Illinois Becomes the Second State to Enact Broader Regulations on AI

in /by

Illinois Governor J.B. Pritzker signed House Bill 3773 into law on August 9, 2024, expanding the state’s regulations on the use of artificial intelligence in the employment process. This makes Illinois the second state to pass broad legislation on using artificial intelligence (“AI”) in employment decisions. In May 2024, Colorado enacted the Consumer Protections for Artificial Intelligence into law.

Illinois’ latest AI regulations will go into effect on January 1, 2026, introducing amendments to Article 5, Section 2 of the Illinois Human Rights Act.

What employers need to know about House Bill 3773

The Act includes several critical provisions aimed at regulating AI during the employment decision-making process to create a fairer experience for candidates: 

  • Discrimination prevention: Employers are prohibited from using AI in a manner that discriminates against employees based on a protected class. 
  • Permissible scope of use: The Act covers the use of AI in various employment-related activities, including: 
  • Recruitment 
  • Hiring 
  • Promotion 
  • Renewal of employment 
  • Selection for training or apprenticeship 
  • Discharge 
  • Discipline 
  • Tenure 
  • Terms, privileges, or conditions of employment 
  • Prohibition on Zip Code Use: Employers are prohibited from using zip codes as a proxy for protected classes. 
  • Notification Requirements: Employers must notify employees that AI is being used for specified purposes, although the Act does not elaborate on the scope or details of this notice requirement. 

The Illinois Department of Human Rights is granted rule-making authority to implement the Act, subject to the Illinois Human Rights Act’s enforcement and remedies provisions. For more detailed information, you can find the full text for House Bill 2773 here.

Illinois may be an early adaptor to a growing trend 

The Act is part of a broader trend in the United States, where states are leading regulatory efforts on AI. Starting on February 1, 2026, the Colorado Artificial Intelligence Act will also impose new regulations on developers and deployers of high-risk AI systems, such as those with algorithmic discrimination risks. Illinois, following closely behind Colorado with similar statewide industry regulations on the use of AI, may be an indicator that more laws on the use of AI will follow.  

Illinois’ decision highlights increasing scrutiny of the use of AI in employment decisions, creating a more pressing need for compliance with emerging laws. Employers using AI in their hiring practice should consult with their legal counsel to review any laws that might affect the use of AI during any part of the employment process. 

Montana’s 2024 Consumer Data Privacy Act

in /by

Montana has joined the growing list of consumer data privacy laws enacted throughout the country, creating new guidelines for consumer data privacy. Minnesota, Rhode Island, Connecticut, and other states enacted similar data privacy laws earlier this year. 

The Montana Consumer Data Privacy Act (MCDPA) went into effect on October 1, 2024. This article covers a few key factors for employers to consider.

What employers need to know 

The Act is intended to give consumers more control and privacy over their personal data by regulating businesses across the state. Although this is a positive step for protecting consumer data and privacy in Montana, it comes with new regulations aimed at employers in the state. The MCDPA applies to entities that: 

  • Conduct business in Montana or produce products or services targeting Montana residents. 
  • Control or process the personal data of more than 50,000 consumers, excluding data processed solely for payment transactions. 
  • Control or process the personal data of more than 25,000 consumers and derive over 25% of their gross revenue from the sale of personal data. 

Consumer Rights 

Montana consumers are granted several rights under the MCDPA: 

  • Confirmation of Data Processing: Consumers can confirm if their data is being processed unless it violates trade secrets. 
  • Correction of Data: Consumers can correct inaccuracies in their personal data. 
  • Deletion of Data: Consumers have the right to delete their personal data. 
  • Access to Data: Consumers can request a copy of their personal data under certain circumstances. 
  • Opt-Out Rights: Consumers can opt out of the sale of their personal data, targeted advertising, or profiling for automated decision-making with significant impacts. 
  • Authorized Agents: Consumers can designate an authorized agent to submit opt-out requests on their behalf. 
  • Appeals: Consumers can appeal a controller’s refusal to act on a request within a reasonable timeframe. 

