Regulon — NY-AB-9315 · NY AB 9315 (Bossware & Automated Employment Decision Tools)

WHAT THIS BILL REGULATES · 6 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Dual enforcement. The Commissioner of Labor has authority to receive and investigate complaints, issue orders, and impose civil penalties. The Attorney General may initiate civil actions for injunctive and declaratory relief, damages, and civil penalties. Private right of action is available to current or former employees and candidates who were harmed by violations — an employee may sue after requesting reevaluation under § 1013, or if they continue to believe they were harmed by unlawful use of an inaccurate or biased tool or other violation. Vendors, developers, and employers are jointly and severally liable. No cure period.

Private Right of Action

Private right of action is available to current or former employees and candidates who were harmed by violations — an employee may sue after requesting reevaluation under § 1013, or if they continue to believe they were harmed by unlawful use of an inaccurate or biased tool or other violation.

Penalties

Liquidated damages of $500 per violation; where actual damages are suffered, the greater of liquidated damages or two times actual damages (including back pay, front pay, lost benefits, and emotional distress). Willful violations increase liquidated damages to the greater of $1,000 per violation or three times actual damages. Each day of unlawful tool use is a separate violation. Failure to provide required notices to each employee or candidate is a separate violation. Injunctive and declaratory relief available. Reasonable attorneys' fees and costs recoverable. Civil penalties may also be imposed by the Commissioner or ordered by the Attorney General. Vendors, employers, developers, and other entities that used, sold, distributed, or developed the tool are jointly and severally liable, except that for employers with fewer than 15 employees, the vendor bears sole liability for unlawful acts where the vendor knowingly provided the tool.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Labor Law § 1010

Definitions

§ 1010. Definitions. For the purposes of this section, the following terms have the following meanings: 1. "Aggregated employee data" means employee data that an employer has combined, or collected together, in a summary or other form so that the employee data cannot be identified with any specific employee. 2. "Automated employment decision tool" means any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods that issues an output, including a score, classification, ranking, or recommendation, that is used to assist or replace human decision making on employment decisions that impact natural persons. "Automated employment decision tool" does not include a tool that does not assist or replace employment decision processes and that does not materially impact natural persons, including, but not limited to, a junk email filter, firewall, antivirus software, calculator, spreadsheet, database, data set, or other compilation of data. 3. "Candidate" means any natural person or their authorized representative seeking employment through an application, or who is screened or evaluated for recruitment, for a position of employment by a business operating in the state. 4. "Continuous incremental time-tracking tool" means any system, application or instrument that continuously measures, records and/or tallies increments of time within a day during which an employee is or is not doing a particular activity or set of activities. 5. "Electronic monitoring tool" means any system, application, or instrument that facilitates the collection of data concerning worker activities or communications by any means other than direct observation by a natural person, including but not limited to the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic, or photo-optical system. 6. "Egregious misconduct" means deliberate or grossly negligent conduct that endangers the safety or well-being of the individual, co-workers, customers, or other persons, or that causes serious damage to the employer's or customers' property or business interests, including discrimination against or harassment of co-workers, customers, or other persons or violations of the law. 7. "Employer" means any person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker, including the state, county, town, city, school district, public authority or other governmental subdivision of any kind. "Employer" includes any of the employer's agents, contractors, or subcontractors. 8. "Employee" means any natural person or their authorized representative acting for, employed by, or a person classified as an independent contractor providing service to, or through, an employer operating in the state. An employee shall be deemed to be operating in the state for purposes of deeming an employee to be covered by this article if the employee works at least part time at a location in the state, or if fully remote, the employee is associated with an office in the state or supervised by a person who works at least part time at a location in the state. Employee can mean a former employee. 9. "Employee data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular employee, regardless of how the information is collected, inferred, or obtained. 10. "Employment decision" means any decision made by the employer that affects wages, benefits, other compensation, hours, work schedule, performance evaluation, hiring, selecting for recruitment, discipline, promotion, termination, job content, assignment of work, access to work opportunities, productivity requirements, workplace health and safety, and other terms or conditions of employment. 11. "Impact assessment" means an impartial evaluation by an independent auditor that complies with section one thousand twelve of this article. 12. "Independent auditor" means a person or entity that conducts an impact assessment of an automated employment decision tool in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment. 13. "Meaningful human oversight" means a process that includes, at a minimum: (a) the designation of an internal reviewer with sufficient expertise; (b) that sufficient authority and discretion be granted to the designated internal reviewer to dispute, rerun, or recommend the rejection of an output suspected to be invalid, inaccurate, or discriminatory; and (c) that the designated internal reviewer has the time and resources available to review and evaluate the tool output. 14. "Periodic assessment of worker performance" means assessing worker performance over the course of units of time equal to or greater than one calendar day. 15. "Protected class" means a class enumerated in section two hundred ninety-six of the executive law. 16. "Vendor" means any person or entity who sells, distributes, or develops for sale an automated employment decision tool to be used in an employment decision made by an employer in the state.

Section 1010 establishes the definitions that govern the entire article. Key terms include electronic monitoring tool (any system collecting worker data by means other than direct human observation), automated employment decision tool (any AI/ML system issuing outputs used to assist or replace human employment decisions), employer (broadly defined to include government entities, agents, contractors, and subcontractors), and vendor (any person selling, distributing, or developing AEDTs for employer use). The definition of employee extends to independent contractors and former employees and covers remote workers supervised from New York. Meaningful human oversight is defined with specificity — requiring a designated internal reviewer with expertise, authority to override tool outputs, and adequate time and resources.

