US senators target AI, biometric surveillance in the workplace

U.S. senators this week introduced legislation that would place some of the most far-reaching federal limits yet proposed on employers’ use of AI, automated scoring systems, and surveillance technology to manage workers.

The Stop Spying Bosses Act would regulate the workplace data that can feed automated management systems, from productivity scores and location data, to biometric identifiers, communications, and behavioral inferences.

The No Robot Bosses Act would restrict employers from relying predominantly on automated decision systems in consequential employment decisions.

The bills would apply to private employers with at least 11 covered workers, as well as public agencies and certain state, congressional, and executive-branch workplaces. Applicants as well as existing workers would be covered.

“No worker should be fired or disciplined by a machine,” said Sen. Edward Markey. “No employer should be able to watch their workers in break rooms or collect data to predict potential union activity. It’s time to put workers first and put guardrails on these harmful technologies.”

“Workers should be managed by people – not robots,”  added Brian Schatz. “As companies increasingly rely on AI tools to manage their workplaces, our bill protects prospective and existing workers from discrimination by automated decision systems and encourages transparency around the use of these tools.”

“AI should be a tool to help workers, not a weapon used against them,” said Liz Schuler, President of the AFL-CIO.

The Stop Spying Bosses Act would regulate the surveillance architecture behind automated management. Its definition of employee data is deliberately broad. It covers information that identifies or can be linked to a worker, whether collected directly, inferred, or acquired elsewhere.

The definition includes personnel files, productivity and break information, workplace communications, calls, precise location information, sensor data, images, video, thermal data, personality test results, private social media activity, and the inputs or outputs of automated decision systems.

The bill expressly includes biometric information. That term encompasses fingerprints, voiceprints, iris and retina scans, facial or hand mapping or templates, gait patterns, and other personally identifying physical movements generated through technological processing.

Employers could not collect or use employee data to identify union activity, monitor protected concerted activity, determine immigration status, or identify workers who have reported suspected wrongdoing.

The bill would also bar collection intended to ascertain political opinion or activity, religious views, or unrelated identity markers.

It would prohibit employers from using data to predict behavior, emotions or beliefs unrelated to a worker’s job, or to threaten a worker’s mental or physical health.

The off-duty restriction is broad but specific. Employers could not collect employee data while a worker is off duty, including when the worker is off duty in a break room, restroom, locker room, lactation space, prayer space, home, or another remote location.

It would not categorically bar monitoring of remote employees while they are working, although any permitted collection would still have to satisfy the bill’s necessity and least invasive means standards.

Even permitted collection would be constrained. An employer could collect data only when it is primarily used to enable an essential job function, ensure service quality, conduct a periodic performance assessment, comply with law, protect health or security, or administer wages or benefits.

The employer would have to show that the collection is strictly necessary, limited to the smallest amount of data and fewest workers, conducted no more frequently than necessary, and used only for a disclosed purpose.

The bill would generally require deletion of employee data within three years after a worker leaves employment or an applicant’s hiring process ends, unless another law requires retention.

Its transfer restrictions are unusually strict. Employers could not sell or license employee data. Transfers to service providers would require disclosure, cybersecurity protections, encryption, and worker opt-in for each transfer.

The bill would prohibit transfers to third parties except where required by law. Its definition of a third party excludes service providers and government entities, meaning that prohibition does not itself bar disclosures to a government entity.

Workers would be entitled to detailed disclosures explaining what data is collected, how and where it is collected, how often collection occurs, where it is stored, who has access, why it is used and which vendors receive or supply it. Notices would have to be accessible, written in plain language and available in the worker’s primary language.

Workers could request access to their data and correction of incomplete or erroneous records. When an employer uses employee data in a work-related decision, it would have to disclose the categories of data used.

The worker would then have at least seven days to review the relevant information and related aggregated data for similarly situated workers, correct inaccuracies, and seek reconsideration.

