Regulon — NY-SB-7623 · NY SB 7623 (Electronic Monitoring & Automated Employment Decision Tools)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Dual enforcement. The attorney general may initiate action in a court of competent jurisdiction for correction of any violation. Private right of action available to employees and candidates who were harmed by an unlawful use, but only after the employee or candidate has first requested reevaluation from the employer and either received no response or continues to have reason to believe harm occurred. Civil penalty proceedings may be brought before designated agency tribunals or, in cities over one million population, by hearing officers within the office of administrative trials and hearings.

Private Right of Action

Private right of action available to employees and candidates who were harmed by an unlawful use, but only after the employee or candidate has first requested reevaluation from the employer and either received no response or continues to have reason to believe harm occurred.

Penalties

Civil penalties: up to $500 for a first violation (and each additional violation on the same day); $500–$1,500 for each subsequent violation. Each day of unlawful tool use is a separate violation; each failure to provide notice is a separate violation. Private action damages: actual damages plus reasonable attorneys' fees and costs, plus 100% liquidated damages (trebled to 300% if willful), unless the employer proves good-faith compliance belief. Joint and several liability among employers, vendors, and any person who used, sold, distributed, or developed the tool; where a vendor knowingly sells to an employer with fewer than 50 employees, the vendor alone is liable. Injunctive relief available via attorney general action.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Labor Law § 203-g(1)

Definitions

(1)(a) "Automated employment decision tool" means any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods that issues a simplified output, including a score, classification, ranking, or recommendation, that is used to assist or replace decision making for employment decisions that impact natural persons. "Automated employment decision tool" does not include a tool that does not assist or replace employment decision processes and that does not materially impact natural persons, including, but not limited to, a junk email filter, firewall, antivirus software, calculator, spreadsheet, database, data set, or other compilation of data.

(1)(b) "Bias audit" means an impartial evaluation by an independent auditor, which shall include, at a minimum, the testing of an automated employment decision tool to assess the tool's disparate impact on employees because of their age, race, creed, color, ethnicity, national origin, disability, citizenship or immigration status, marital or familial status, military status, religion, or sex, including sexual orientation, gender identity, gender expression, pregnancy, pregnancy outcomes, and reproductive healthcare choices.

(1)(c) "Candidate" means any natural person or their authorized representative seeking employment through an application, or who is screened or evaluated for recruitment, for a position of employment by a business operating in the state.

(1)(d) "Electronic monitoring tool" means any system that facilitates the collection of data concerning worker activities or communications by any means other than direct observation by a natural person, including the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic, or photo-optical system.

(1)(e) "Employer" means any person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. "Employer" includes any of the employer's labor contractors.

(1)(f) "Employee" means any natural person or their authorized representative acting for, employed by, or an independent contractor providing service to, or through, a business operating in the state.

(1)(g) "Employee data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular employee, regardless of how the information is collected, inferred, or obtained. Data includes, but is not limited to, the following: (i) personal identity information, including the individual's name, contact information, government-issued identification number, financial information, criminal background, or employment history; (ii) biometric information, including the individual's physiological, biological, or behavioral characteristics, including the individual's deoxyribonucleic acid (DNA), that can be used, singly or in combination with other data, to establish individual identity; (iii) health, medical, lifestyle, and wellness information, including the individual's medical history, physical or mental condition, diet or physical activity patterns, heart rate, medical treatment or diagnosis by a health care professional, health insurance policy number, subscriber identification number, or other unique identifier used to identify the individual; and (iv) any data related to workplace activities, including the following: (A) human resources information, including the contents of an individual's personnel file or performance evaluations; (B) work process information, such as productivity and efficiency data; (C) data that captures workplace communications and interactions, including emails, texts, internal message boards, and customer interaction and ratings; (D) device usage and data, including calls placed or geolocation information; (E) audio-video data and other information collected from sensors, including movement tracking, thermal sensors, voiceprints, or facial recognition, emotion, and gait recognition; (F) inputs to or outputs generated by an automated employment decision tool that are linked to the individual; and (G) data that is collected or generated on workers to mitigate the spread of infectious diseases, including COVID-19, or to comply with public health measures.

(1)(h) "Employment decision" means any decision made by the employer that affects wages, benefits, other compensation, hours, work schedule, performance evaluation, hiring, selecting for recruitment, discipline, promotion, termination, job content, assignment of work, access to work opportunities, productivity requirements, workplace health and safety, and other terms or conditions of employment. For independent contractors or candidates for employment, this means the equivalent of these decisions based on their contract with or relationship to the employer.

(1)(i) "Vendor" means any person who sells, distributes, or develops for sale an automated employment decision tool to be used in an employment decision made by an employer in the state.

Subdivision 1 establishes the statutory definitions governing the entire section. The definition of automated employment decision tool is notably broader than the NYC Local Law 144 definition: it covers any computational process using ML, statistical modeling, data analytics, or AI that issues a simplified output used to assist or replace employment decisions, with an explicit carve-out for tools that do not materially impact natural persons. The definition of electronic monitoring tool captures virtually any non-human-observation system for collecting data on worker activities or communications. Employee data is expansively defined to include biometric information, health and wellness data, workplace communications, sensor data, and AEDT inputs/outputs.