Controller Obligations 

Controllers include employers and businesses responsible for processing personal data. Below is an overview of regulations to which controllers must adhere: 

  • Data Collection and Processing: Limit data collection and process data only for disclosed purposes unless consumer consent is obtained. 
  • Data Security: Maintain administrative, technical, and physical data security practices. 
  • Assessing Data Protection: Conduct assessments for targeted advertising, sale of personal data, and high-risk profiling. 
  • Disclosure: Clearly disclose the sale of personal data or processing for targeted advertising. 
  • Consent for Sensitive Data: Obtain consumer consent before processing sensitive data. 
  • Opt-Out Mechanism: Provide an easy-to-use opt-out mechanism comparable to the consent mechanism. 
  • Universal Opt-Out: By January 1, 2025, allow consumers to opt out of targeted advertising or data sales through a universal mechanism. 
  • Privacy Notices: Post privacy notices with specific content requirements. 
  • Response to Requests: Respond to consumer data requests within 45 days, with a possible 45-day extension. 
  • Notification of Declines: Inform consumers within the same 45-day period if a request is declined. 
  • Authentication: Respond to authenticated requests or notify consumers if more information is needed for authentication. 
  • Appeals: Respond to consumer appeals within 60 days. 
  • Contracts with Processors: Enter into contracts with specific terms regulating data processing. 
  • Children’s Privacy: Comply with the Children’s Online Privacy Protection Act of 1998. 

Employers have until January 1, 2025, to comply with the deadline for universal opt-out mechanisms and new regulations under the law. Take a closer look here to read the full details of Montana’s Data Privacy Act.

Expanding data privacy laws across the country

The MCDPA is one of the latest laws geared toward data and consumer privacy protection. As the topic of data privacy continues to stay in the spotlight, understanding and complying with data privacy regulations in the states where you operate or hire is essential to protecting consumer data, maintaining trust with employees and consumers, and remaining legally compliant. 

With an uptick in data privacy laws seen in 2023 and 2024 following the Executive Order to Protect Sensitive Bulk Data, it is probable that more state-wide data privacy laws may be implemented in the near future. Employers who hire, operate, and target consumer data in Montana or other states with similar data privacy laws should consult their legal counsel to ensure compliance and determine how new data privacy laws apply to them.

New Background Check Requirements for Health Professionals in New Jersey

in /by

Signed into law on September 12, 2024, New Jersey enacted a new background check bill that mandates criminal history background checks for a broader range of healthcare professionals seeking licensure in the state. The law expands a previous law enacted to enforce background checks for healthcare professionals. New Jersey has expanded the law to enhance patient safety, ensuring that individuals with certain criminal histories are not licensed to practice in these fields.

Below is an overview of the timeline of events leading up to the approval of New Jersey’s new healthcare regulations: 

  • January 25, 2024: Introduced in the Senate, referred to Senate Commerce Committee 
  • June 10, 2024: Reported from Senate Committee, 2nd Reading 
  • June 26, 2024: Recommitted to Senate Budget and Appropriations Committee, reported with amendments 
  • June 28, 2024: Passed by the Senate (40-0), received in the Assembly, substituted for A1128, passed Assembly (73-0-0) 
  • September 12, 2024: Approved and signed into law

Who does the amendment apply to? 

Effective immediately, the new law expands the background check requirement to include several categories of healthcare professionals who were previously exempt. Specifically, the bill impacts: 

  • Applied Behavior Analysts 
  • Art Therapists 
  • Dieticians and Nutritionists 

Under the expanded definitions and regulations, professionals in these fields are required to undergo a criminal history record background check as part of their licensure or renewal process. This check will be conducted through the New Jersey State Police and the Federal Bureau of Investigation (FBI). 

