CA Privacy Agency Proposes Draft Regulations on ADMT
As the United States grapples with AI considerations at the federal level, California is taking proactive steps through the California Privacy Protection Agency (CPPA). The CPPA has released a set of draft regulations designed to spark discussion and gather public input on proposed rules governing businesses’ utilization of Automated Decision-Making Technology (ADMT) and related consumer rights. The primary objective of these regulations is to enhance transparency and afford consumers greater control over automated systems that influence them.
The draft regulations broadly define “automated decision-making technology,” encompassing any software or process that employs personal data to make or facilitate decisions, including profiling. Key consumer rights stipulated in the proposed rules include:
1. Right to Opt-Out:
Businesses must provide consumers with a means to opt out of specific uses of ADMT, especially those carrying legal or similarly significant consequences. This includes decisions related to financial services, employment, healthcare, and housing. Opt-out rights extend to automated profiling in contexts such as the workplace or public spaces.
2. Right to Access Information:
Consumers possess the right to access meaningful information from businesses regarding the logic, purpose, and impact of ADMT used in determinations about them. Businesses are obligated to elucidate the factors and logic applied by these systems, including the role of human review.
3. Enhanced Transparency:
Businesses are required to furnish advance notice elucidating their intended purpose and use of automated decision-making technologies before processing consumer data. This preemptive disclosure empowers consumers to decide whether to opt out of the ADMT.
4. Special Provisions for Minors:
Behavioral advertising targeted at minors under the age of 16 is subject to additional safeguards and parental consent requirements.
The draft regulations aim to balance consumer empowerment through transparency with businesses’ ability to leverage ADMT for beneficial purposes. As the inaugural state privacy agency in the U.S., the CPPA seeks broad public input on these intricate issues at the crossroads of technology, business, and consumer rights. It’s important to note that these draft regulations may undergo substantial changes before finalization. Concurrently, the CPPA will consider risk assessment requirements during its board meeting on December 8. The CPPA has had a busy year discussing AI-related topics, including cybersecurity audits.
For companies navigating the potential impact of this regulation and others globally, BABL AI‘s team of audit experts is ready to provide valuable insights and assistance.