Labor Law § 1011

Electronic monitoring tools

Deployer

1(a) 1 It shall be unlawful for an employer to use an electronic monitoring tool to collect employee data unless: (i) the electronic monitoring tool is primarily used to accomplish any of the following purposes: (A) allowing a worker to accomplish an essential job function; (B) ensuring the quality of goods and services; (C) periodic assessment of worker performance; (D) ensuring compliance with employment, labor, or other relevant laws; (E) protecting the health, safety, or security of workers, or the security of the employer's facilities or computer networks; (F) administering wages and benefits; or (G) additional purposes to enable business operations as determined by the department; (ii) the specific type of electronic monitoring tool is strictly necessary to accomplish the purpose, exclusively used to accomplish the purpose, and is the least invasive means to the employee that could reasonably be used to accomplish the purpose; and (iii) the specific form of electronic monitoring is limited to the smallest number of workers, collects the least amount of data and is collected no more frequently than is necessary to accomplish the purpose, and the data collected is deleted once the purpose has been achieved.

1(b) 2 Any employer that uses an electronic monitoring tool shall give prior written notice to all candidates and employees subject to electronic monitoring and post said notice in a conspicuous place which is readily available for viewing by candidates and employees, pursuant to subdivision two of section fifty-two-e of the civil rights law. Such notice shall include, at a minimum, the following: (i) a description of the purpose for which the electronic monitoring tool will be used, as specified in subparagraph (i) of paragraph (a) of this subdivision; (ii) a description of the specific employee data to be collected, and the activities, locations, communications, and job roles that will be electronically monitored by the tool; (iii) a description of the dates, times, and frequency that electronic monitoring will occur; (iv) whether and how any employee data collected by the electronic monitoring tool will be used as an input in an automated employment decision tool; (v) whether and how any employee data collected by the electronic monitoring tool will alone or in conjunction with an automated employment decision tool be used to make an employment decision by the employer or employment agency; (vi) whether any employee data collected by the electronic monitoring tool will be used to assess employees' productivity performance or to set productivity standards, and if so, how; (vii) a description of where any employee data collected by the electronic monitoring tool will be stored and the length of time it will be retained; and (viii) an explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the monitoring purpose.

1(c) 3 An employer shall establish, maintain, and preserve for three years contemporaneous, true, and accurate records of data collected via an electronic monitoring tool to ensure compliance with employee or commissioner requests for data. The employer shall destroy any employee data collected via an electronic monitoring tool no later than thirty-seven months after collection unless the employee has provided written and informed consent to the retention of their data by the employer.

1(d) 2 Notice of the specific form of electronic monitoring shall: (i) be written in clear and plain language; (ii) be provided to each employee, in the language identified by each employee as the primary language of such employee, at the time of hiring and at least annually thereafter; (iii) be posted in a clear and conspicuous location in English and in any other language that the employer regularly uses to communicate with employees; (iv) be made available in formats that are accessible to employees who are blind or have other disabilities; (v) provide the worker with actual notice of electronic monitoring activities. A notice that states electronic monitoring "may" take place or that the employer "reserves the right" to monitor shall not be considered actual notice of electronic monitoring activities; and (vi) be otherwise presented in a manner that ensures the notice clearly and effectively communicates the required information to employees.

1(e) 4 An employer who engages in random or periodic electronic monitoring of employees shall inform the affected employees of the specific events which are being monitored at the time the monitoring takes place. Notice shall be clear and conspicuous. (ii) Notice of random or periodic electronic monitoring may be given after electronic monitoring has occurred only if necessary to preserve the integrity of an investigation of illegal activity or protect the immediate safety of employees, customers, or the public.

2(a)(i)–(ix) 5 2. (a) Notwithstanding the allowable purposes for electronic monitoring described in paragraph (a) of subdivision one of this section, an employer shall not: (i) use an electronic monitoring tool in such a manner that results in a violation of labor, employment, civil rights, or human rights law or any other law of this state; (ii) use an electronic monitoring tool or data collected via an electronic monitoring tool in such a manner as to threaten the health, welfare, safety, or legal rights of employees or the general public; (iii) use an electronic monitoring tool to monitor employees who are off-duty and not performing work-related tasks; (iv) use an electronic monitoring tool in order to obtain information about an employee's health, protected-class status, or membership in any group protected from employment discrimination under section two hundred ninety-six of the executive law or any other applicable law; (v) use an electronic monitoring tool in order to identify, punish, or obtain information about employees engaging in activity protected under labor or employment law; (vi) conduct audio or visual monitoring of bathrooms or other similarly private areas, including locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, areas designated to express breast milk, or areas designated for prayer or other religious activity, including data collection on the frequency of use of those private areas; (vii) conduct audio or visual monitoring of a workplace in an employee's residence, an employee's personal vehicle, or property owned or leased by an employee; (viii) use an electronic monitoring tool that incorporates facial recognition, gait, voice analysis, or emotion recognition technology; (ix) take adverse action against an employee based in whole or in part on their opposition or refusal to submit to a practice that the employee believes in good faith violates this article.

2(a)(x)–(xii) 6 take adverse employment action against an employee on the basis of data collected via continuous incremental time-tracking tools except in the case of egregious misconduct; (xi) take adverse employment action against an employee based on any data collected via electronic monitoring if such data measures an employee's performance in relation to a performance standard that has not been previously disclosed to such employee in violation of subparagraph (vi) of paragraph (b) of subdivision one of this section, or if such data was collected without proper notice to employees or candidates pursuant to section fifty-two-e of the civil rights law; or (xii) where employees have union representation and where not preempted by federal law, refuse to bargain over the implementation, use, and ongoing evaluation of electronic monitoring tools.

2(b) 7 An employer shall not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided pursuant to paragraph (b) of subdivision one of this section.

2(c) 8 An employer shall not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless it is required to do so under state or federal law, or necessary to do so to comply with an impact assessment of an automated employment decision tool pursuant to section one thousand twelve of this article.