Compliance with the new background check requirement is essential for practitioners in the affected fields. Failure to pass the background check or refusal to consent to screening can potentially result in: 

  • Denial of a professional license 
  • Suspension of a professional license 
  • Revocation of a professional license 

To read the full text of the law, take a closer look here.

Healthcare regulations across the U.S.

As with many other legal regulations and trends, the expanded regulations for background checks in the healthcare industry are not isolated to New Jersey. In April 2024, Florida also expanded regulations impacting a wide range of healthcare professions and facilities that will go into effect starting July 1, 2025.

Employers operating in multiple states should stay ahead of laws expanding healthcare regulations and patient safety to ensure compliance with relevant and upcoming laws. As legal requirements in healthcare evolve, it is critical to stay prepared with the help of your legal counsel. One Source will attempt to monitor and provide updates on the situation and other healthcare screening requirements as they evolve.

In need of background checks to meet healthcare-specific regulations? Contact us.

 

Pittsburgh Limits Employer Drug Testing for Medical Marijuana Patients

in /by

The Pittsburgh City Council passed an ordinance that significantly limits circumstances in which employers are permitted to administer pre-employment drug testing for medical marijuana patients. Notably, Pennsylvania has had protections set in place for medical marijuana patients under Chapter 21 of Act 16 since 2016. Still, the previous guidelines did not explicitly prohibit testing medical marijuana patients for cannabis use.

The new measure specifically aims to protect medical marijuana users from workplace discrimination. It limits the circumstances under which employers are permitted to conduct cannabis drug tests, aligning employee rights with legalized medical marijuana use in Pittsburgh. 

Quick summary of the ordinance

Mayor Ed Gainey signed the ordinance on September 24, 2024, after it was unanimously passed by the Pittsburgh City Council, putting it into effect immediately. The ordinance prohibits requiring pre-employment cannabis testing or testing during employment for medical marijuana patients. The ordinance applies to most employers, employment agencies, and labor organizations with five or more employees. 

The full details of the Pittsburgh Medical Marijuana Employment Protection Ordinance are available in the City Council meeting notes here.

Room for employer action

Under the new ordinance, employers are generally restricted from requiring pre-employment cannabis testing or testing during employment as a condition of continued or prospective employment. However, there are notable exceptions: 

  • Regulatory compliance: Positions subject to drug testing regulations by the U.S. Department of Transportation or Pennsylvania Department of Transportation. 
  • Firearm requirements: Positions that require the employee to carry a firearm. 
  • Collective bargaining agreements: Employers part of a valid collective bargaining agreement addressing pre-employment drug testing. 

The new ordinance does not alter the definition of “employer,” which excludes further excludes certain religious, fraternal, charitable, and sectarian organizations. 

In addition, the 2024 ordinance also allows disciplinary action and testing medical marijuana patients in certain situations, including: 

  • Reasonable cause: Employers may conduct drug testing if there is reasonable cause to suspect an employee is under the influence of a drug while at work or after a workplace accident. 
  • Disciplinary actions: Employers can take disciplinary action against a medical marijuana patient if their conduct falls below the standard of care normally accepted for their position while under the influence in the workplace. 

The ordinance also notably allows room for employer rights to test for the suspected use of other illegal narcotics on the job and does not require businesses to permit the use of medical marijuana during work hours or on the premises. 

The bigger picture

Limiting cannabis testing for certain roles is a significant development for the City of Pittsburgh. The ordinance aligns the city with Pennsylvania state law, which permits medical marijuana use outside of work with boundaries for employer action. 

Employers hiring or operating in Pittsburgh should consult their legal counsel to determine whether this ordinance applies to them. Additionally, limitations on employer drug testing in Pittsburgh is just one moving part of a nationwide movement to align with changing cannabis use laws. Employers in areas with legalized medical or recreational cannabis use may want to keep an eye on current laws and upcoming changes to employee protection laws as the landscape evolves.

