We Get Privacy: Episode 19 — Managing Tech-Induced CCPA Risk Assessment Obligations

Transcript

Joe Lazzarotti
Principal, Tampa

Welcome to the We Get Privacy Podcast. I'm Joe Lazzarotti. I'm joined by my co-host, Damon Silver. Damon and I co-lead the Privacy, AI and Cybersecurity group here at Jackson Lewis. In that role, we receive a variety of questions every day from our clients, all of which boil down to the core question of how do we handle our data safely? In other words, how do we leverage all the great things data can do for our organization without running headfirst into a wall of legal risk? How can we manage that risk without unnecessarily hindering our business operations?

Damon Silver
Principal, New York City

On each episode of the podcast, Joe and I talk through a common question that we're getting from our clients, and we talk it through in the same way that we would with our clients, meaning with a focus on the practical. What are the legal risks? What options are available to manage those risks? What should we be mindful of from an execution perspective? 

Joe, our question for today is: how do we prepare to comply with the CCPA's risk assessment regulations?

I know we talked a bit beforehand about how to make these new requirements under the risk assessment regulations more digestible for our clients. What we thought might be helpful is to select some common use cases that are relevant to a lot of our clients, and then do a little bit of a deep dive into whether these types of activities are going to trigger the risk assessment regulation obligations.

Joe, at a high level, for people who may not be familiar, could you talk a little bit about what types of activities, generally speaking, might trigger the obligation to do a risk assessment?

Lazzarotti

I want to take a minute also to talk about how this came about. There were some regulations finalized at the beginning of this year under the CCPA, and there are staggered application dates by which you have to start completing these assessments. The rules became effective January 1, 2026, but as a practical matter, the first risk assessment need not be completed until after 2027. The expectation is that they would be completed all along.

The essence of the risk assessment is to evaluate the processing of personal information. Remember, this is the California Consumer Privacy Act. The concern is: are we burdening a person's privacy with certain types of processing that the regs have identified as higher risk? If that burden is greater than the benefit that the business gets from that particular use or processing of personal information, it needs to restrict the processing to align its benefits with the burden on consumer privacy. Some of the examples of things that

The regs talk about where risk assessments are required are instances where you're selling or sharing personal information, or using automated decision-making technologies in certain situations, or even certain systemic observation when you're profiling someone in certain situations, such as video or audio monitoring. That's another example. There are a few others, but the idea is the rules have identified some circumstances where some type of analysis and then a report, including a report to the California Privacy Protection Agency once that's completed, is required.

Those are some of the areas, Damon, where the rules have said that you have to conduct this risk assessment. Maybe just thinking about that, are there any particular use cases that you've come across that you feel like it's worth digging into because I imagine that some of the things we've talked about may trigger more than one of the prongs that might require risk assessment.

Silver

That is surprising for many of our clients as we're talking it through; they may realize that there's some aspect of one of these activities that could potentially trigger a risk assessment obligation, but oftentimes it is multiple. The relevance of that is, one, in doing the risk assessment, you have to be accounting for these different higher-risk activities. Also, it makes it much more challenging to develop a process that would keep you out of scope. If you were just dealing, for example, with the collection and processing of sensitive personal information, maybe you could structure the use case so you're no longer doing that. However, if you're also dealing with systematic observation and use of an ADMT, all of a sudden you kind of have to unravel the whole use case to stay out of having this obligation, at which point it's probably not worth doing. You're better off just moving forward and doing the risk assessment.

One example that has come up pretty regularly, and maybe we can talk about this in conjunction with another one because there's a lot of overlap, is many of our clients want to use AI tools in connection with conducting video interviews. Oftentimes these are at the early end of the application process to screen out who should be invited for in-person interviews. Sometimes these tools can carry on a full conversation without any human being involved in the meeting. Other times a human is involved, and the AI is doing analysis of the candidates' responses and maybe their tone and facial expressions and various other things.

Then related to that, more broadly, AI meeting assistants are being used in the context of all types of meetings to perform various functions like creating a transcript or creating meeting notes and to-dos and stuff like that.

Looking first, Joe, just at the narrower context of a video interview, what are some potential triggers for the risk assessment requirement if you are an employer using an AI-assisted tool in your video interview process?

Lazzarotti

Damon, gets to the point that you raised. This is a great example of: if we don't try to score someone's facial expressions, maybe we're out of the woods on doing a risk assessment. However, then you just have to say: we're arguably systematically observing someone and recording their video and audio, and that's another trigger. Of course, if you take that away, the whole video goes away. 

Then, there's the other prong of trying to determine whether you're processing sensitive personal information and the tool happens to be capturing some type of biometric, if it's making some facial measurement or, depending on the technology, if you determine it's a biometric.

By the way, the definition of "biometric" in the CCPA is a little different from what you may be used to in Illinois under the Biometric Information Privacy Act. Those are biometric information, sensitive information processing, systematic observation and ADMT; these are all triggers for this particular tool. If you're going to go forward with that, you'd probably want to be thinking about doing that risk assessment for something like that.

