audits must be submitted to the Department of Labor for inclusion in a public registry and distributed to affected employees within sixty days.

Employers must conduct annual subsequent audits, retain all design and development documentation necessary for audits, and protect the privacy of sensitive employee data collected for audit purposes. Where an audit finds disparate impact, employers must take reasonable remedial steps and describe them in writing to employees, the auditor, and the department. Manipulation, concealment, or misrepresentation of audit results is independently unlawful for auditors, vendors, and employers alike.

Compliance actions 6 items

Employers must not use an automated employment decision tool unless the tool has been the subject of a bias audit conducted within the past year by an independent, impartial auditor with no financial or legal conflicts of interest. The audit must (1) identify modeling techniques and attributes, (2) evaluate scientific validity and proxy-variable risk for protected classes, (3) assess training data and output disparities and recommend remedial actions, (4) evaluate disability accessibility limitations, (5) determine whether features causing disparate impact are the least discriminatory method available, and (6) be submitted to the Department of Labor for a public registry within 60 days and distributed to affected employees.

H-02.1

Employers must conduct or commission annual subsequent bias audits for each year the automated employment decision tool is in use, assessing and describing any change in validity or disparate impact.

H-02.8

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of automated employment decision tools, including data sources, technical specifications, individuals involved in development, historical use data, and a version history sufficient to attest to the tool's specifications at the time of any employment decision. Documentation must be stored in a legible and accessible format for auditors.

G-01.3

Sensitive employee data collected for bias audits must be collected, processed, stored, and retained in a manner that protects employee privacy. Audit data must not be shared with the employer and must not be shared with any other entity unless strictly necessary for audit completion.

D-01.4

Where a bias audit finds disparate impact or accessibility limitations, employers must (1) take reasonable steps to reduce or remedy the impact and describe those steps in writing to employees, the auditor, and the department; or (2) if the employer disputes the finding, explain in writing why the tool is the least discriminatory method available; or (3) if the finding results from a lawful affirmative action plan, describe that plan in writing to employees, the auditor, and the department.

H-02.1

Independent auditors, vendors, and employers must not manipulate, conceal, or misrepresent the results of a bias audit.

H-02

Labor Law § 203-g(5)

AEDT: pre-use notice to employees and candidates

Deployer

(5) 17 5. Any employer that uses an automated employment decision tool shall notify employees and candidates subject to the tool no less than ten business days before such use: (a) that an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate; (b) the job qualifications and characteristics that such automated employment decision tool will assess, what employee or candidate data or attributes the tool will use to conduct that assessment, and what kind of outputs the tool will produce as an evaluation of such employee or candidate; (c) what employee or candidate data is collected for the automated employment decision tool, the source of such data and the employer's data retention policy. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation; (d) the results of the most recent bias audit of the automated employment decision tool, including any findings of a disparate impact and associated response from the employer, or information about how to access that information if publicly available; (e) information about how an employee or candidate may request an alternative selection process or accommodation that does not involve the use of an automated employment decision tool; and (f) information about how the employee or candidate may (i) request internal review of the employment decision made by the automated employment decision tool in accordance with subdivision seven of this section and (ii) notification of the employee or candidate's right to file a complaint in a civil court in accordance with subdivision eight of this section.

This subdivision imposes detailed pre-use notification requirements on employers deploying automated employment decision tools. Employers must notify affected employees and candidates at least ten business days before the tool is used. The notice must cover six categories of information: (1) that an AEDT will be used, (2) the qualifications and characteristics the tool assesses, what data or attributes it uses, and what outputs it produces, (3) what data is collected and its source, along with the employer's data retention policy, (4) the most recent bias audit results, (5) how to request an alternative selection process or accommodation, and (6) information about internal reevaluation rights and the right to file a civil action.

The 10-business-day advance notice window and the requirement to disclose both the right to an alternative process and the right to judicial review are notably more prescriptive than NYC Local Law 144's notice provisions.

Compliance actions 1 item

Employers must notify employees and candidates at least 10 business days before using an automated employment decision tool, disclosing: (1) that an AEDT will be used, (2) the qualifications and characteristics assessed, data attributes used, and outputs produced, (3) data collected, its source, and the data retention policy, (4) the most recent bias audit results, (5) how to request an alternative selection process or accommodation, and (6) how to request internal review and the right to file a civil action.