2(d) 9 An employer shall not require employees to: (i) physically implant devices that collect or transmit data, including devices that are installed subcutaneously or incorporated into items of clothing or personal accessories; (ii) install applications on personal devices that collect or transmit employee data or to wear or embed those devices; or (iii) carry or use any device with location tracking applications or services enabled unless the location tracking is: (A) conducted during work hours; and (B) strictly necessary to accomplish essential job functions and narrowly limited to only the activities and times necessary to accomplish essential job functions.

2(e) 10 An employer shall not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions. For an employer to satisfy the requirements of this paragraph: (i) An employer must establish meaningful human oversight of such decisions based in whole or part on data collected through electronic monitoring. (ii) A human decision-maker must actually review any information collected through electronic monitoring, verify that such information is accurate and up to date, review any pending employee requests to correct erroneous data, and exercise independent judgment in making each such decision; and (iii) The human decision-maker must consider information other than information collected through electronic monitoring when making each such decision, such as but not limited to supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

2(f) 11 When an employer makes a hiring, promotion, termination, disciplinary or compensation decision based in whole or part on data gathered through the use of electronic monitoring, it shall disclose to affected employees at least fourteen days prior to the decision going into effect: (i) that the decision was based in whole or part based on data gathered through electronic monitoring; (ii) the specific electronic monitoring tool or tools used to gather such data; (iii) the specific data, and judgments based upon such data, used in the decision-making process; and (iv) any information used in the decision-making process gathered through sources other than electronic monitoring.

Section 1011 establishes the framework governing employer use of electronic monitoring tools. Subdivision 1(a) restricts monitoring to seven enumerated purposes and imposes a triple necessity test: the monitoring tool must be primarily used for an allowable purpose, strictly necessary and least invasive for that purpose, and limited to the smallest number of workers with the least data collected. Subdivision 1(b) requires detailed advance written notice to employees covering the monitoring purpose, data collected, frequency, relationship to AEDTs, use for productivity standards, storage, and least-invasiveness justification. Subdivision 1(c) requires three-year recordkeeping with a 37-month maximum retention cap absent employee consent. Subdivision 1(d) prescribes detailed formatting and accessibility requirements for notices. Subdivision 1(e) requires real-time notice when random or periodic monitoring occurs.

Subdivision 2 sets out categorical prohibitions: employers may not use monitoring to violate other laws, threaten employee health or safety, monitor off-duty employees, obtain protected-class or health information, identify employees engaging in protected activity, monitor private areas (bathrooms, locker rooms, breakrooms, prayer areas), monitor employee residences or vehicles, or use facial recognition, gait analysis, voice analysis, or emotion recognition technology. Additional restrictions prohibit selling or transferring monitoring data, requiring implanted devices or personal-device applications, relying primarily on monitored data for consequential employment decisions without meaningful human oversight, and failing to disclose to employees when monitoring data influenced an employment decision.

Compliance actions 11 items

Employers must limit use of electronic monitoring tools to seven enumerated purposes and must ensure the specific tool is strictly necessary, exclusively used for that purpose, the least invasive means available, limited to the smallest number of workers, and that data is collected no more frequently than necessary and deleted once the purpose is achieved.

D-01.4

Employers must provide prior written notice to all employees and candidates subject to electronic monitoring, including the monitoring purpose, specific data collected, activities and locations monitored, monitoring schedule, relationship to AEDT inputs, use for productivity standards, data storage location and retention period, and least-invasiveness justification. Notice must be in plain language, provided at hiring and annually, posted conspicuously, accessible to employees with disabilities, and provided in the employee's primary language. A notice that monitoring 'may' take place or that the employer 'reserves the right' to monitor is not actual notice.

H-01.3

Employers must establish, maintain, and preserve for three years contemporaneous, true, and accurate records of all data collected via electronic monitoring tools to ensure compliance with employee and commissioner data requests. Employers must destroy monitoring data no later than 37 months after collection unless the employee provides written, informed consent to continued retention.

G-01.3

Employers engaging in random or periodic electronic monitoring must inform affected employees of the specific events being monitored at the time monitoring takes place. Notice may be given after monitoring only if necessary to preserve the integrity of an investigation of illegal activity or to protect the immediate safety of employees, customers, or the public.

H-01.3

Employers must not use electronic monitoring tools in a manner that violates any state law; threatens employee health, welfare, safety, or legal rights; monitors off-duty employees; obtains information about health or protected-class status; identifies or punishes employees engaging in protected labor activity; conducts audio or visual monitoring of private areas (bathrooms, locker rooms, breakrooms, prayer areas, lactation rooms); monitors employee residences, personal vehicles, or employee-owned property; or uses facial recognition, gait analysis, voice analysis, or emotion recognition technology. Employers must not take adverse action against employees for opposing practices they reasonably believe violate this article.

S-02.2

Employers must not take adverse employment action based on continuous incremental time-tracking data except in cases of egregious misconduct. Employers must not take adverse action based on monitoring data measuring performance against an undisclosed standard or data collected without proper notice. Employers with union-represented employees must, where not preempted by federal law, bargain over the implementation, use, and ongoing evaluation of electronic monitoring tools.

S-02

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the notice provided to employees.

D-01.4

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any other entity unless required by state or federal law or necessary to comply with an AEDT impact assessment under § 1012.

D-01.4

Employers must not require employees to physically implant data-collecting devices, install monitoring applications on personal devices, or carry devices with location tracking unless tracking is conducted during work hours and strictly necessary for essential job functions.

S-02

Employers must not rely primarily on electronic monitoring data when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight — including a designated internal reviewer with expertise, authority to dispute or reject outputs, and adequate time and resources — who must actually review monitoring data for accuracy, check pending correction requests, exercise independent judgment, and consider non-monitoring information in making each decision.

H-01.6

Employers must disclose to affected employees at least 14 days before an employment decision takes effect that the decision was based in whole or part on electronic monitoring data, identify the specific monitoring tools used, disclose the specific data and judgments used in the decision, and identify any non-monitoring information used.