Labor Law § 203-g(2)

Restrictions on use of electronic monitoring tools

Deployer

(2)(a) 1 It shall be unlawful for an employer to use an electronic monitoring tool to collect employee data unless: (i) the electronic monitoring tool is primarily intended to accomplish any of the following purposes: (A) allowing a worker to accomplish an essential job function; (B) ensuring the quality of goods and services; (C) periodic assessment of worker performance; (D) ensuring compliance with employment, labor, or other relevant laws; (E) protecting the health, safety, or security of workers, or the security of the employer's facilities or computer networks; (F) administering wages and benefits; or (G) additional purposes to enable business operations as determined by the department; (ii) the specific type of electronic monitoring tool is strictly necessary to accomplish the purpose, exclusively used to accomplish the purpose, and is the least invasive means to the employee that could reasonably be used to accomplish the purpose; and (iii) the specific form of electronic monitoring is limited to the smallest number of workers and collects the least amount of data necessary to accomplish the purpose.

(2)(b) 2 Any employer that uses an electronic monitoring tool shall give prior written notice to all employees who may be subject to electronic monitoring and post said notice in a conspicuous place which is readily available for viewing by employees, pursuant to subdivision two of section fifty-two-e of the civil rights law. Such notice shall include, at a minimum, the following: (i) a description of the purpose for which the electronic monitoring tool will be used, as specified in subparagraph (i) of paragraph (a) of this subdivision; (ii) a description of the specific employee data to be collected, and the activities, locations, communications, and job roles that will be electronically monitored by the tool; (iii) a description of the dates, times, and frequency that electronic monitoring will occur; (iv) whether and how any employee data collected by the electronic monitoring tool will be used as an input in an automated employment decision tool; (v) whether and how any employee data collected by the electronic monitoring tool will alone or in conjunction with an automated employment decision tool be used to make an employment decision by the employer or employment agency; (vi) whether any employee data collected by the electronic monitoring tool will be used to assess employees' productivity performance or to set productivity standards, and if so, how; (vii) a description of where any employee data collected by the electronic monitoring tool will be stored and the length of time it will be retained; and (viii) an explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the monitoring purpose.

(2)(c) 3 An employer shall destroy any employee data collected via an electronic monitoring tool when the initial purpose for collecting the data has been satisfied or at the end of the employee's relationship with the employer, unless the employee has provided written and informed consent to the retention of their data by the employer.

(2)(d) 2 Notice of the specific form of electronic monitoring shall be clear and conspicuous and provide the worker with actual notice of electronic monitoring activities. A notice that states electronic monitoring "may" take place or that the employer "reserves the right" to monitor shall not be considered clear and conspicuous.

(2)(e) 4 An employer who engages in random or periodic electronic monitoring of employees shall inform the affected employees of the specific events which are being monitored at the time the monitoring takes place. Notice shall be clear and conspicuous. (ii) Notice of random or periodic electronic monitoring may be given after electronic monitoring has occurred only if necessary to preserve the integrity of an investigation of illegal activity or protect the immediate safety of employees, customers, or the public.

Subdivision 2 establishes the conditions under which employers may lawfully use electronic monitoring tools. The use-restriction framework operates on three levels: the monitoring must serve one of seven enumerated purposes, the specific tool must be strictly necessary and the least invasive means available, and monitoring must be limited to the smallest number of workers collecting the least data necessary. Paragraph (b) imposes a detailed written-notice obligation requiring employers to disclose the monitoring purpose, data collected, monitoring schedule, connections to AEDTs and employment decisions, productivity-standard implications, data storage and retention, and a least-invasive-means justification. Paragraph (c) requires data destruction when the collection purpose is satisfied or the employment relationship ends, absent written employee consent. Paragraphs (d) and (e) address notice specificity — hedging language like "may" monitor or "reserves the right" is expressly insufficient — and impose real-time notice requirements for random or periodic monitoring with a narrow post-hoc exception for integrity-of-investigation scenarios.

Compliance actions 4 items

Employers may use electronic monitoring tools to collect employee data only if the tool serves one of seven enumerated purposes, is strictly necessary and the least invasive means to accomplish that purpose, and is limited to the smallest number of workers and least amount of data necessary.

D-01.4

Employers must give prior written notice to all employees who may be subject to electronic monitoring, and post the notice conspicuously, disclosing: the monitoring purpose, data collected, activities and locations monitored, monitoring schedule, whether data feeds into an AEDT or employment decisions, productivity-standard use, data storage location and retention period, and why the monitoring is the least invasive means available. Notices stating monitoring may occur or that the employer reserves the right to monitor are insufficient.

D-01.1

Employers must destroy employee data collected via electronic monitoring when the initial collection purpose has been satisfied or when the employment relationship ends, unless the employee provides written and informed consent to continued retention.