H-01.1

Labor Law § 203-g(6)

AEDT: prohibited uses and human oversight

Deployer

(6)(a) 18 Notwithstanding the provisions of subdivision four of this section, an employer shall not, alone or in conjunction with an electronic monitoring tool, use an automated employment decision tool: (i) in such a manner that results in a violation of labor or employment law; (ii) in such a manner as to unduly intensify the conditions of work or to harm the health and safety of employees, including by setting unreasonable productivity quotas; (iii) to make predictions about an employee or candidate for employment's behavior, beliefs, intentions, personality, emotional state, or other characteristic or behavior; (iv) to predict, interfere with, restrain, or coerce employees engaging in activity protected under labor and employment law; (v) to implement a dynamic wage-setting system that pays employees different wages for the same work; (vi) to subtract from an employee's wages time spent exercising their legal rights; or (vii) that involves facial recognition, gait, or emotion recognition technologies.

(6)(b)–(b)(ii) 19 An employer shall not rely solely on output from an automated employment decision tool when making hiring, promotion, termination, disciplinary, or compensation decisions. (i) An employer shall establish meaningful human oversight of hiring, promotion, termination, disciplinary or compensation decisions assisted or replaced by automated employment decision tools. Meaningful human oversight requires: (A) the designation of an internal reviewer with sufficient expertise in the operation of automated employment decision tools, sufficient familiarity with the results of the most recent bias audit of the employer's tool, and sufficient understanding of the outputs of the employer's tool to identify potential errors, discrepancies, or inaccuracies produced by the tool; (B) that sufficient authority and discretion be granted to the designated internal reviewer to dispute, rerun, or recommend the rejection of an output suspected to be invalid, inaccurate, or discriminatory; and (C) that the designated internal reviewer has the time and resources available to review and evaluate the tool output in accordance with clause (B) of this subparagraph. (ii) An employer shall consider information other than automated employment decision tool outputs when making hiring, promotion, termination, disciplinary, or compensation decisions, such as supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

(6)(c) 20 An employer may not, where employees have union representation, refuse to bargain over the use of automated employment decision tools.

(6)(d) 21 An employer shall not require employees or candidates that apply for a position of employment to consent to the use of an automated employment decision tool in an employment decision in order to be considered for an employment decision, nor shall an employer discipline or disadvantage an employee or candidate for employment solely as a result of their request for accommodation.

This subdivision imposes two layers of restrictions on employer use of automated employment decision tools. First, it categorically prohibits AEDT use in seven contexts: violations of labor law, undue work intensification or safety harm (including unreasonable productivity quotas), behavioral/emotional/personality predictions about employees or candidates, interference with protected labor activity, dynamic wage-setting, automated wage-deduction for time spent exercising legal rights, and use of facial recognition, gait, or emotion recognition technologies.

Second, the subdivision requires meaningful human oversight of all employment decisions assisted by AEDTs. Employers must designate an internal reviewer with sufficient expertise in AEDT operation, familiarity with bias audit results, and understanding of tool outputs to identify errors or inaccuracies. The reviewer must have authority and discretion to dispute, rerun, or reject outputs, and must be given adequate time and resources. Employers must also consider non-AEDT information (supervisory evaluations, personnel files, work products, peer reviews) when making decisions. Employers may not require employees or candidates to consent to AEDT use as a condition of being considered for employment decisions, and must not discipline or disadvantage anyone for requesting accommodation.

Compliance actions 4 items

Employers must not use automated employment decision tools to violate labor law, unduly intensify work conditions or set unreasonable productivity quotas, make behavioral or emotional predictions about employees or candidates, interfere with protected labor activity, implement dynamic wage-setting paying different wages for the same work, deduct wages for time spent exercising legal rights, or employ facial recognition, gait, or emotion recognition technologies.

S-02

Employers must not rely solely on AEDT output for hiring, promotion, termination, disciplinary, or compensation decisions and must establish meaningful human oversight by designating an internal reviewer with (1) sufficient expertise in the AEDT's operation and bias audit results to identify errors, (2) authority and discretion to dispute, rerun, or reject suspected invalid, inaccurate, or discriminatory outputs, and (3) adequate time and resources. Employers must also consider non-AEDT information such as supervisory evaluations, personnel files, work products, or peer reviews.

H-01.6

Employers with union-represented employees must not refuse to bargain over the use of automated employment decision tools.

—

Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone solely for requesting accommodation from AEDT evaluation.

D-01.3

Labor Law § 203-g(7)

Internal reevaluation of AEDT-informed employment decisions

Deployer

(7)(a) 22 An employer shall offer employees and candidates a meaningful opportunity to request a reevaluation of the results of an employment decision made or assisted by an automated employment decision tool, if an employee or candidate believes or suspects that the decision resulted from inaccuracy, error, or bias in the tool, that the tool was used as the sole basis for the decision, or that the employer's use of the tool in some other way violates the provisions of this section, and the employee or candidate was meaningfully harmed by the outcome of the employment decision. An employee or candidate shall within thirty days of being notified of the employment decision provide the employer with a written request for reevaluation. Such written request shall include: (i) the person's name, the employment decision at issue, and how the person was harmed by the outcome of the employment decision; (ii) why the person believes or suspects the employment decision was informed by an inaccurate, erroneous, or biased output, was the result of an unlawful sole reliance on an automated employment decision tool, or otherwise violated the provisions of this section; (iii) any evidence that may support the person's belief or suspicion; and (iv) what reasonable remedial action the person would like the employer to take to investigate or remedy the believed or suspected harm, which may include providing the employee or candidate with outputs or documentation associated with the employment decision, providing the employee or candidate with documentation about the tool's most recent bias audit, or reprocessing the employee or candidate's data through the tool.