H-01.1

Labor Law § 1012

Automated employment decision tools

DeployerDeveloper

1(a) 12 It shall be unlawful for an employer to use an automated employment decision tool for an employment decision unless such tool has been the subject of an impact assessment. Impact assessments for automated employment decision tools must: (i) be conducted no more than one year prior to the use of such tool, or where the tool was in use by the employer before the effective date of this article, within six months of the effective date of this article; (ii) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (iii) identify and describe the attributes and modeling techniques that the tool uses to produce outputs; (iv) evaluate whether those attributes and techniques are a scientifically valid means of evaluating an employee or candidate's performance or ability to perform the essential functions of a role, and whether those attributes may function as a proxy for belonging to a protected class; (v) consider, identify, and describe any disparities in the data used to train or develop the tool and describe how those disparities may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy any disparate impact; (vi) consider, identify, and describe any outputs produced by the tool that may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy that disparate impact; (vii) evaluate whether the use of the tool may limit accessibility for persons with disabilities, or for persons with any specific disability, and what actions may be taken by the employer or vendor of the tool to reduce or remedy the concern; (viii) consider and describe potential sources of adverse impact against protected classes that may arise after the tool is deployed; (ix) identify and describe any other assessment of risks of discrimination or a disparate impact of the tool on members of a protected class that arise over the course of the impact assessment, and what actions may be taken to reduce or remedy that risk; (x) for any finding of a disparate impact or limit on accessibility, evaluate whether the data set, attribute, or feature of the tool at issue is the least discriminatory method of assessing a candidate's performance or ability to perform job functions; and (xi) be submitted in its entirety or an accessible summary form to the department for inclusion in a public registry of such impact assessments within sixty days of completion and distributed to employees who may be subject to the tool.

1(b) 13 An employer shall conduct or commission subsequent impact assessments each year that the tool is in use to assist or replace employment decisions. Subsequent impact assessments shall comply with the requirements of paragraph (a) of this subdivision, and shall assess and describe any change in the validity or disparate impact of the tool.

1(c) 14 An employer or vendor shall retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool that may be necessary to conduct an impact assessment. This includes but is not limited to the source of the data used to develop the tool, the technical specifications of the tool, individuals involved in the development of the tool, and historical use data for the tool. Such documentation must include a historical record of versions of the tool, such that an employer shall be able to attest in the event of litigation disputing an employment decision, the nature and specifications of the tool as it was used at the time of that employment decision. Such documentation shall be stored in accordance with such recordkeeping, data retention, and security requirements as the commissioner may specify, and in such a manner as to be legible and accessible to the party conducting an impact assessment.

1(d) 15 If an initial or subsequent impact assessment requires the collection of employee data to assess a tool's disparate impact on employees, such data shall be collected, processed, stored, and retained in such a manner as to protect the privacy of employees, and shall comply with any data retention and security requirements specified by the commissioner. Employee data provided to auditors for the purpose of an impact assessment shall not be shared with the employer, nor shall it be shared with any person, business entity, or other organization unless strictly necessary for the completion of the impact assessment.

1(e) 16 If an initial or subsequent impact assessment concludes that a data set, feature, or application of the automated employment decision tool results in a disparate impact on persons belonging to a protected class, or unlawfully limits accessibility for persons with disabilities, an employer shall refrain from using the tool until it: (i) takes reasonable and appropriate steps to remedy that disparate impact or limit on accessibility and describe in writing to employees, the auditor, and the department what steps were taken; and (ii) if the employer believes the impact assessment finding of a disparate impact or limit on accessibility is erroneous, or that the steps taken in accordance with subparagraph (i) of this paragraph sufficiently address those findings such that the tool may be lawfully used in accordance with this article, describes in writing to employees, the auditor, and the department how the data set, feature, or application of the tool is the least discriminatory method of assessing an employee's performance or ability to complete essential functions of a position.

1(f) 17 It shall be unlawful for an independent auditor, vendor, or employer to manipulate, conceal, or misrepresent the results of an impact assessment.

1(g) Nothing in this article shall be construed as prohibiting an employer from implementing a lawful affirmative action plan or engaging in otherwise lawful efforts to reduce or eliminate bias in employment decisions.

2(a) 18 2. (a) Any employer that uses an automated employment decision tool to assess or evaluate an employee or candidate shall notify employees and candidates subject to the tool no less than ten business days before such use: (i) that an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate; (ii) the job qualifications and characteristics that such automated employment decision tool will assess, what employee or candidate data or attributes the tool will use to conduct that assessment, and what kind of outputs the tool will produce as an evaluation of such employee or candidate; (iii) what employee or candidate data is collected for the automated employment decision tool, the source of such data and the employer's data retention policy. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation; (iv) the results of the most recent impact assessment of the automated employment decision tool, including any findings of a disparate impact and associated response from the employer, or information about how to access that information if publicly available; (v) information about how an employee or candidate may request an alternative selection process or accommodation that does not involve the use of an automated employment decision tool and details about that alternative process or accommodation process; and (vi) information about how the employee or candidate may: (A) request reevaluation of the employment decision made by the automated employment decision tool in accordance with section one thousand thirteen of this article; and (B) notification of the employee or candidate's right to file a complaint in a civil court in accordance with section one thousand fifteen of this article.

2(b) 18 The notice required by this subdivision shall be: (i) written in clear and plain language; (ii) included in each job posting or advertisement for each position for which the automated employment decision tool will be used; (iii) posted on the employer's website in any language that the employer regularly uses to communicate with employees; (iv) provided directly to each candidate who applies for a position in the language with which that candidate communicates with the employer; (v) made available in formats that are accessible to employees who are blind or have other disabilities; and (vi) otherwise presented in a manner that ensures the notice clearly and effectively communicates the required information to employees.

