AI-Powered Employee Monitoring: Navigating Privacy, Bias + Compliance

Transcript

Eric Felsberg
Principal, Long Island 

Welcome to the We Get AI podcast. My name is Eric Felsberg, and I'm joined by my colleague Joe Lazzarotti. Joe and I are the leaders of the AI group at Jackson Lewis. We're happy to be with you as we try to demystify a lot of the AI developments that we're all experiencing; this is a rapidly moving area. The goal of this podcast is to ensure that we take some of those developments and break them down into easy-to-understand segments. If it goes well, offer you some practical tips on how to navigate this evolving area.

We thank you for joining us. Joe, do you want to say a few words?

Joe Lazzarotti
Principal, Tampa

It's great to be with you. We want to touch on a topic today that is pretty interesting in terms of technology from a whole range of different areas, but it really all centers around monitoring employees and their productivity. There have been some recent AI laws that deal with that a little bit, but just to introduce the topic more thoroughly, there are some platforms that allow employers to get a better, sometimes too much of a, window into what their employees are doing. Then the analysis of that data sometimes is processed by what we're all calling AI. The end result of that, or the purpose of that, is to get a sense of how productive the workforce is, and there are a lot of questions that go into that, like what to measure, how to measure it, and in a lot of cases, are we going too far in measuring it? That's what we were thinking about addressing today.

Felsberg

There are a lot of new technologies that are coming on the scene. It feels like we hear about a new one each day, and we probably do, for that matter. Some of the technologies, to your point, we've been hearing a lot about lately are these monitoring tools. Usually an employer will come to us and will say, we want to use this tool, not for personal employment decision-making. We're using it to streamline operations, and we want to monitor our productivity. Then, you and I will have a discussion with them to try to figure out exactly what that tool does. At least from my perspective, I first want to understand what the tool does. Immediately, what I'm thinking about as it's being described to us is which laws out there potentially address this or are implicated by its use. 

You and I were chatting offline about the New York City AEDT law, which deals with automated employment decision tools for jobs in the city of New York. That applies to hiring, which is a lot of what the AI dialogue has been emerging over the last couple of years. A lot of people are very familiar with the use of AI in the hiring context, but what a lot of people don't spend much time thinking about is that it oftentimes goes beyond that.

In New York City, just using this as an example, it also applies to promotional decisions. If you're thinking, I have this AI tool, it's going to monitor employee activity. Again, it's being used to streamline our processes, make improvements to our workflow, or whatever the reason is for its use. The question that always comes to mind is what is that output that that AI tool is producing? Is it scoring candidates, for example? Is it somehow categorizing more productive employees versus maybe less productive employees? Even though the stated purpose is to look at productivity-type issues and not employment decision tools, it begs the question if later on I want to use some of the output from these AI tools to make promotional decisions. Am I now under the New York City bias audit requirement? Let's say that I am; then, how do I do a bias audit? We understand how to do it with hiring – you take all the applicants that were assessed by the tool, and some received a favorable outcome, meaning a “passing score.” They're moving forward in the hiring process, and others aren't. That's the bias that you're measuring. It's the same thing in promotions, except you're dealing with a much smaller, usually I shouldn't say always, but usually much smaller data set because it's all of the employees that were assessed or reviewed, again, arguably by these monitoring tools. Based on the output, what types of decisions are we making? Are we earmarking certain people for promotional opportunities? Does that become an employment decision tool within the meaning of the New York City law? 

Oftentimes when I'm speaking with clients, I'll have that conversation with them to say similar to what I just described. This may rise to the level where New York City has an interest in regulating, and we have to think about how we're using it.

 Now, oftentimes, Joe, you and I and some of your colleagues on the privacy team, we work pretty closely together. This issue will morph, if you will, from a pure AI issue very quickly into an employee monitoring/ privacy assessment. That's where you come in because there's a series of legal obligations that employers can't forget about in terms of employee monitoring. We thought this would be an interesting topic to talk about that intersection. 

Joe, what do we need to know about monitoring?

Lazzarotti

Businesses have monitored individuals, customers, guests, employees, patients, and people they don't even know in the common areas of their facilities for a long time, whether it's cameras or audio capabilities, now GPS. These platforms, at least the ones that we're primarily covering today, deal with what employees are doing on the company's information systems, their computers, and their networks. 

There are some privacy implications, but as a starting point, at least what I'm seeing is that a lot of times organizations have a pretty fixed idea in terms of what they want to monitor; they come to us with a particular issue they're trying to resolve, like are employees being productive or are they working at all? They're working at home; we don't know what they're doing, and we want to get a better sense for that. Some feel like they want to better protect data – they want to know and get more visibility into what data's being exchanged and primarily disclosed. There are a lot of purposes around it, so they try to fashion the application and what the tool can do to serve those purposes. However, in the process, they're also collecting a lot of information.

On another episode, we talked about how privacy and AI just seem to be more and more intertwined. When you look at, for example, the CCPA, and just to figure out how the law drives some of this analysis. If you are a business covered by the CCPA, you have to think about first: do we need to do a risk assessment, which is part of the regulations that were effective this year, because there are different triggers for that assessment. One is: are you processing sensitive personal information? There are some minor exceptions to that, but this monitoring tool could be collecting and processing that data. Are you recording someone, audio or video, in a systematic way? Again, if you're using one of these platforms where there's a screenshot capture or even maybe keylogging or what have you, you could have a situation where we have to do a risk assessment. 

There's also an automated decision-making technology provision in the CCPA. If the tool is making or substantially making certain decisions, then you also have to do a risk assessment. 

