In November 2023, the California Privacy Protection Agency (CPPA) published a set of draft regulations concerning the utilization of artificial intelligence (AI) and automated decision-making technology (ADMT). These proposed rules are still under development, but it is important for organizations to closely monitor their progress as California is home to many of the world’s largest technology companies, and any AI regulations implemented by California could have widespread implications. Additionally, a California appeals court recently ruled that the CPPA can enforce rules immediately upon finalization. By staying informed about the progress of the ADMT rules, organizations can prepare to comply with the regulations once they are enacted. The CPPA is currently accepting public feedback and reviewing the rules, so there is a possibility that the regulations may undergo changes before their official adoption. The information in this post is based on the most recent draft as of 9 April 2024.
California is introducing new rules for ADMT and AI due to the California Consumer Privacy Act (CCPA) not initially addressing the use of ADMT directly. The passage of the California Privacy Rights Act (CPRA) in 2020 amended the CCPA and established the CPPA to enforce CCPA regulations. The CPRA also granted California consumers new rights related to automated decision-making, prompting the development of ADMT rules by the CPPA.
The draft regulations would apply to for-profit organizations operating in California that meet certain criteria based on annual revenue, data sharing activities, and revenue sources related to selling data of California residents. The proposed rules would specifically cover significant decision-making processes, extensive consumer profiling, and the training of ADMT tools. The draft defines ADMT as software or programs that process personal data through machine learning or AI to execute decisions or assist human decision-making.
Covered uses of ADMT include making significant decisions that affect consumers’ rights, extensive profiling to evaluate consumer traits, and training ADMT tools for specific purposes. The regulations aim to protect consumers residing in California, including employees, students, contractors, and job applicants, by granting them rights to access information about ADMT use and opt out of certain automated processes.
The CCPA’s AI regulations require organizations to issue pre-use notices to consumers, provide opt-out options for covered ADMT uses, and explain how ADMT impacts consumers. Pre-use notices must be clear and informative, detailing the specific use of ADMT by the organization. Consumers have the right to opt out of most covered uses of ADMT, and businesses must facilitate this process by offering simple opt-out methods. Exemptions exist for ADMT used in safety, security, and fraud prevention purposes, as well as specific work and school contexts. Consumers also have the right to access information about the organization’s use of ADMT.
Overall, organizations subject to the CCPA’s AI and ADMT regulations must comply with pre-use notice requirements, opt-out procedures, and consumer access rights to ensure transparency and data privacy protection.
Source link