D-01.4

Employers conducting random or periodic electronic monitoring must inform affected employees of the specific events being monitored at the time monitoring occurs. Post-hoc notice is permitted only if necessary to preserve the integrity of an investigation of illegal activity or protect immediate safety.

D-01.1

Labor Law § 203-g(3)

Prohibited uses of electronic monitoring tools

Deployer

(3)(a)(i)–(v) 5 Notwithstanding the allowable purposes for electronic monitoring described in paragraph (a) of subdivision two of this section, an employer shall not: (i) use an electronic monitoring tool in such a manner that results in a violation of labor or employment law; (ii) use an electronic monitoring tool in such a manner as to threaten the health, welfare, safety, or legal rights of employees; (iii) use an electronic monitoring tool to monitor employees who are off-duty and not performing work-related tasks; (iv) use an electronic monitoring tool in order to obtain information about an employee's religious beliefs, health or disability status, or immigration status; (v) use an electronic monitoring tool in order to identify, punish, or obtain information about employees engaging in activity protected under labor and employment law;

(3)(a)(vi)–(ix) 5 use an electronic monitoring tool in order to or with the effect of informing a dynamic wage-setting system; (vii) conduct audio-visual monitoring of bathrooms or other similarly private areas, including locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, areas designated to express breast milk, or areas designated for prayer or other religious activity, including data collection on the frequency of use of those private areas; (viii) conduct audio-visual monitoring of a workplace in an employee's residence, an employee's personal vehicle, or property owned or leased by an employee, unless that audio-visual monitoring is strictly necessary to ensure employee health and safety, to verify the security of company or client data, or to accomplish other similarly compelling purposes; (ix) use an electronic monitoring tool that incorporates facial recognition, gait, or emotion recognition technology;

(3)(a)(x)–(xi) 6 discipline or terminate the employment of an employee solely on the basis of their opposition of or refusal to submit to a practice that the employee believes in good faith that violate this section; or (xi) where employees have union representation, refuse to bargain over the use of electronic monitoring tools.

(3)(b) 7 An employer shall not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided pursuant to paragraph (b) of subdivision two of this section.

(3)(c) 8 An employer shall not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless it is required to do so under state or federal law, or necessary to do so to comply with a bias audit of an automated employment decision tool pursuant to subdivision four of this section.

(3)(d) 9 An employer shall not require employees to either install applications on personal devices that collect or transmit employee data or to wear, embed, or physically implant those devices, including those that are installed subcutaneously or incorporated into items of clothing or personal accessories, unless the electronic monitoring is strictly necessary to accomplish essential job functions and is narrowly limited to only the activities and times necessary to accomplish essential job functions. Location tracking applications and devices shall be disabled outside the activities and times necessary to accomplish essential job functions.

(3)(e) 10 An employer shall not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

(3)(f) 11 The information and judgments involved in an employer's use of electronic monitoring data shall be documented and communicated to affected employees prior to the hiring, promotion, termination, or disciplinary decision going into effect.

(3)(g) Data that provides evidence of criminal activity, when independently corroborated by the employer, or captured through the use of reasonable security measures that comply with paragraph (a) of subdivision two of this section, is exempt from this subdivision.

Subdivision 3 enumerates specific prohibited uses of electronic monitoring tools and employee data collected through monitoring. The prohibitions target monitoring that violates labor law, threatens employee health or safety, targets off-duty workers, seeks protected information (religious beliefs, health, disability, or immigration status), surveils protected labor activity, informs dynamic wage-setting, or occurs in private areas. Audio-visual monitoring of employee residences or personal vehicles is restricted to strictly necessary health-safety and data-security scenarios. Facial recognition, gait recognition, and emotion recognition technology are categorically prohibited. The subdivision also bars secondary use of monitoring data beyond the noticed purpose, prohibits sale or transfer of employee data except where required by law or necessary for a bias audit, restricts mandatory installation of monitoring applications on personal devices, prohibits sole reliance on monitoring data for consequential employment decisions, and requires pre-decision documentation and communication of monitoring-based judgments to affected employees. An anti-retaliation provision protects employees who refuse to submit to practices they believe violate the section. A criminal-activity evidence exemption applies to data independently corroborated by the employer.

Compliance actions 7 items

Employers must not use electronic monitoring tools to: violate labor or employment law; threaten employee health, welfare, safety, or legal rights; monitor off-duty employees; obtain information about religious beliefs, health/disability status, or immigration status; identify or punish protected labor activity; inform dynamic wage-setting; conduct audio-visual monitoring of bathrooms, breakrooms, and other private areas; monitor employee residences or personal vehicles except where strictly necessary for health/safety or data security; or incorporate facial recognition, gait recognition, or emotion recognition technology.

S-02

Employers must not discipline or terminate employees for good-faith opposition to or refusal to submit to practices they believe violate this section, and must not refuse to bargain over electronic monitoring tools where employees have union representation.

—

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the prior written notice provided to employees.