3(a) 19 3. (a) Notwithstanding the provisions of subdivision one of this section, an employer shall not, alone or in conjunction with an electronic monitoring tool, use an automated employment decision tool: (i) in such a manner that results in a violation of labor, employment, civil rights or human rights law or any other law of this state; (ii) in a manner that harms or is likely to harm the health or safety of employees, including by setting productivity quotas in a manner that is likely to cause physical or mental illness or injury; (iii) to make predictions about an employee or candidate for employment's behavior, beliefs, intentions, personality, emotional state, or other characteristic or behavior; (iv) to predict, interfere with, restrain, or coerce employees engaging in activity protected under labor and employment law; (v) to subtract from an employee's wages time spent exercising their legal rights; (vi) in a manner not consistent with the scope of the impact assessment required by subdivision one of this section; or (vii) that involves facial recognition, gait, or emotion recognition technologies.

3(b) 20 An employer shall not rely primarily on output from an automated employment decision tool when making hiring, promotion, termination, disciplinary, or compensation decisions. For an employer to satisfy the requirements of this paragraph: (i) An employer must establish meaningful human oversight of such decisions based in whole or in part on the output of automated employment decision tools. (ii) A human decision-maker must actually review any output of an automated employment decision tool and exercise independent judgment in making each such decision; (iii) The human decision-maker must consider information other than automated employment decision tool outputs when making each such decision, such as but not limited to supervisory or managerial evaluations, personnel files, employee work products, or peer reviews; and (iv) An employer shall consider information other than automated employment decision tool outputs when making hiring, promotion, termination, disciplinary, or compensation decisions, such as supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

3(c)–(d) 21 An employer may not, where employees have union representation and where not preempted by federal law, refuse to bargain over the use of automated employment decision tools. (d) An employer shall not require employees or candidates to consent to the use of an automated employment decision tool in an employment decision in order to be considered for an employment decision, nor shall an employer discipline or disadvantage an employee or candidate for employment as a result of their request for accommodation.

Section 1012 establishes the bill's core AEDT regulatory framework. Subdivision 1 prohibits employers from using any AEDT unless it has been the subject of an independent impact assessment conducted within the past year (or six months of the effective date for tools already in use). The impact assessment must evaluate scientific validity, proxy-variable risk, training-data disparities, output-level disparate impact, disability accessibility, and post-deployment discrimination risk — and must be submitted to the Department of Labor for inclusion in a public registry. Employers must retain comprehensive historical documentation of tool design, development, and use sufficient to reconstruct the tool's state at the time of any disputed employment decision.

Subdivision 2 requires employers to provide detailed notice to employees and candidates at least ten business days before AEDT use, covering what the tool assesses, what data it uses, what outputs it produces, impact assessment results, how to request an alternative process, and how to seek reevaluation. Subdivision 3 imposes categorical prohibitions: AEDTs may not be used to violate any state law, endanger employee health or safety, predict employee behavior or emotional states, interfere with protected labor activity, deduct wages for exercising legal rights, or operate outside the scope of the impact assessment. Facial recognition, gait, and emotion recognition technologies are prohibited in AEDTs. Employers must provide meaningful human oversight for consequential AEDT-informed decisions, must bargain over AEDT use with unionized workers, and must not condition employment consideration on consent to AEDT use.

Compliance actions 10 items

Employers must not use any AEDT unless it has been the subject of an impact assessment conducted by an independent auditor within the past year (or within six months of the effective date for pre-existing tools). The assessment must evaluate the tool's attributes and modeling techniques for scientific validity, proxy-variable risk across protected classes, training-data disparities, output-level disparate impact, disability accessibility, post-deployment discrimination risk, and least-discriminatory-method analysis. The completed assessment or an accessible summary must be submitted to the Department of Labor for inclusion in a public registry within 60 days and distributed to affected employees.

H-02.1

Employers must conduct or commission subsequent impact assessments annually for each year the AEDT remains in use, complying with all requirements of the initial assessment and additionally assessing any change in the tool's validity or disparate impact.

H-02.8

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of each AEDT — including training data sources, technical specifications, developer identities, historical use data, and a historical record of tool versions — sufficient to reconstruct the tool's state at the time of any disputed employment decision. Documentation must be stored per commissioner-specified requirements and be legible and accessible to auditors conducting impact assessments.

G-01.3

Employee data collected for impact assessments must be collected, processed, stored, and retained in a manner protecting employee privacy and in compliance with commissioner-specified security requirements. Data provided to auditors must not be shared with the employer or any other entity unless strictly necessary for the impact assessment.

D-01.4

Employers must immediately cease using any AEDT found by an impact assessment to cause disparate impact on a protected class or unlawfully limit disability accessibility, and may not resume use until (1) the employer takes reasonable steps to remedy the disparate impact or accessibility limitation and describes those steps in writing to employees, the auditor, and the Department, and (2) if the employer contests the finding, it describes in writing how the tool is the least discriminatory method of assessing the relevant performance criteria.

H-02.3

Independent auditors, vendors, and employers must not manipulate, conceal, or misrepresent the results of an impact assessment.

H-02

Employers must notify employees and candidates at least ten business days before using an AEDT to assess or evaluate them, disclosing: (1) that an AEDT will be used, (2) the qualifications and characteristics assessed, data attributes used, and outputs produced, (3) what data is collected and from what source, along with the data retention policy, (4) results of the most recent impact assessment including any disparate impact findings, (5) how to request an alternative non-AEDT selection process or accommodation, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website, provided to each candidate in their language, and accessible to employees with disabilities.

H-01.1

Employers must not use an AEDT to violate any state law; harm or likely harm employee health or safety (including through unsafe productivity quotas); make predictions about employee behavior, beliefs, intentions, personality, or emotional state; predict or interfere with protected labor activity; subtract wages for time spent exercising legal rights; operate outside the scope of the impact assessment; or use facial recognition, gait, or emotion recognition technologies.

