New Privacy Protections Introduced in Illinois

Illinois has introduced new workplace privacy legislation governing the use of artificial intelligence during the job interview process. The state legislature unanimously passed the Artificial Intelligence Video Interview Act (“the AIVI Act”), HB2557, which imposes consent, transparency and data destruction requirements on employers using AI technology during the job interview process. This comes at a time as many employers are beginning to take advantage of AI for hiring as recently reported by the Washington Post in its profile of the video interviewing software HireVue. 

This most recent development continues a long trend of data privacy regulation in Illinois, starting with the passage of the Personal Information Protection Act in 2006. The state’s reputation for privacy protection has only grown with the passage of the Biometric Information Privacy Act (BIPA) which requires written consent from an individual before collection of biometric identifiers. Collectors of data must also disclose policies for use and retention of the biometric data before collections can take place. Fisher Phillips most recently reported on BIPA in January regarding the Rosenbach ruling that any “aggrieved person” may seek damages under the act based upon the mere “violation of his or her rights under the statute.” Since then, BIPA’s impact has grown as it has proven resilient across multiple jurisdictions. The most recent example being the Ninth Circuit’s August ruling that a class of Facebook users could pursue a class action arising out of Facebook’s use of facial scanning technology.  

Below are several key obligations the AIVI Act imposes on employers:

• Notification– Employers must notify applicants that AI will be used during the video interview for the purpose of analyzing the applicant’s facial expressions and to consider the applicant’s fitness for the position. Applicants must be provided with an information sheet prior to interview detailing how AI works and the characteristics used for evaluation.
• Consent– Applicants must give written consent to be evaluated by an AI program during the interview process. Employers do not need to consider applicants who refuse to consent.
• Limits on AI Use –Employers are not permitted to use AI to evaluate applicants who have not consented to the use of AI analysis. In addition employers may not share applicant videos, except with persons whose expertise is necessary in order to evaluate an applicant’s fitness for a position.
• Data Destruction – If an applicant requests the destruction of a video interview, the employer must comply within 30 days upon receiving the request, as well as instruct anyone with a copy of the video interview to destroy their version of the video.

The AIVI Act is vague in several key areas. Specifically, it does not provide a definitions section, nor does it touch on penalties, enforcement, or provide guidance on notification standards. Given the recent introduction of AI into the hiring process, it is likely the AIVI Act will be updated as necessary to address these deficiencies as the practice becomes more common.

While there is no other state legislation specifically regarding the use of AI and video interviews, other states are paying attention to the use of AI and retention of personal data. The California Consumer Privacy Act (“CCPA”), whose recent amendments were profiled by Fisher Phillips attorneys, requires businesses to implement policies on the use and retention of AI to identify candidates or customers. At the federal level, the EEOC has been taking notice of “big data” technologies and the potential that the use of such technology may be in violation of existing employment laws. While the EEOC does not yet have an official policy on AI-based tools in the workplace, it has expressed the view that employers must consider the potential exposure and risk to privacy when handling employee data generated by this emerging technology.

It remains to be seen what sort of impact the AIVI Act will have on hiring and other employment practices. If the AIVI Act is treated in a similar manner to BIPA however, employers should plan around strict interpretation with a potentially nationwide scope. Furthermore, other states and federal agencies are looking at the use of AI in the employment context and it is likely that they may pursue similar legislation. Employers should therefore evaluate their hiring practices and procedures, and ensure written consent is obtained before using any applications which will collect and store personal data.