D-01.4

Employers must not sell, transfer, or disclose employee data collected via electronic monitoring to any other entity, unless required by state or federal law or necessary to comply with an AEDT bias audit.

D-01.4

Employers must not require employees to install monitoring applications on personal devices, or to wear, embed, or physically implant monitoring devices, unless the monitoring is strictly necessary to accomplish essential job functions and narrowly limited to those activities and times. Location tracking must be disabled outside essential job function activities and times.

S-02

Employers must not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

H-01.6

Employers must document and communicate to affected employees the information and judgments involved in the employer's use of electronic monitoring data before any hiring, promotion, termination, or disciplinary decision goes into effect.

H-01.1

Labor Law § 203-g(4)

Bias audit requirements for automated employment decision tools

DeployerDeveloper

(4)(a) 12 It shall be unlawful for an employer to use an automated employment decision tool for an employment decision unless such tool has been the subject of a bias audit. Bias audits for automated employment decision tools must: (i) be conducted no more than one year prior to the use of such tool, or where the tool was in use by the employer before this act became a law, within six months of this act becoming a law; and (ii) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (iii) identify and describe the attributes and modeling techniques that the tool uses to produce outputs; (iv) evaluate whether those attributes and techniques are a scientifically valid means of evaluating an employee or candidate's performance or ability to perform the essential functions of a role, and whether those attributes may function as a proxy for belonging to a protected class; (v) consider, identify, and describe any disparities in the data used to train or develop the tool and describe how those disparities may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy any disparate impact; (vi) consider, identify, and describe any disparities in the outputs produced by the tool that may result in a disparate impact on persons belonging to a protected class, and what actions may be taken by the employer or vendor of the tool to reduce or remedy that disparate impact; (vii) evaluate whether the use of the tool may limit accessibility for persons with disabilities, or for persons with any specific disability, and what actions may be taken by the employer or vendor of the tool to reduce or remedy the concern; (viii) identify and describe any other assessment of risks of discrimination or a disparate impact of the tool on members of a protected class that arise over the course of the bias audit, and what actions may be taken to reduce or remedy that risk; (ix) for any finding of a disparate impact or limit on accessibility, evaluate whether the data set, attribute, or feature of the tool at issue is the least discriminatory method of assessing a candidate's performance or ability to perform job functions; and (x) be submitted in its entirety or an accessible summary form to the department for inclusion in a public registry of such audits within sixty days of completion and distributed to employees who may be subject to the tool.

(4)(b) 13 An employer shall conduct or commission subsequent audits each year that the tool is in use to assist or replace employment decisions. Subsequent audits shall comply with the requirements of paragraph (a) of this subdivision, and shall assess and describe any change in the validity or disparate impact of the tool.

(4)(c) 14 An employer or vendor shall retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool that may be necessary to conduct a bias audit. This includes but is not limited to the source of the data used to develop the tool, the technical specifications of the tool, individuals involved in the development of the tool, and historical use data for the tool. Such documentation must include a historical record of versions of the tool, such that an employer shall be able to attest in the event of litigation disputing an employment decision, the nature and specifications of the tool as it was used at the time of that employment decision. Such documentation shall be stored in such a manner as to be legible and accessible to the party conducting a bias audit.

(4)(d) 15 If an initial or subsequent bias audit requires the collection of sensitive employee data to assess a tool's disparate impact on employees, such data shall be collected, processed, stored, and retained in such a manner as to protect the privacy of employees. Employee data provided to auditors for the purpose of a bias audit shall not be shared with the employer, nor shall it be shared with any person, business entity, or other organization unless strictly necessary for the completion of the bias audit.

(4)(e) 16 If an initial or subsequent bias audit concludes that a data set, feature, or application of the automated employment decision tool results in a disparate impact on persons belonging to a protected class, or unlawfully limit accessibility for persons with disabilities, an employer shall: (i) take reasonable and appropriate steps to reduce or remedy that disparate impact or limit on accessibility and describe in writing to employees, the auditor, and the department what steps were taken; and (ii) if the employer believes the audit finding of a disparate impact or limit on accessibility is erroneous, or that the steps taken in accordance with subparagraph (i) of this paragraph sufficiently address those findings such that the tool may be lawfully used in accordance with this section, describe in writing to employees, the auditor, and the department how the data set, feature, or application of the tool is the least discriminatory method of assessing an employee's performance or ability to complete essential functions of a position; or (iii) if the employer believes the audit finding of a disparate impact or limit on accessibility is part of a lawful affirmative action plan or other lawful effort to reduce or eliminate bias in employment decisions, describe such plan or effort in writing to employees, the auditor, and the department.

(4)(f) 17 It shall be unlawful for an independent auditor, vendor, or employer to manipulate, conceal, or misrepresent the results of a bias audit.