Silver

This is going to come up a lot as we go through these use cases, Joe: figuring out whether the risk assessment is necessary. You really do need to dig into how the tool is going to be used. For example, are you collecting biometric information, whether it's voice prints or facial recognition, to identify the various speakers? Are you engaging in some type of systematic observation? Is that the whole function of the tool? Does it do some type of scoring or ranking or something else like that using AI or another ADMT that is going to factor into your decision-making? A lot of clients mistakenly think that the only decision is rejection: is the tool automatically rejecting the candidate? A lot of times, these tools don't do that, but the law is drafted much more broadly than that. If you're getting scores or rankings, and as a practical matter, those are the people that you're going to look at first and advance and probably hire in the vast majority of contexts. Effectively, the tool is, at least arguably, making the decision for all the people who received lower scores or rankings.

You do need to look at all those factors, both to figure out whether a risk assessment's necessary, but then also if you determine a risk assessment is necessary, those are all going to be factors that you have to think about in going through that analysis that you discussed before to balance the risk to the individual's privacy against the benefit that the tool is providing to the company and also to the individual.

Lazzarotti

That's a great point, Damon, because we're not getting too deep into this part, but we're just trying to identify the types of use cases that might require a risk assessment. When you get into that, if you have to do it, the obligation to prepare that report will require you to be more specific. You can't just say, the purpose of this use case is to facilitate hiring. There may be more to it than that, and you can't just give some general statement. The rules say you have to really outline more specifically what those purposes are. You really want to be thinking ahead, saying, well, what is it that we have to really think about? Who has to be involved? There are a lot of pieces to the puzzle once you sit down and put pen to paper to do the actual assessment. You want to be thinking about that when you're evaluating that use case.

As a related one, what are you thinking about a company using an applicant-scoring or ranking-type assessment? What are you seeing there in terms of assessing the need for an assessment in that case?

Silver

Again, in this context, it is important to look into the details of what's really happening. If again it's a clear binary of the tools advancing or rejecting someone, that's going to be obvious. It seems like most of the vendors out there realize that that is going to be an impediment to their tool being used at scale. Most of them don't do that, but they do provide some form of scoring, ranking or match assessment.

Then the question really becomes, how is that used by the company? Are they treating that as just one of multiple factors they consider and doing independent analysis to decide who gets advanced? For example, there's one tool I looked at recently that provided a match score, then highlighted the resume side by side with the job description and explained why it thought someone was a good or bad match for that job description. It made it very easy. It pulled the information from the resume so the recruiter could take a look. It was, in a way, both performing the function of giving a score or ranking, but also of just surfacing information, a more procedural task.

Then the question becomes: does the recruiter actually look at the raw inputs from the resume and decide on their own whether this person is a good match or not? Do they document that they did it? Or, as a practical matter, are the people who get the highest scores just moving along because the recruiter is overburdened and doesn't really have time to go through the process of reviewing the resume and documenting it? A lot of the discussions I've been having about these types of tools have really focused on the process the client's going to put in place. Can they make an argument that, based on what they do with the output from the tool, it is not really significantly contributing to the ultimate decisions made? It's more about surfacing information the recruiting team is considering alongside other factors.

Lazzarotti

It's interesting the example you gave, Damon, because if you're surfacing that resume as part of the process, it seems like you really have to go through the actual use case and think about each step of the way because you may not realize that a person's ethnic origin or maybe their religious beliefs are reflected in the resume, just because of maybe groups that they belong to or whatnot. That may just not have occurred to you, but now that particular use case involves processing sensitive personal information, as defined specifically in the CCPA. That might be itself – that one piece, maybe a small add-on- that really doesn't form the essence of the actual use case, but is nice to have – could trigger a requirement to do a risk assessment. I definitely see a lot of that with a lot of technologies, just trying to really understand how they're being used.

Another one is dash cams. We both worked quite a bit with those. I don't know about you, but we very often get the question from our clients who just have one issue that's really driving the need for a dash cam. It's like, we really have to track where our vehicles are, or we really want to be able to, for insurance purposes, make sure we know what happened, and so there's a camera, so is it okay to have a camera?

For me, a lot of times, before we even get any further down the road on CCPA, it's like, what is the device doing? Let's talk about that. In most cases, our contact isn't the one who's really in the weeds on this. They're just bringing us the issue, and they're not familiar with the technology as a whole.

Have you run into the same thing about what the tool is actually doing? We usually end up finding out it's more than just having a camera.

Silver

100%. That is usually the initial question: we're going to be video recording, and we were video recording outside the vehicle; now we're going to video record inside, or we had video on, and we want to add audio. Do we need to provide some type of notice to the driver and the other people in the vehicle? The answer there is yes; that's a good idea, and it might be required, particularly for the audio.