 

Utah Sets Boundaries on Generative AI

in /by

As AI systems and technology use continue to soar, more regulations and guidelines follow. Utah’s SB 149, also known as the AI Policy Act, mandates disclosure to any person who is interacting with generative AI. The Act is effective as of May 1, 2024, and has been implemented to promote transparency and fairness in AI-driven communications.

Below is a quick timeline of events leading up to SB 149:

  • Early 2023: Initial discussions and drafting of the AI Policy Act.
  • March 2024: SB 149 passed in the Utah Legislature.
  • May 1, 2024: SB 149 went into effect.

Utah is one of the first states, alongside Colorado, to enact a law governing the use of AI.

What is “Generative AI”?

Utah’s AI Policy Act defines generative AI as any artificial system that:

  • is trained on data;
  • interacts with a person using text, audio, or visual communications; and
  • generates non-scripted outputs with intentional likeness to human interaction, with limited or no actual human oversight.

This broad definition encompasses various applications, from marketing bots to customer service responses.

Guidelines for Employers 

In addition to the general terms and usage of AI, employers should be aware of guidelines, enforcement, and penalties regarding Utah’s AI Policy Act.

Disclosures 

  • General Disclosure: Companies must “clearly and conspicuously” disclose the use of generative AI, if it is used to interact with a person and if that person asks.
  • Regulated Professionals Disclosure: Any person who provides the services of a regulated professional, meaning any occupation requiring a license or state certification, must prominently disclose the use of generative AI at the start of the interaction.

Disclosures must be prominent and clear and cannot be solely included in terms of use or privacy notices.

Enforcement and Penalties 

  • The Division of Consumer Protection may impose fines of up to $2,500 per violation and seek additional remedies such as injunctions and disgorgement (seizure of illegally obtained profits).
  • The Attorney General’s office can seek civil penalties for up to $5,000 for each prior administrative or court order violation.

To read the full details of policies, regulated professions, and guidelines for employers, take a closer look here.

The Office of Artificial Intelligence Policy

Utah law also establishes a state Office of Artificial Intelligence Policy (OAIP) under the Act, which will oversee a learning laboratory to assess risks and best practices related to AI. The OAIP will also have rule-making authority over AI issues, consult with businesses and stakeholders about proposed regulations, draft rules for participation in the learning lab program, and define criteria for organizations to follow when seeking mitigation of regulatory requirements or violations.

Importance for Human Resource Professionals Nationwide

New laws and regulations regarding the use of AI, such as Utah’s SB 149 and Colorado’s SB 24-205, can potentially set a precedent for future legislation in other states addressing responsible AI use on a larger scale.

These laws highlight the need for transparency, fairness, and accountability in AI systems, particularly those used in direct human interactions and concerning use in regulated professions. As states like California, Connecticut, and Virginia propose similar laws in 2024 to combat the misuse of AI, the urgency for clear disclosure requirements appears to be a growing trend. Employers in Utah should consult with their legal counsel to review laws regarding the use of AI in business and employment practices.

One Source will attempt to provide updates on AI regulations in Utah and across the United States as they emerge.

 

Changes to California’s Fair Employment & Housing Act

in /by

On September 28, 2024, Governor Gavin Newsom signed Senate Bill 1100, an amendment to California’s Fair Employment & Housing Act (FEHA), introducing a significant change to promote fairness and inclusivity throughout the hiring process.  Under the amendment, starting in 2025, California will prohibit employers from requiring a driver’s license in job advertisements and applications unless driving is a job function for the position that cannot be performed by alternative means.

An overview of California’s Fair Employment & Housing Act 

Below is a quick timeline of California’s Fair Employment & Housing Act: 

  • 1959: The Fair Employment Practices Act enacted to address workplace discrimination 
  • 1963: The Rumford Fair Housing Act set boundaries on discrimination based on race, religion, national origin, and ancestry. 
  • 1980: The FEHA was enacted, combining the Fair Employment Practices Act and the Rumford Fair Housing Act. 