Subdivision 4 is the bill's central bias-audit regime for automated employment decision tools. It prohibits employer use of an AEDT unless the tool has been subjected to a bias audit meeting ten enumerated requirements, including independence of the auditor, identification of modeling techniques, scientific validity evaluation, training-data disparity analysis, output disparity analysis, accessibility evaluation, residual risk assessment, least-discriminatory-method analysis, and submission to the Department of Labor for public registry inclusion within sixty days. Annual subsequent audits are required for as long as the tool is in use. Documentation-retention obligations fall on both employers and vendors, requiring preservation of design, development, use, and data records sufficient to reconstruct the tool as used at the time of any disputed decision. Employee data provided for bias audits must be privacy-protected and may not be shared with the employer. When a bias audit finds disparate impact or accessibility limitations, the employer must take remedial steps or justify continued use as the least discriminatory method, and must describe those actions in writing to employees, the auditor, and the department. Manipulation, concealment, or misrepresentation of audit results is independently unlawful.

Compliance actions 6 items

Employers must not use an automated employment decision tool unless it has been subjected to an independent bias audit conducted no more than one year prior to use (or within six months for tools in use at enactment). The audit must be conducted by an independent party with no conflicts of interest and must: identify modeling techniques and attributes; evaluate scientific validity and proxy-for-protected-class risk; analyze training data and output disparities across protected classes; evaluate disability accessibility impacts; assess all residual discrimination risks; and for any disparate impact finding, evaluate whether the feature at issue is the least discriminatory method. The audit must be submitted to the Department of Labor within sixty days and distributed to affected employees.

H-02.1

Employers must conduct or commission subsequent bias audits annually for each year an automated employment decision tool is in use, complying with all initial-audit requirements and additionally assessing and describing any change in the tool's validity or disparate impact.

H-02.8

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool necessary to conduct a bias audit, including data sources, technical specifications, developer identities, historical use data, and a version history sufficient to reconstruct the tool as it existed at the time of any disputed employment decision. Documentation must be legible and accessible to auditors.

G-01.3

Sensitive employee data collected for a bias audit must be collected, processed, stored, and retained in a manner that protects employee privacy. Audit data must not be shared with the employer and must not be disclosed to any person or entity unless strictly necessary for the bias audit.

D-01.4

When a bias audit finds disparate impact or accessibility limitations, employers must (1) take reasonable steps to reduce or remedy the impact and describe those steps in writing to employees, the auditor, and the department; (2) if the employer disputes the finding or believes remediation suffices, describe in writing why the tool is the least discriminatory method; or (3) if the finding results from a lawful affirmative action plan, describe the plan in writing to employees, the auditor, and the department.

H-02.3

Independent auditors, vendors, and employers must not manipulate, conceal, or misrepresent the results of a bias audit.

H-02

Labor Law § 203-g(5)

Notice requirements for automated employment decision tool use

Deployer

(5) 18 Any employer that uses an automated employment decision tool shall notify employees and candidates subject to the tool no less than ten business days before such use: (a) that an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate; (b) the job qualifications and characteristics that such automated employment decision tool will assess, what employee or candidate data or attributes the tool will use to conduct that assessment, and what kind of outputs the tool will produce as an evaluation of such employee or candidate; (c) what employee or candidate data is collected for the automated employment decision tool, the source of such data and the employer's data retention policy. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation; (d) the results of the most recent bias audit of the automated employment decision tool, including any findings of a disparate impact and associated response from the employer, or information about how to access that information if publicly available; (e) information about how an employee or candidate may request an alternative selection process or accommodation that does not involve the use of an automated employment decision tool; and (f) information about how the employee or candidate may (i) request internal review of the employment decision made by the automated employment decision tool in accordance with subdivision seven of this section and (ii) notification of the employee or candidate's right to file a complaint in a civil court in accordance with subdivision eight of this section.

Subdivision 5 imposes a comprehensive pre-use notice obligation on employers using automated employment decision tools. Employers must notify affected employees and candidates at least ten business days before use. The notice must cover six categories of information: (a) that an AEDT will be used; (b) the qualifications and characteristics being assessed, data inputs, and output types; (c) data collected, its source, and the employer's retention policy; (d) the most recent bias audit results including any disparate impact findings and the employer's response; (e) how to request an alternative selection process or accommodation; and (f) how to request internal reevaluation and the right to file a civil action. This is a more detailed and longer-lead-time notice requirement than NYC Local Law 144's ten-business-day notice, adding bias audit result disclosure, alternative-process information, and reevaluation right disclosure.

Compliance actions 1 item

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that an AEDT will be used; (2) the qualifications assessed, data inputs and attributes used, and output types; (3) data collected, its source, and the retention policy; (4) the most recent bias audit results and employer response; (5) how to request an alternative selection process or accommodation; and (6) how to request internal reevaluation and the right to file a civil action.