S-02.1

Employers must not rely primarily on AEDT output when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight — a human decision-maker must actually review any AEDT output, exercise independent judgment, and consider non-AEDT information (such as supervisory evaluations, personnel files, employee work products, or peer reviews) in making each decision.

H-01.6

Employers must, where employees have union representation and where not preempted by federal law, bargain over the use of AEDTs. Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage any employee or candidate who requests an accommodation from AEDT use.

S-02

Labor Law § 1013

Data access and accuracy

Deployer

1(a)–(d) 22 1.(a) An employer shall ensure that any data collected through electronic monitoring that may be used for the purposes of an employment decision is accurate and, where relevant, kept up to date. (b) A current or former employee whose data was collected by their employer through electronic monitoring has the right to request a copy of the employee's own data, and a copy of the aggregated employee data for similar employees at the same establishment for the same time period, if that data may be or was used for the purposes of an employment decision. A former employee is limited to one request per year pursuant to this subdivision. (c) An employer that receives a written or oral request for information pursuant to this section shall comply with the request as soon as practicable, but no later than seven calendar days from the date of the request. An employer shall not take adverse action against an employee based on their request for their own or aggregated employee data, nor shall an employer provide those records at a cost to the current or former employee. An employer shall provide information pursuant to this section in English or, if applicable in the language identified by the employee as the primary language of such employee. (d) An employer that does not monitor this data has no obligation to provide it.

2(a)–(d) 23 2. (a) An employer that uses electronic monitoring to collect employee data to assist in an employment decision must provide employees with the opportunity to review and request correction of such data both at the time of its collection and after. (b) An employer that receives an employee request to correct inaccurate data collected through electronic monitoring shall investigate and determine whether such data is inaccurate. (c) If an employer, upon investigation, determines that such data is inaccurate, the employer shall: (i) promptly correct the inaccurate data and inform the employee of the employer's decision and action; (ii) review and adjust, as appropriate, any employment decisions that were based on the inaccurate data and inform the employee of the adjustment; and (iii) inform any third parties with which the employer shared the inaccurate data, or from which the employer received the inaccurate data, and direct them to correct it, and provide the employee with a copy of such action. (d) If an employer, upon investigation, determines that the data is accurate, the employer shall inform the employee of the decision not to amend the data, the steps taken to verify the accuracy of the data, and any evidence supporting the decision not to amend the data.

3(a) 24 3. (a) An employer that uses data collected via an electronic monitoring tool or outputs from an automated employment decision tool to make an employment decision shall provide employees affected by such action written notice of the decision at least fourteen calendar days before such action shall take effect. Such notice of adverse employment action shall contain: (i) any performance standards used to make the employment decision; (ii) any of the employee's data collected through electronic monitoring that was used to make the employment decision; (iii) any aggregated employee data of employees performing the same or similar functions at the same establishments for ninety days prior to the employment decision; (iv) any outputs from an automated employment decision tool that was used to make the employment decision; (v) a copy of the most recent impact assessment of any automated employment decision tool that was used to make the employment decision; and (vi) what other information, standards, or data, other than data collected via electronic monitoring or outputs produced by automated employment decision tools, was used by the employer to make the employment decision.

3(b)–(c) 25 An employee subject to an employment decision based on data collected via an electronic monitoring tool or outputs from an automated employment decision tool who believes the employment decision to be the result of inaccurate data or an inaccurate or erroneous output by an automated employment decision tool may request a reevaluation of the decision by the employer. Such request shall be in writing, including by text message or electronic mail, and shall include at a minimum: (i) the employee's name; (ii) the data or output the employee alleges is inaccurate or erroneous; and (iii) any evidence the employee has that such data or output is inaccurate or erroneous. (c) An employer that receives a request for reevaluation of an employment decision pursuant to this section shall investigate the employee's claim of inaccurate or erroneous information and respond to the employee as soon as practicable, but no later than seven calendar days from the date of the request. If an employer, upon investigation, concludes that no inaccurate data or erroneous output was used to make the employment decision, it shall provide the employee with evidence of such accuracy and validity. If an employer, upon investigation, concludes that inaccurate data or an erroneous output did contribute to the employment decision, the employer shall inform the employee in writing of such error or inaccuracy and take action to reevaluate the employee with corrected data or without the use of an automated employment decision tool.

Section 1013 creates a comprehensive set of employee data rights applicable to both electronic monitoring data and AEDT outputs. Subdivision 1 establishes rights to data accuracy and access: employers must ensure monitoring data used for employment decisions is accurate and current, and current or former employees may request copies of their own data and aggregated data for similarly situated employees. Requests must be fulfilled within seven calendar days at no cost. Subdivision 2 creates a data correction framework requiring employers to provide opportunities to review and request correction of monitoring data, investigate correction requests, and if data is found inaccurate, correct it, adjust affected employment decisions, and notify third parties. Subdivision 3 establishes a 14-day advance notice requirement before any employment decision based on monitoring data or AEDT outputs takes effect, with detailed disclosure of the data, standards, tool outputs, and impact assessments used, and creates a formal reevaluation process for employees who believe they were harmed by inaccurate data or erroneous AEDT output.

Compliance actions 4 items

Employers must ensure electronic monitoring data used in employment decisions is accurate and current. Current and former employees have the right to request a copy of their own monitoring data and aggregated data for similarly situated employees, at no cost, within seven calendar days of request. Former employees may make one request per year. Employers must not retaliate against employees for exercising data access rights. Information must be provided in the employee's primary language.

D-01.1

Employers must provide employees the opportunity to review and request correction of electronic monitoring data used in employment decisions, both at the time of collection and after. Upon receiving a correction request, employers must investigate and, if data is inaccurate, promptly correct it, adjust any affected employment decisions, and notify third parties who received the inaccurate data. If data is found accurate, employers must explain the verification steps and supporting evidence.