Any one of those three things, if the performance monitoring platform is performing, then you may have to do a risk assessment. That's like just one piece of it. Then, you start thinking about whether it is also capturing a biometric. Sometimes the tool is used to validate the user of a device, so that's capturing maybe a face scan. You start thinking about all of that and these unintended consequences. 

A few years ago, I don't know if it's as big of an issue today under the current administration, but there was a memo put out by the NLRB, the acting general counsel at the time. The memo concerned this idea of protected or concerted activity under the National Labor Relations Act, where employees, and I'm not a labor lawyer, but in general, can communicate together about working conditions. Does an enhanced, robust surveillance environment like these platforms potentially chill those rights where employees feel like they can't engage in that activity because they're under constant surveillance? Those issues arise. At the same time, their activities in the environment could raise issues about how their performance is being evaluated, perhaps through AI, which is where you're getting involved in terms of the bias analysis that has to be done.

At the same time, you also have potential discrimination issues because if the tool is just measuring your performance but not sensitive to why it is that you might not be performing, for example, it's quite possible that you may have a disability that the tool just doesn't evaluate and identify. It just says, you're not doing this task as quickly as your coworkers, so you're ranked lower. It doesn't know why you're not doing that. How do you make that employee understand that, and how do you identify that? You're not now rating someone lower because of that disability and giving them an opportunity to seek some type of accommodation. 

There are all these things going on in these platforms, and privacy is a big part of it. Not so much for the collection of that data, but then what happens to that data? Where does it get stored? Who has access to it? How long do you retain it? Do you disclose it to any third parties and under what circumstances? There are all those questions as well. That's where a lot of companies are having some difficulty: just understanding, weighing the benefits and the burdens of deploying these technologies and even understanding exactly what features they want to turn on and turn off to achieve the results. Those are some of the issues that we're dealing with, certainly from a privacy perspective.

Felsberg

We sound like a broken record to some degree, but it's just this importance of governance. A lot of times when an employer approaches us, they say, my team or part of the business wants to use this AI tool. Can you just give me the notice language and maybe put together a policy for us? We can do that, but again, it's this underbelly that they have to think about. Just taking my original example with New York City. The way New York City's AI law is set up is to measure it for bias, publish that analysis and, setting aside notice provisions and maybe some other things, you've largely satisfied your obligation under New York City law. 

The question then becomes, well, what if the bias audit shows that there's evidence of bias? Do we need to chase that down? Well, you may not find that in the AI law, but from a general employment and anti-discrimination perspective, that's probably something you should be looking into. One of the things that we're seeing, and one of the things that we're trying to convey here, is that when you are establishing a governance structure, we always advocate that you put together a multidisciplinary AI committee. It shouldn't just be living in the IT area. It's important to have an IT presence, but you need to have someone for compliance, maybe privacy, legal, human resources, and any other team whose area of responsibility may be implicated by the use of an AI tool. It's privacy, it's anti-discrimination, and a whole host of other areas that you have to think about beyond just whatever these particular laws say.

In the grand scheme of things, these laws, even though they may be broad in terms of how they define their technology, are actually pretty narrow on what it is that they're trying to regulate. It's all the noise out here that potentially could have even more substantial impact on your organization if we don't get this. For me, that's probably the main point that our listeners need to take away from this.

Lazzarotti

You mentioned the New York City law, but I'm curious what you think about, for example, the California non-discrimination regs that were issued. They didn't establish a bias audit requirement like New York City, but what they said was that the lack of doing that could be used as evidence. Then, in either Colorado or Connecticut, there was something that said the same thing, maybe Colorado. 

What would you recommend from that perspective in terms of how to deal with that from a multi-state perspective when you are deploying this tool? What can you do to best position yourself to have the strongest defense in litigation, regardless of what state or potential plaintiff may come? 

Felsberg

It's a really good question; it comes up one or two times a week. To some degree, there's too much emphasis on the bias audits. I'm not suggesting that they're not important. Yes, potentially, if you should get a claim, a bias audit may be very important and may help your defense. By the same token, it also could memorialize that you did have an impact. You did have at least quantitative evidence of bias. That could be quite damaging if you, as the employer, said, I complied with the New York City law, and  I did the bias order, so let me move on to my next project. There's impact, or there's bias screaming from the page, if you will, whether a litigant gets their hands on it or another regulator; that's an example where a bias audit creates an issue.

The answer to all of this, at least in part, is I would encourage everyone to think through these issues before they press the live button on these tools: should I have this tool validated? Again, we could spend another episode just talking about this precise issue, but the idea of validation within the meaning of the uniform guidelines on employee selection procedures- meaning hire a third-party industrial-organizational psychologist; usually, they are the people that do this work, and they examine whatever the AI tool is and try to figure out whatever it is that it's assessing.

Joe, you and I aren't IO psychologists, but the general concept is they look to see whether these tools are assessing qualities that are necessary to the performance of the job. The output of that process is a validation study. If you should get a claim from a bias perspective or, on like a federal level, an adverse impact or a disparate impact claim, one of the big parts of your defense, a huge part of it, is: do you have a validation study to support the use of this particular tool in the manner that you're using it? That will come in handy even if you don't have quantitative evidence of bias now, but let's say a year from now if you do, then that’s going to be a critical part of the defense.

That's something to think about. These questions need to be thought about, ironed out, and we need to level set on where a risk tolerance is before you use the tool, if at all possible.

Lazzarotti

Performance management tools certainly have a lot of room for examination and careful thought before they're implemented. Certainly, at least from what I've seen, a lot of people in the New York City law didn't realize they were just focused on hiring and recruiting, not promotion. I'm glad you raised that. Thanks for listening in. As always, we welcome any feedback that you have, including questions or thoughts for additional episodes. If you do, you can email us at ai@jacksonlewis.com.