H-01.1

Labor Law § 203-g(6)

Prohibited uses of automated employment decision tools and human oversight requirements

Deployer

(6)(a) 19 Notwithstanding the provisions of subdivision four of this section, an employer shall not, alone or in conjunction with an electronic monitoring tool, use an automated employment decision tool: (i) in such a manner that results in a violation of labor or employment law; (ii) in such a manner as to unduly intensify the conditions of work or to harm the health and safety of employees, including by setting unreasonable productivity quotas; (iii) to make predictions about an employee or candidate for employment's behavior, beliefs, intentions, personality, emotional state, or other characteristic or behavior; (iv) to predict, interfere with, restrain, or coerce employees engaging in activity protected under labor and employment law; (v) to implement a dynamic wage-setting system that pays employees different wages for the same work; (vi) to subtract from an employee's wages time spent exercising their legal rights; or (vii) that involves facial recognition, gait, or emotion recognition technologies.

(6)(b)–(b)(i)–(ii) 20 An employer shall not rely solely on output from an automated employment decision tool when making hiring, promotion, termination, disciplinary, or compensation decisions. (i) An employer shall establish meaningful human oversight of hiring, promotion, termination, disciplinary or compensation decisions assisted or replaced by automated employment decision tools. Meaningful human oversight requires: (A) the designation of an internal reviewer with sufficient expertise in the operation of automated employment decision tools, sufficient familiarity with the results of the most recent bias audit of the employer's tool, and sufficient understanding of the outputs of the employer's tool to identify potential errors, discrepancies, or inaccuracies produced by the tool; (B) that sufficient authority and discretion be granted to the designated internal reviewer to dispute, rerun, or recommend the rejection of an output suspected to be invalid, inaccurate, or discriminatory; and (C) that the designated internal reviewer has the time and resources available to review and evaluate the tool output in accordance with clause (B) of this subparagraph. (ii) An employer shall consider information other than automated employment decision tool outputs when making hiring, promotion, termination, disciplinary, orcompensation decisions, such as supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

(6)(c) 21 An employer may not, where employees have union representation, refuse to bargain over the use of automated employment decision tools.

(6)(d) 22 An employer shall not require employees or candidates that apply for a position of employment to consent to the use of an automated employment decision tool in an employment decision in order to be considered for an employment decision, nor shall an employer discipline or disadvantage an employee or candidate for employment solely as a result of their request for accommodation.

Subdivision 6 establishes both prohibited uses for AEDTs and mandatory human oversight requirements. Paragraph (a) prohibits AEDT use in seven categories: in a manner violating labor or employment law; unduly intensifying work conditions or setting unreasonable productivity quotas; predicting employee or candidate behavior, beliefs, personality, or emotional state; predicting or interfering with protected labor activity; implementing dynamic wage-setting that pays different wages for the same work; deducting time spent exercising legal rights from wages; and incorporating facial recognition, gait, or emotion recognition. Paragraph (b) prohibits sole reliance on AEDT output for consequential employment decisions and mandates meaningful human oversight through a designated internal reviewer with expertise, familiarity with audit results, authority to dispute or reject outputs, and adequate time and resources. Paragraph (c) requires collective bargaining over AEDT use where union representation exists. Paragraph (d) prohibits conditioning employment consideration on consent to AEDT use and bars discipline or disadvantage for requesting accommodation.

Compliance actions 4 items

Employers must not use an automated employment decision tool to: violate labor or employment law; unduly intensify work conditions or set unreasonable productivity quotas; predict employee or candidate behavior, beliefs, intentions, personality, or emotional state; predict or interfere with protected labor activity; implement dynamic wage-setting paying different wages for the same work; deduct time spent exercising legal rights from wages; or incorporate facial recognition, gait, or emotion recognition technologies.

S-02

Employers must not rely solely on AEDT output for hiring, promotion, termination, disciplinary, or compensation decisions and must establish meaningful human oversight by designating an internal reviewer with (A) sufficient expertise in AEDT operations and familiarity with the most recent bias audit results, (B) authority and discretion to dispute, rerun, or recommend rejection of suspect outputs, and (C) adequate time and resources to review outputs. Employers must also consider information beyond AEDT outputs, such as supervisory evaluations, personnel files, and peer reviews.

H-01.6

Employers with unionized employees must not refuse to bargain over the use of automated employment decision tools.

—

Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage any employee or candidate solely for requesting an accommodation.

—

Labor Law § 203-g(7)

Employee and candidate reevaluation rights

Deployer

(7)(a) 23 An employer shall offer employees and candidates a meaningful opportunity to request a reevaluation of the results of an employment decision made or assisted by an automated employment decision tool, if an employee or candidate believes or suspects that the decision resulted from inaccuracy, error, or bias in the tool, that the tool was used as the sole basis for the decision, or that the employer's use of the tool in some other way violates the provisions of this section, and the employee or candidate was meaningfully harmed by the outcome of the employment decision. An employee or candidate shall within thirty days of being notified of the employment decision provide the employer with a written request for reevaluation. Such written request shall include: (i) the person's name, the employment decision at issue, and how the person was harmed by the outcome of the employment decision; (ii) why the person believes or suspects the employment decision was informed by an inaccurate, erroneous, or biased output, was the result of an unlawful sole reliance on an automated employment decision tool, or otherwise violated the provisions of this section; (iii) any evidence that may support the person's belief or suspicion; and (iv) what reasonable remedial action the person would like the employer to take to investigate or remedy the believed or suspected harm, which may include providing the employee or candidate with outputs or documentation associated with the employment decision, providing the employee or candidate with documentation about the tool's most recent bias audit, or reprocessing the employee or candidate's data through the tool.

