Editor's Note
Privacy and AI
California is considering restricting AI surveillance in the workplace. This article does a great job explaining the bill, issues with it, and where we're at.
At the same time, Congress is proposing a law that says states can't regulate AI for 10 years, which may or may not be viable, especially if states can show that AI is harming people.
While that all gets sorted, let's talk about privacy and AI.
Under federal law, there are fragments of privacy law in statutes regarding tax and medical information, in common law and IP law regarding commercial use of our names, images, and likeness, and in court cases regarding privacy in our homes, particularly our bedrooms and bathrooms. But there is no express Constitutional right to privacy under federal law.
Many states have more robust privacy laws. For example, in California everyone has a state Constitutional right to privacy which covers all the examples above and other things too.
The big deal with AI is that it collects boatloads of data about us from multiple sources depending on the system. Once it has data about someone, it's often not too hard to connect different data bits and put them together to determine not only personally identifying information, but a whole lot of other things too. And we really don't know very much about what happens to all that data after it's collected.
Imagine the information someone could learn about you just from your emails. There are AI systems, possibly already in your workplace, that collect, store, and use all of that data. Add data about system sign ins, keycards, transcripts of all your video and other meetings, and other information that the employer's computer programs have collected. At some point, some computer system is going to think it knows a whole lot about you. And it will be right. Except that there's no guarantee that what the computer thinks it knows and the connections it makes are also right.
This is especially true in an information environment that is also full of misinformation and disinformation designed to influence people's thoughts and opinions.
The problem is not just protecting people's personal and private information, it's also protecting that information from being dumped into training and other data sources where it can get tied to other data. Pretty soon, nothing is private regardless of what laws say.
As we consider whether and how we use AI, it's also important to understand what new data gets collected, where it goes, what happens to it, and what else it can be used for.
Maybe we don't really want everything on the record. It's worth considering.
- Heather Bussing
California continues to police artificial intelligence (“AI”) in the workplace. Following proposed rulemaking on the use of AI for significant employment decisions, as we reported here, Assembly member Isaac Bryan introduced Assembly Bill 1221 (“AB 1221”) this legislative session. The bill aims to regulate workplace surveillance tools, including AI, and use of employee data derived therefrom. Applicable to employers of all sizes, AB 1221 could present significant challenges for businesses.
Key Provisions of AB 1221
If enacted, AB 1221 would regulate workplace surveillance tools and the data they collect. The bill broadly defines a “workplace surveillance tool” to encompass any system or device that actively or passively collects or facilitates the collection of worker data, activities, communications, biometrics and behaviors and includes incremental time-tracking tools, geolocation, and photo-optical systems, among others. The bill has several key provisions that will impact businesses:
- Notice: Employers will be required to provide written notice to employees 30 days before using any surveillance tool, detailing the data collected, its purpose, frequency, storage, employment-related decisions, and workers’ rights to access and correct their data.
- Data Security: The bill also sets forth robust measures to protect employee data, including required provisions in employer contracts with vendors they engage to analyze or interpret employee data.
- Prohibited Technologies: The bill bans the use of facial, gait, neural data collection, and emotional recognition technologies.
- No Collection of Protected Characteristics: AB 1221 prohibits employers altogether from using surveillance tools to infer an employee’s immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability status, criminal record, credit history, or any other status protected under California’s Fair Employment and Housing Act.
- Limited Use in Disciplinary Actions: Employers are prohibited from relying exclusively on surveillance tools to make disciplinary decisions; to the extent they wish to rely on surveillance data at all for such decisions, employers must notify workers, allow data correction, and adjust personnel decisions within 24 hours if data challenged by the employee warrants it.
- Penalties and Civil Liability: AB 1221 delegates enforcement to the California Labor Commissioner and provides for a $500 civil penalty per employer violation. In addition, AB 1221 would create a separate private right of action for employees, pursuant to which they could obtain damages, injunctive relief, punitive damages, and attorneys’ fees and costs.
Areas of Uncertainty
While AB 1221 aims to establish a framework for workplace surveillance, several aspects of the bill remain ambiguous. For instance, the requirement to provide notice for “significant updates or changes” to surveillance tools is not clearly defined. Additionally, the bill does not specify who is responsible for determining what constitutes an “up-to-date cybersecurity safeguard.”
Also, “injured” employees presumably would be able to recover their “noneconomic” damages for alleged “physical pain and mental suffering” associated with violations of this statute, which is a common remedy sought in employment cases that could substantially increase the liability for employers. These ambiguities could lead to inconsistent enforcement and legal challenges, creating costly uncertainty for employers.
Current Status
As of May 7, 2025, the bill is headed back to the Assembly Appropriations Committee. If passed and signed by Governor Newsom, AB 1221 would establish some of the broadest workplace privacy regulations in the nation.