D-01.2

Employers must provide affected employees written notice at least 14 calendar days before any employment decision based on monitoring data or AEDT outputs takes effect, disclosing: (1) performance standards used, (2) the employee's monitoring data used, (3) aggregated data for similarly situated employees for the prior 90 days, (4) any AEDT outputs used, (5) the most recent impact assessment of any AEDT used, and (6) any other information used in the decision.

H-01.1

Employees who believe an employment decision resulted from inaccurate monitoring data or an erroneous AEDT output may request reevaluation in writing. Employers must investigate and respond within seven calendar days. If inaccuracy is confirmed, the employer must inform the employee in writing and reevaluate using corrected data or without the AEDT. If the employer finds no inaccuracy, it must provide the employee with evidence of accuracy and validity.

H-01.4

Labor Law § 1014

Retaliation prohibited

Deployer

1–3 26 § 1014. Retaliation prohibited. 1. It shall be unlawful for a person to take any retaliatory action, as defined in section seven hundred forty of the this chapter, against any employee or candidate because: (a) such employee or candidate opposes or discloses, or threatens to disclose to a supervisor, hiring manager, or public body an activity, policy or practice of the employer or vendor that the employee or candidate reasonably believes is in violation of this article, or any rule or regulation issued pursuant to this article; (b) such employee or candidate provides information to, or testifies before, any public body conducting an investigation, hearing or inquiry into any such activity, policy or practice by such employer or vendor, or otherwise participates in such investigation, hearing, or inquiry; (c) such employee or candidate objects to, or refuses to participate in any such activity, policy or practice; (d) such employee or candidate exercises their rights protected under this section or informs others of such rights; or (e) such person believes that the employee or candidate engaged in any of the activities described in paragraphs (a), (b), (c) or (d) of this subdivision. 2. A candidate or employee need not make explicit reference to any section or provision of this article or of any provision of this chapter or human rights law to trigger the protections of this section. 3. An employer or other person violates this section where the employee's protected activity is found to be a contributing factor for the adverse action. Where the commissioner or a court finds an employer or other person has violated this section, it may order the relief specified in section two hundred fifteen of the this chapter.

Section 1014 establishes broad anti-retaliation protections for employees and candidates who oppose, disclose, or threaten to disclose violations of the article, participate in investigations, refuse to participate in violative practices, or exercise their rights under the article. The section uses a contributing-factor standard for establishing retaliation — lower than the but-for causation standard used in many employment statutes. Employees need not cite a specific section of the article to trigger protection. Remedies for retaliation are those specified in Labor Law § 215.

Compliance actions 1 item

Employers must not retaliate against any employee or candidate who opposes, discloses, or threatens to disclose violations of this article; participates in investigations or hearings; refuses to participate in violative practices; or exercises rights under this article. Retaliation is established where the protected activity is a contributing factor for the adverse action. No explicit citation to the statute is required to trigger protection.

G-03.3

Labor Law § 1015

Civil liability

1 § 1015. Civil liability. 1. If an employer fails to respond to a current or former employee or candidate's request for reevaluation of an employment decision pursuant to section one thousand thirteen of this article, or if a current or former employee or candidate continues to have reason to believe they were harmed by the unlawful use of an inaccurate or biased automated employment decision tool or other violation of this article, the employee or candidate may initiate an action in a court of competent jurisdiction to enforce the provisions of this article. An employer that violates this article shall be liable for liquidated damages in the amount of five hundred dollars for each violation or, where an employee or candidate has suffered actual damages as a result of such violation such as reduced pay, worse working conditions, denial of advancement or access to better pay or working conditions, discipline, or termination, then the employer shall be liable to an affected employee or candidate for the greater of liquidated damages or two times the employee or candidate's actual damages, which shall include back pay, front pay, and lost benefits, and may be awarded injunctive, declaratory, and the employee may be awarded damages for emotional distress and any other reasonable or appropriate relief. An employer shall also be liable for reasonable attorneys' fees and costs, except such liquidated damages may be up to the greater of one thousand dollars for each violation or three times actual damages if found that the actions were willful, or in the case of violations of section one thousand fourteen of this article, such relief as is specified in section two hundred fifteen of this chapter.

2 2. In any civil action claiming that an employer has violated this article in its use of electronic monitoring or automated employment decision tools, any person, employer, vendor, or other business entity that used, sold, distributed, or developed the tool shall be jointly and severally liable to a prevailing plaintiff for all damages awarded to that prevailing plaintiff, except that where a person, employer, vendor, or other business entity knowingly sells, provides, or distributes a tool to an employer with fewer than fifteen employees, the vendor, not the small employer, shall be liable for any unlawful acts.

Section 1015 creates the private right of action. Employees and candidates who fail to receive a timely reevaluation response under § 1013, or who continue to believe they were harmed by an unlawful AEDT or other article violation, may sue in court. The damages structure is tiered: base liquidated damages of $500 per violation; where actual damages are shown, the greater of liquidated damages or two times actual damages (including back pay, front pay, lost benefits, and emotional distress); and for willful violations, the greater of $1,000 per violation or three times actual damages. Attorneys' fees and costs are recoverable. Joint and several liability extends to any person, employer, vendor, or business entity that used, sold, distributed, or developed the tool — with a small-employer exception where a vendor knowingly sold to an employer with fewer than 15 employees.

Labor Law § 1016

Violations

1(a)–(c) § 1016. Violations. 1. (a) Each day on which an electronic monitoring tool or automated employment decision tool is used in violation of this article shall give rise to a separate violation of this article. (b) Failure to provide any notice to a candidate or an employee in violation of section one thousand eleven or one thousand twelve of this article shall constitute a separate violation. (c) Any person who violates any provision of this article or any rule promulgated pursuant to this article may be liable for a civil penalty in the amounts provided under paragraph (b) of subdivision one of section two hundred fifteen of this chapter in order to punish violations and deter future violations.