(7)(b) 24 An employer shall respond in writing to an employee or candidate's written request for reevaluation within sixty days of receipt of such request. Such written response shall include: (i) any employment decision tool outputs regarding the person purporting to be harmed by the employment decision that were used in the making of the employment decision; (ii) a description of the information other than the automated employment decision tool output that contributed to the employment decision; (iii) whether the employer agrees with the employee or candidate's belief or suspicion that the decision was informed by an inaccurate, erroneous, or biased tool or output, that the tool was the unlawful sole basis for the decision, or that the employer otherwise violated the provisions of this section in its use of the tool, and why or why not; (iv) if the employer disagrees with the employee or candidate's belief or suspicion, any evidence supporting the tool or output's accuracy and validity, the existence of meaningful human oversight, or the use of bases other than the tool in the making of the decision; (v) if the employee or candidate requested the reprocessing of their data through the tool, the results or outputs of that reprocessing, and whether the results of the reprocessing have changed the employer's employment decision, and why or why not; and (vi) if the employer refuses to take any reasonable remedial action requested by the employee or candidate, why they refuse to do so.

Subdivision 7 establishes a structured internal reevaluation process for employees and candidates who believe they were harmed by an AEDT. Within thirty days of being notified of an employment decision, the affected person may submit a written reevaluation request specifying the decision at issue, the harm suffered, the basis for the belief that the tool was inaccurate, erroneous, biased, or unlawfully used as the sole decision basis, supporting evidence, and requested remedial action. The employer must respond in writing within sixty days, disclosing: tool outputs used in the decision, non-tool information that contributed, whether the employer agrees with the complaint and why, supporting evidence for the tool's accuracy if the employer disagrees, reprocessing results if requested, and reasons for refusing any requested remedial action. This creates a mandatory pre-litigation administrative process that both documents the decision chain and provides the employee with the information needed to pursue a civil action under subdivision 8.

Compliance actions 2 items

Employers must offer employees and candidates a meaningful opportunity to request reevaluation of any employment decision made or assisted by an AEDT, where the person believes the decision resulted from inaccuracy, error, bias, sole reliance on the tool, or other statutory violation, and was meaningfully harmed. The written request must be submitted within thirty days of the decision and must include the person's identity, the decision at issue, the harm suffered, the basis for the belief, supporting evidence, and requested remedial action.

H-01.4

Employers must respond in writing within sixty days to a reevaluation request, disclosing: the AEDT outputs used in the decision, non-AEDT information that contributed, whether the employer agrees with the complaint and why, evidence supporting the tool's accuracy if the employer disagrees, reprocessing results if requested, and the reason for refusing any requested remedial action.

H-01.1

Labor Law § 203-g(8)

Private right of action and joint liability

(8)(a) If an employer fails to respond to an employee or candidate's request for reevaluation, or if the employee or candidate continues to have reason to believe they were harmed by the unlawful use of an inaccurate or biased automated employment decision tool or other violation of this section, the employee or candidate may initiate an action in a court of competent jurisdiction to enforce the provisions of this section. An employer that violates this section shall be liable for actual damages to any employee or candidate that has suffered damages due to such violation, reasonable attorneys' fees and costs, and, unless the employer proves a good faith basis to believe that its actions were in compliance with the law, one hundred percent of the total amount of actual damages, except such liquidated damages may be up to three hundred percent if found that the actions were willful.

(8)(b) In any civil action claiming that an employer has violated this section in its use of electronic monitoring or automated employment decision tools, any person, employer, vendor, or other business entity that used, sold, distributed, or developed the tool shall be jointly and severally liable to a prevailing plaintiff for all damages awarded to that prevailing plaintiff, except that where a person, employer, vendor, or other business entity knowingly sells, provides, or distributes a tool to an employer with fewer than fifty employees, the vendor, not the small employer, shall be liable for any unlawful acts.

Subdivision 8 creates the private enforcement mechanism. An employee or candidate may initiate a civil action if the employer fails to respond to a reevaluation request or if the person continues to believe they were harmed by an unlawful use of an inaccurate or biased AEDT. Remedies include actual damages, reasonable attorneys' fees and costs, and liquidated damages of 100% of actual damages — increased to 300% for willful violations — unless the employer proves a good-faith compliance belief. Paragraph (b) imposes joint and several liability on any person, employer, vendor, or business entity that used, sold, distributed, or developed the tool. A small-employer exception provides that when a vendor knowingly sells a tool to an employer with fewer than fifty employees, the vendor alone bears liability for unlawful acts.