The bill would establish a Worker Protection and Technology Division within the Department of Labor. The division would have authority to investigate employers and service providers, require records and prioritize industries with high rates of employee data collection and heightened risks of workplace surveillance related health impacts.

It also would report annually to Congress on workplace surveillance harms and possible remedies.

Both bills include whistleblower protections, Labor Department enforcement, private rights of action, and authority for state attorneys general and state privacy regulators to seek relief.

Both would invalidate predispute arbitration agreements and class-action waivers for alleged violations of their core worker protection provisions. Neither would preempt federal or state law, or limit the authority of the Federal Trade Commission, Equal Employment Opportunity Commission, National Labor Relations Board, or other agencies.

Under the Stop Spying Bosses Act, a first disclosure violation could bring statutory damages of up to $500 for each affected worker. Violations of the data-minimization or worker access provisions could result in damages of $5,000 to $20,000 per violation, rising to $10,000 to $40,000 for willful or repeated violations.

Retaliation against a whistleblower could carry damages of $5,000 to $50,000, or $10,000 to $100,000 for willful or repeated violations.

The No Robot Bosses Act is not an outright ban on workplace AI or analytics. Its central provision states that an employer may not rely predominantly on an automated decision system in making a work-related decision.

It would still permit software to inform decisions, but it does not define how much human involvement would be needed to ensure that automation is not the predominant basis.

The bill defines an automated decision system broadly. It covers systems, software and processes based on AI, machine learning, statistics or other data-processing techniques that produce a prediction, score, ranking, recommendation, evaluation, metric, inference or profile.

It excludes passive computing infrastructure such as web hosting, networking, data storage, and cybersecurity tools that do not influence a decision or collect observations.

The measure would bar employers from using automated systems in ways that violate labor, employment, workplace safety or civil rights law. It specifically prohibits uses that interfere with reasonable accommodations, result in unlawful discrimination or discourage workers from exercising rights under the National Labor Relations Act.

Employers would have to disclose when they use or intend to use an automated system in a work-related decision. The notice would have to identify the system’s inputs, the characteristics it measures, relevant performance standards and metrics, the entity operating it, its trade name, and the process for disputing or appealing a decision.

Applicants would have to receive notice before an employer processes their application through an automated system. Workers generally would receive notice before a decision is made.

For adverse actions such as termination, discipline, reduced benefits, or a more burdensome schedule, employers would have to provide the disclosure at least seven days beforehand, except in cases of egregious misconduct.

Workers managed through an automated system could opt out and instead be managed by a human supervisor with authority to make work-related decisions. Applicants could opt out of automated screening, review or processing and require a human review.

Developers and employers would have to conduct detailed predeployment evaluations before deploying, licensing, or offering automated systems likely to be used in employment decisions.

Those evaluations would examine system design, inputs, testing, demographic representation, worker rights risks, privacy, safety, discrimination, and possible economic effects involving wages, hours, schedules, benefits, training, and advancement.

Employers using those systems would have to conduct annual impact assessments. They would also have to publish redacted summaries of evaluations and assessments, while retaining the underlying records for at least 10 years.

The No Robot Bosses Act would establish a Fairness and Transparency Office in the Labor Department’s Wage and Hour Division. It would also require advance notice and good-faith bargaining with workers’ representatives over the decision to implement covered automated systems and the effects of doing so.

In private suits, prohibited automated system practices could result in statutory damages of $5,000 to $20,000 per violation, rising to $10,000 to $40,000 for willful or repeated violations.

Retaliation could carry damages of $5,000 to $50,000, rising to $10,000 to $100,000 for willful or repeated violations.

The two bills would move beyond the existing model of addressing discrimination or unfair labor practices only after harm occurs. They would impose rules on the data collection, automated systems, and workplace decisions that can shape a person’s job before the harm is complete.

Article Topics

biometrics  |  legislation  |  surveillance  |  U.S. Government  |  workforce management