2 2. The attorney general may initiate in a court of competent jurisdiction action that may be appropriate or necessary for correction of any violation of this article, including mandating compliance with the provisions of this article, securing any of the remedies authorized under this article including recovering damages and liquidated damages as specified in section one thousand fourteen of this article and securing injunctive, declaratory, or such other relief as may be appropriate, and ordering payment of civil penalties.

3 3. The provisions of this article shall not be construed as to limit the authority of the division of human rights to enforce the provisions of article fifteen of the executive law, or as to preempt any municipality from adopting a local law, rule, or regulation establishing requirements, standards, or enforcement measures in addition to those established under this article.

Section 1016 defines the violation structure and establishes Attorney General enforcement authority. Each day of unlawful tool use constitutes a separate violation, and each failure to provide required notice to an employee or candidate is a separate violation — creating significant potential per-day and per-person exposure. Civil penalties are available under Labor Law § 215(1)(b). The Attorney General may bring civil actions for compliance, damages, liquidated damages, injunctive and declaratory relief, and civil penalties. Critically, the section preserves the Division of Human Rights' authority under Executive Law Article 15 and expressly disclaims preemption of municipal laws — municipalities may adopt additional requirements.

Labor Law § 1017

Powers of the commissioner

1 § 1017. Powers of the commissioner. 1. The commissioner shall: (a) promulgate rules specifying the data retention, security, and privacy requirements for all data collected during the course of, and all results or outputs of, the impact assessments required by this article; (b) develop and publish model employer notices for the use of electronic monitoring and automated employment decision tools that employers may utilize in their adoption of the notices required by this article; and (c) promulgate such other rules and regulations as may be necessary to carry out this article.

2 2. The commissioner shall establish an administrative process for receiving and investigating complaints from employees and candidates or their representatives. The commissioner shall have the same powers of investigation as under article nineteen of this chapter. If after investigation the commissioner finds that an employer or person has violated any provision of this section, the commissioner may exercise the same enforcement powers provided under paragraph (b) of subdivision one of section two hundred fifteen of this chapter and may order any relief that may be appropriate or necessary for correction of any violation of this article, including mandating compliance with the provisions of this article, securing any of the remedies authorized under this article including recovering damages and liquidated damages as specified in section one thousand fourteen of this article and securing injunctive, declaratory, or other relief as may be appropriate, and ordering payment of civil penalties or reasonable attorneys' fees and costs.

3 3. The commissioner shall establish a means of collecting, storing, and making publicly available any impact assessments or summaries of impact assessments submitted by employers or vendors in the state. The commissioner shall promulgate rules and regulations by which employers, vendors, or employees may request the redaction of certain information from said impact assessments or summaries thereof, if that information is proprietary, sensitive, or poses a threat to the privacy of employees or candidates.

Section 1017 delegates rulemaking and enforcement authority to the Commissioner of Labor. The Commissioner must promulgate rules on data retention, security, and privacy for impact assessment data; develop and publish model employer notices for electronic monitoring and AEDT use; and promulgate other implementing regulations. The Commissioner must establish an administrative complaint process with investigation powers equivalent to those under Labor Law Article 19, and may impose civil penalties and order the full range of remedies including damages, liquidated damages, injunctive and declaratory relief, and attorneys' fees. The Commissioner must also establish a public registry for impact assessments with rules for proprietary or privacy-sensitive redactions.

Civil Rights Law § 52-e

Conforming amendment — electronic monitoring prior notice

Deployer

27 § 52-e. Employers engaged in electronic monitoring; prior notice required. 1. For purposes of this section, employer means any individual, corporation, partnership, firm, or association with a place of business in the state. It shall not include the state or any political subdivision of the state. 2. (a) Any employer who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio, or electromagnetic, photoelectronic or photo-optical systems, shall give prior written notice upon hiring to all employees who are subject to electronic monitoring. The notice required by this subdivision shall be in writing, in an electronic record, or in another electronic form and acknowledged by the employee either in writing or electronically. Each employer shall also post the notice of electronic monitoring in a conspicuous place which is readily available for viewing by its employees who are subject to electronic monitoring. Such written notice shall comply with the requirements of article thirty-six of the labor law.

Section 2 of the bill renumbers and amends Civil Rights Law § 52-c (originally added by Chapter 583 of the Laws of 2021) as § 52-e. The substantive change is a single addition: the written notice of electronic monitoring required under the Civil Rights Law must now also comply with the requirements of Article 36 of the Labor Law — effectively incorporating all of the new article's notice content and formatting requirements into the existing employer electronic monitoring disclosure obligation. The existing penalty structure ($500/$1,000/$3,000 escalating per offense) and attorney general enforcement authority are preserved.

Compliance actions 1 item

Employers who monitor employee telephone, email, or internet usage must give prior written notice upon hiring to all monitored employees, post the notice conspicuously, and ensure the notice complies with all requirements of Labor Law Article 36. Notice must be in writing or electronic form and acknowledged by the employee.

H-01.3

Act § 3

Effective date

§ 3. This act shall take effect on the one hundred eightieth day after it shall have become a law. Effective immediately, the addition, amendment and/or repeal of any rule or regulation necessary for the implementation of this act on its effective date are authorized to be made and completed on or before such effective date.

The act takes effect on the 180th day after becoming law. The Commissioner is authorized to begin rulemaking immediately upon enactment, before the effective date, to ensure implementing regulations are in place by the time the substantive provisions take effect.

Safety Harmful content prevention · self-harm escalation

5 items

S-02.2

S-02

S-02.1

S-02

Data Controls Data sale restrictions · deidentification

6 items

D-01.4

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the notice provided to employees.

D-01.4