Labor Law § 203-g(9)

Civil penalties

(9)(a)–(d) Any person who violates any provision of this section or any rule promulgated pursuant to this section is liable for a civil penalty of not more than five hundred dollars for a first violation and each additional violation occurring on the same day as the first violation, and not less than five hundred dollars nor more than fifteen hundred dollars for each subsequent violation. (b) Each day on which an electronic monitoring tool or automated employment decision tool is used in violation of this section shall give rise to a separate violation of this section. (c) Failure to provide any notice to a candidate or an employee in violation of subdivision two or five of this section shall constitute a separate violation. (d) A proceeding to recover any civil penalty authorized by this section is returnable to any tribunal established within any agency designated to conduct such proceedings, or, in a city of over one million in population, such hearing may be held by a hearing officer employed within the office of administrative trials and hearings.

Subdivision 9 establishes the civil penalty structure. Any person violating any provision of the section or any implementing rule is liable for up to $500 for a first violation (and each additional violation on the same day), and between $500 and $1,500 for each subsequent violation. Each day of unlawful tool use constitutes a separate violation, and each failure to provide required notice is a separate violation. Civil penalty proceedings may be brought before designated agency tribunals or, in cities over one million population, before hearing officers in the office of administrative trials and hearings.

Labor Law § 203-g(10)

Attorney general enforcement

(10) The attorney general may initiate in a court of competent jurisdiction action that may be appropriate or necessary for correction of any violation of this section, including mandating compliance with the provisions of this section or such other relief as may be appropriate.

Subdivision 10 grants the attorney general authority to initiate actions in a court of competent jurisdiction for correction of violations, including mandating compliance or seeking other appropriate relief. This creates a parallel enforcement pathway to the private right of action and civil penalty proceedings.

Labor Law § 203-g(11)

Savings clause — Division of Human Rights

(11) The provisions of this section shall not be construed as to limit the authority of the division of human rights to enforce the provisions of article fifteen of the executive law.

Subdivision 11 is a savings clause preserving the authority of the Division of Human Rights to enforce the New York Human Rights Law (Executive Law Article 15). This ensures that the new section does not narrow existing anti-discrimination enforcement powers.

Section 2

Department of Labor rulemaking and public bias audit registry

(a)–(b) The department of labor shall promulgate any rules and regulations necessary to implement the provisions of this section. (b) The department of labor shall within one hundred eighty days of this act becoming a law have established a means of collecting, storing, and making publicly available any bias audits or summaries of bias audits submitted by employers or vendors in the state. Such department shall promulgate rules and regulations by which employers, vendors, or employees may request the redaction of certain information from said bias audits or summaries thereof, if that information is proprietary, sensitive, or poses a threat to the privacy of employees or candidates.

Section 2 directs the Department of Labor to promulgate rules and regulations implementing the statute. Within 180 days of enactment, the department must establish a system for collecting, storing, and publicly making available bias audits or summaries submitted by employers or vendors. The department must also promulgate rules permitting employers, vendors, or employees to request redaction of proprietary, sensitive, or privacy-threatening information from publicly available audit records.

Civil Rights Law § 52-e

Conforming amendment — electronic monitoring notice requirements

Deployer

25 Any employer who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio, or electromagnetic, photoelectronic or photo-optical systems, shall give prior written notice upon hiring to all employees who are subject to electronic monitoring. The notice required by this subdivision shall be in writing, in an electronic record, or in another electronic form and acknowledged by the employee either in writing or electronically. Each employer shall also post the notice of electronic monitoring in a conspicuous place which is readily available for viewing by its employees who are subject to electronic monitoring. Such written notice shall comply with the requirements of subdivision two of section two hundred three-g of the labor law.

Section 3 of the bill renumbers Civil Rights Law § 52-c to § 52-e and amends it to require that the prior written notice required under the existing electronic monitoring disclosure law comply with the new detailed notice requirements of Labor Law § 203-g(2). This conforming amendment ensures that employers subject to both statutes must meet the more comprehensive notice standards established by the new labor law section.

Compliance actions 1 item

Employers subject to Civil Rights Law § 52-e must ensure that prior written electronic monitoring notices given at hiring comply with the detailed notice requirements of Labor Law § 203-g(2), including all eight enumerated disclosure categories.

D-01.1

Section 4

Effective date

This act shall take effect on the one hundred eightieth day after it shall have become a law.

The act takes effect on the 180th day after it becomes law. This provides a transition period for employers, vendors, and the Department of Labor to come into compliance and establish the public bias audit registry.

Safety Harmful content prevention · self-harm escalation

3 items

S-02

Data Controls Data sale restrictions · deidentification

8 items

D-01.4

D-01.1

D-01.4

D-01.1

D-01.4

Employers must not use employee data collected via electronic monitoring for any purpose other than those specified in the prior written notice provided to employees.

D-01.4

D-01.1

Human Oversight Decision review · appeal pathways

10 items

H-01.6

Employers must not rely solely on employee data collected through electronic monitoring when making hiring, promotion, termination, disciplinary, or compensation decisions.

H-01.1