Since then, the FEHA has been a center point for California’s anti-discrimination laws. Multiple changes have occurred over the past few years alone, such as AB 2188  in 2024, which prohibits discrimination against off-duty cannabis use in most circumstances, and updates to the Fair Chance Act in October 2023. 

On September 28, 2024, Governor Gavin Newsom signed SB 1100 into law, further amending the FEHA to limit the circumstances under which an employer can require a driver’s license in job advisements and applications. 

Purpose and employer restrictions 

California has historically prohibited discrimination against individuals without a standard driver’s license to provide more opportunities for Californians with non-standard driver’s licenses who can provide proof of residency in the state but not national citizenship. This recent change adds an additional layer of protection to avoid candidate discrimination against individuals without any form of driver’s license at all.

The primary goal of the amendment is to provide equal access to employment opportunities for individuals who do not possess a driver’s license and those who may rely on alternative transportation methods such as ride-hailing services, public transportation, biking, and walking. Employers are also prohibited from including a statement in job advertisements, postings, applications, or other materials that an applicant must have a driver’s license unless: 

  • The employer reasonably anticipates driving to be one of the job functions for the position.
  • The employer reasonably believes that satisfying the job function using alternative forms of transportation (such as ride-hailing, taxis, carpooling, bicycling, and walking) would not be comparable in travel time or cost to the employer.

These changes to California’s Fair Employment Act are effective January 1, 2025. To learn more details, read the full text of the amendment here.

The future of anti-discrimination law

Hiring professionals in California should monitor the status of Senate Bill 1100 as the law’s interpretation and employer boundaries are set in future rulings, as well as other future updates to the Fair Employment & Housing Act.

While this amendment specifically applies to California, it draws attention to an often-overlooked barrier to inclusivity and non-discrimination in the workplace for candidates who do not or are unable to drive. Employers in other states should also be aware of these changes, as they may influence future legislation in other states and jurisdictions.

 

This article is for informational purposes only and does not constitute legal advice. Employers should consult their legal counsel before taking any action. 

 

Annual Disposal of E-Verify Employer Records: What You Need to Know

in /by

The U.S. Citizenship and Immigration Services (USCIS) annually disposes of E-Verify employer records that are ten years old or older. This process is conducted by the National Archives and Records Administration (NARA) records retention and disposal schedule (N 1-566-08-7) established in 2008. 

The primary reason for disposing of E-Verify employer records is to reduce security and privacy risks associated with the U.S. government’s retention of personally identifiable information (PII). 

What employers need to know 

Your company’s program administrator or corporate administrator is permitted to download and save your company’s employee historical records report, which includes the following information: 

  • Company name and location 
  • Initiated date and verification case number 
  • Employee name and date of initial resolution 
  • Date of additional resolution and final status 
  • Case closure date and case closure description 

Form I-9 compliance: Employers are required to record or print and file all E-Verify case numbers for each corresponding Form I-9, Employment Eligibility Verification. 

Disposal of records: USCIS disposes of E-Verify records that are ten or more years old each year. Employers have until January 5, 2025, to download records for E-Verify cases last updated on or before December 31, 2014. On January 6, 2025, USCIS will dispose of these records. 

Exporting and retaining E-Verify case information: 

  1. Ensure your company’s program administrator or corporate administrator downloads and saves the Historic Records Report by January 5, 2025. 
  1. Record or print and file the E-Verify case number for each corresponding Form I-9. 
  1. Retain the Historic Records Report with the corresponding Forms I-9 in a secure location. 

For detailed instructions on downloading and retaining records, see the official E-Verify Records Retention Instructions.

 

This article is for informational purposes only and does not constitute legal advice. Hiring professionals, HR professionals, and administrators should consult their legal counsel to ensure all actions comply with the law.