(7)(b) 23 An employer shall respond in writing to an employee or candidate's written request for reevaluation within sixty days of receipt of such request. Such written response shall include: (i) any employment decision tool outputs regarding the person purporting to be harmed by the employment decision that were used in the making of the employment decision; (ii) a description of the information other than the automated employment decision tool output that contributed to the employment decision; (iii) whether the employer agrees with the employee or candidate's belief or suspicion that the decision was informed by an inaccurate, erroneous, or biased tool or output, that the tool was the unlawful sole basis for the decision, or that the employer otherwise violated the provisions of this section in its use of the tool, and why or why not; (iv) if the employer disagrees with the employee or candidate's belief or suspicion, any evidence supporting the tool or output's accuracy and validity, the existence of meaningful human oversight, or the use of bases other than the tool in the making of the decision; (v) if the employee or candidate requested the reprocessing of their data through the tool, the results or outputs of that reprocessing, and whether the results of the reprocessing have changed the employer's employment decision, and why or why not; and (vi) if the employer refuses to take any reasonable remedial action requested by the employee or candidate, why they refuse to do so.

This subdivision establishes a structured internal reevaluation process for employees and candidates who believe they were harmed by an AEDT-informed employment decision. The process requires a written request within 30 days of the decision, specifying the harm, the basis for the belief that the decision was informed by inaccurate, erroneous, or biased output, supporting evidence, and the remedial action requested. The employer must respond in writing within 60 days, providing the AEDT outputs used, a description of non-AEDT information that contributed to the decision, the employer's assessment of the complaint, supporting evidence for the tool's validity if the employer disagrees, reprocessing results if requested, and an explanation for any refusal to take remedial action.

This reevaluation process is a prerequisite to the private right of action in subdivision 8 — an employee or candidate who does not receive a response or remains unsatisfied after reevaluation may then proceed to civil litigation.

Compliance actions 2 items

Employers must provide employees and candidates a meaningful opportunity to request reevaluation of AEDT-informed employment decisions within 30 days of the decision, where the individual believes the decision resulted from inaccuracy, error, bias, sole reliance on the tool, or other violation and was meaningfully harmed.

H-01.4

Employers must respond in writing within 60 days to reevaluation requests, providing the AEDT outputs used, a description of non-AEDT information that contributed to the decision, the employer's assessment of the complaint (with supporting evidence if disputed), reprocessing results if requested, and an explanation for any refusal to take remedial action.

H-01.1

Labor Law § 203-g(8)

Private right of action and joint liability

(8)(a) 24 If an employer fails to respond to an employee or candidate's request for reevaluation, or if the employee or candidate continues to have reason to believe they were harmed by the unlawful use of an inaccurate or biased automated employment decision tool or other violation of this section, the employee or candidate may initiate an action in a court of competent jurisdiction to enforce the provisions of this section. An employer that violates this section shall be liable for actual damages to any employee or candidate that has suffered damages due to such violation, reasonable attorneys' fees and costs, and, unless the employer proves a good faith basis to believe that its actions were in compliance with the law, one hundred percent of the total amount of actual damages, except such liquidated damages may be up to three hundred percent if found that the actions were willful.

(8)(b) 24 In any civil action claiming that an employer has violated this section in its use of electronic monitoring or automated employment decision tools, any person, employer, vendor, or other business entity that used, sold, distributed, or developed the tool shall be jointly and severally liable to a prevailing plaintiff for all damages awarded to that prevailing plaintiff, except that where a person, employer, vendor, or other business entity knowingly sells, provides, or distributes a tool to an employer with fewer than fifty employees, the vendor, not the small employer, shall be liable for any unlawful acts.

This subdivision creates a private right of action for employees and candidates who were harmed by an employer's unlawful use of electronic monitoring or automated employment decision tools. The action is available if the employer fails to respond to a reevaluation request or the individual continues to believe they were harmed. Remedies include actual damages, reasonable attorneys' fees and costs, and liquidated damages of 100% of actual damages (up to 300% if the violation was willful), unless the employer proves a good-faith compliance belief.

