Introduction
California’s AB 1008 legislation addresses the classification of personal information, including geolocation data [2], when processed through artificial intelligence systems [2]. It underscores the importance of maintaining the classification of personal information regardless of its processing method. This legislation [2], along with initiatives by California privacy officials, is poised to significantly impact businesses, particularly those utilizing automated decision-making technology (ADMT) in employment processes.
Description
California’s AB 1008 clarifies that personal information [2], including geolocation data [2], remains classified as personal information even when processed through artificial intelligence systems [2]. This legislation emphasizes that personal information can exist in various formats [2], reinforcing the notion that the nature of the data does not change due to its processing method [2]. In addition, California privacy officials are advancing key initiatives that will significantly impact businesses utilizing automated decision-making technology (ADMT) [1], particularly in employment-related processes such as resume screening. The California Privacy Protection Agency (CPPA) has initiated formal rulemaking on ADMTs [1], which are defined as technologies that process personal information to execute or facilitate decisions [1], potentially replacing human judgment [1].
The proposed regulations may allow businesses to bypass the opt-out requirement in certain employment scenarios [1], provided they implement an appeal mechanism for human review of ADMT results [1]. Businesses must identify any ADMTs they currently use and assess their compliance with the new regulations to prepare for potential changes [1]. The CPPA is encouraging detailed feedback from stakeholders during the public comment period [1], which will influence the final regulations [1]. The projected compliance costs for businesses could reach $3.5 billion if the regulations are enacted as proposed [1]. The Transparency Coalition has expressed support for AB 1008 and advocates for similar legislative measures in other states in 2025 [2].
Conclusion
The enactment of AB 1008 and the initiatives by the California Privacy Protection Agency are set to have profound implications for businesses, particularly those employing automated decision-making technologies. These measures emphasize the need for businesses to adapt to new compliance requirements, potentially incurring significant costs. The ongoing rulemaking process and stakeholder feedback will shape the final regulations, which could serve as a model for similar legislative efforts in other states.
References
[1] https://www.fisherphillips.com/en/news-insights/california-regulators-take-aim-at-resume-screening-other-automated-tech-4-steps-for-businesses.html
[2] https://www.transparencycoalition.ai/news/location-sharing-is-creating-a-massive-data-set-based-on-your-private-movements