Then, when you ask some of the follow-up questions- and a lot of times a client didn't even ask these questions themselves, so this is all new information being surfaced- it turns out that the dash cam is also collecting biometrics. Many of them use biometrics, facial recognition, to identify the driver. There's the systematic observation piece, obviously, again, and many of them have a feature that uses AI or another ADMT to analyze driver behavior to see whether they're harshly braking, changing lanes, or seem distracted. Many of our clients are using the outputs from the dash cam's AI analysis as a factor in deciding whether to discipline or promote an employee. It can impact compensation. This relatively simple question of, do we need to give some type of short notice because we're video recording in the cabin, ends up having many more layers to it.

You made a great point earlier, Joe, that some of these tools have lots of features, and some might be just nice to have. They're not essential; they're nice to have. Someone thinks biometric driver identification is a good idea, so let's just do that. Obviously there are a lot of compliance hurdles that come along with that decision. It is really valuable to peel back what the tool will do and decide which features are must-haves for you. For the others, do a cost-benefit analysis to determine whether you're getting enough value from the additional functionality to justify what you have to do from a compliance standpoint.

Lazzarotti

That also becomes an issue for other use cases. We talk about a common thing that's been going on for a while, recording calls, and that's been fueled by COVID. We have video conferences, and now we have AI recordings, and there's a whole bunch of issues there. Again, sometimes people in business just aren't thinking about many of those issues because this is about the privacy of personal data. This is not necessarily about the AI. This is not about the recording per se. It's what are you recording? What are you capturing? That's really the balance that has to be struck: whether you have to do a risk assessment and, if so, how to actually do that assessment to think about how these interests are being balanced in this process.

Damon, can you talk a little bit about what you're seeing with targeted advertising in terms of doing this analysis?

Silver

Targeted advertising has been popular for a long time. It's getting increased attention recently for a reason unrelated to CCPA. There have been all these claims made under the California Invasion of Privacy Act and then similar laws in other states as well as a few federal laws that basically say that if you're going to collect and disclose to outside parties data related to someone's visit on a website or their activity on the website, you need to get their consent. If you don't, it's essentially a wiretap violation.

There's also a number of CCPA considerations that come up when you're using these technologies, which most site owners do. Even in the B2B context, most sites at this point are running various cookies and pixels for analytics and targeted advertising. In the targeted advertising context, you again have that systematic observation trigger, as we discussed in the context of recording video conferences. 

You also have the “sharing of data.” Under the CCPA, there's a defined term, "sharing of data," which means disclosure of data for purposes of cross-context behavioral advertising, which is the same as targeted advertising. If you are using trackers for that purpose, that in and of itself is going to be a trigger. 

Then you also potentially have the processing of sensitive personal information, which includes precise geolocation. A lot of times, particularly when tracking on a mobile device, it's very valuable to the business to know how close the visitor is to their store, say, so they can show them content that will be relevant and hopefully bring them into the store. There could also be other types of sensitive personal information, such as someone's racial or ethnic origin or religious beliefs, depending on the site's content. 

This is an area where many website owners are very likely to have a risk assessment obligation. It's probably not the key thing they're thinking about with respect to those technologies, because, again, with all this recent litigation, the focus has been on consent management, the banner and all of that. This is another piece of the puzzle, another compliance challenge related to the use of those types of website trackers.

Joe, just to close this out, and I know you recently wrote on this, a lot of our clients are using various employee productivity monitoring tools on their systems. Can you talk a little bit about what those look like and the impact those might have on risk assessment requirements?

Lazzarotti

These are software platforms that integrate with the company's environment and can analyze and track all kinds of activity by users of the company's systems. Whether that's which applications they've been in or how long they can record video, they can take screenshots of what the user has on their screen, including a Facebook Messenger conversation. The idea is that we have a lot of remote workers, for example, and we want to see what they're doing, assess whether they're productive, and make sure the person using the computer is the right person. You wind up touching on many of the things we talked about regarding triggering a risk assessment under the CCPA. You could be processing sensitive personal information. You could be involved in systematic observation. The tool could be using an ADMT. There are a number of triggers that, by using that tool, you might have to assess to address those uses and triggers. 

In closing, I would say that we talked a bit about inventorying use cases on a prior episode, and it's almost like you have to add in a slice of that inventory tracking mechanism, whatever you came up with, to add to each of the use cases: do I have to do a risk assessment for this use case and what's involved in that? There really is becoming a bit of a challenge in terms of not only saying what the laws that apply to this use case are, but also knowing which law applies to it. Now, what other steps do we have to take? We haven't gotten into this too much, but it's not a once-and-done; It's every three years, or if there are some material changes, you have to do a new assessment. It has to be documented. The performance management platforms are ripe for this kind of activity.

Silver

That's a great place to close it out, Joe. Thanks everyone for tuning in. As always, if you have suggestions related to this episode or future topics you'd like us to cover, please reach out to us at privacy@jacksonlewis.com. Thanks, Joe.