Notably, the subdivision imposes joint and several liability on any person, employer, vendor, or other business entity that used, sold, distributed, or developed the offending tool. An exception protects small employers with fewer than 50 employees where a vendor knowingly sold them the tool — in that case, the vendor bears sole liability.

Labor Law § 203-g(9)

Civil penalties

(9)(a)–(d) 25 Any person who violates any provision of this section or any rule promulgated pursuant to this section is liable for a civil penalty of not more than five hundred dollars for a first violation and each additional violation occurring on the same day as the first violation, and not less than five hundred dollars nor more than fifteen hundred dollars for each subsequent violation. (b) Each day on which an electronic monitoring tool or automated employment decision tool is used in violation of this section shall give rise to a separate violation of this section. (c) Failure to provide any notice to a candidate or an employee in violation of subdivision two or five of this section shall constitute a separate violation. (d) A proceeding to recover any civil penalty authorized by this section is returnable to any tribunal established within any agency designated to conduct such proceedings, or, in a city of over one million in population, such hearing may be held by a hearing officer employed within the office of administrative trials and hearings.

This subdivision establishes the civil penalty framework for violations of the section. A first violation (and each additional violation on the same day) carries a maximum penalty of $500. Subsequent violations carry penalties of $500–$1,500 each. Each day a tool is used in violation is a separate violation, and each failure to provide a required notice is a separate violation. Penalty proceedings are returnable to any agency-designated tribunal or, in cities over one million population, to the Office of Administrative Trials and Hearings.

Labor Law § 203-g(10)

Attorney General enforcement

(10) 26 10. The attorney general may initiate in a court of competent jurisdiction action that may be appropriate or necessary for correction of any violation of this section, including mandating compliance with the provisions of this section or such other relief as may be appropriate.

This subdivision grants the Attorney General authority to initiate enforcement actions in any court of competent jurisdiction to mandate compliance or obtain other appropriate relief for violations of the section.

Labor Law § 203-g(11)

Savings clause: Division of Human Rights authority

(11) 11. The provisions of this section shall not be construed as to limit the authority of the division of human rights to enforce the provisions of article fifteen of the executive law.

This subdivision is a savings clause preserving the authority of the Division of Human Rights to enforce Article 15 of the Executive Law (the New York Human Rights Law) independently of this section.

Section 2

Department of Labor rulemaking and public bias audit registry

(a)–(b) 27 The department of labor shall promulgate any rules and regulations necessary to implement the provisions of this section. (b) The department of labor shall within one hundred eighty days of this act becoming a law have established a means of collecting, storing, and making publicly available any bias audits or summaries of bias audits submitted by employers or vendors in the state. Such department shall promulgate rules and regulations by which employers, vendors, or employees may request the redaction of certain information from said bias audits or summaries thereof, if that information is proprietary, sensitive, or poses a threat to the privacy of employees or candidates.

Section 2 directs the Department of Labor to promulgate implementing rules and regulations and to establish, within 180 days of the act becoming law, a system for collecting, storing, and making publicly available bias audits or summaries submitted by employers or vendors. The department must also promulgate rules allowing employers, vendors, or employees to request redaction of proprietary, sensitive, or privacy-threatening information from published audits.

Civil Rights Law § 52-e

Conforming amendment: electronic monitoring notice requirements

28 Section 52-c of the civil rights law, as added by chapter 583 of the laws of 2021, is renumbered section 52-e and is amended to read as follows: § 52-e. Employers engaged in electronic monitoring; prior notice required. ... Such written notice shall comply with the requirements of subdivision two of section two hundred three-g of the labor law.

Section 3 of the bill renumbers Civil Rights Law § 52-c as § 52-e and amends it to require that the written notice to employees about electronic monitoring comply with the detailed notice requirements of Labor Law § 203-g(2). This conforming change aligns the existing Civil Rights Law electronic monitoring notice framework with the new Labor Law section. The existing enforcement mechanism (AG enforcement, penalties up to $500/$1,000/$3,000 for successive offenses) is retained.

Section 4

Effective date

This act shall take effect on the one hundred eightieth day after it shall have become a law.

The bill takes effect on the 180th day after it becomes law.

Safety Harmful content prevention · self-harm escalation

3 items

S-02

Data Controls Data sale restrictions · deidentification

8 items

D-01.4

D-01.1

D-01.4

D-01.1

D-01.4

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the prior written notice provided to employees.

D-01

D-01.4

D-01.3

Human Oversight Decision review · appeal pathways

10 items

H-01.6

Employers must not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

H-01.1

H-02.1

H-02.8

Employers must conduct or commission annual subsequent bias audits for each year the automated employment decision tool is in use, assessing and describing any change in validity or disparate impact.

H-02.1