Legal Pitfalls Of AI: What Employers Must Know

Considerations when Implementing AI in your workplace

According to several recent surveys, over 50% of employers utilize artificial intelligence (AI) in some fashion in their businesses, often in an effort to increase operational efficiencies and innovative solutions. However, implementing AI into a company’s business framework can create significant legal implications, which companies must identify and consider to ensure compliance and protect organizational interests as well as employee and customer rights.

The following are three legal considerations for employers as they integrate AI into their business models.

1. Compliance with State and Federal Anti-Discrimination Laws    

AI applications, including automated decision-making systems in hiring, can subject employers to significant legal jeopardy if used to violate state and federal anti-discrimination laws. 

In a representative case in 2023, a tutoring company agreed to settle an AI lawsuit with the Equal Employment Opportunity Commission (EEOC) following multiple EEOC warnings to employers about potential discrimination related to the use of AI in the hiring process. The Complaint alleged iTutorGroup programmed its application software to automatically reject female candidates aged 55 and over and male candidates aged 60 or older. A rejected candidate discovered they were a possible victim of discrimination after re-applying for the same position using a more recent birth date and receiving an interview. Although iTutorGroup denied fault, it ultimately agreed to pay $365,000 to applicants who were denied employment for allegedly discriminatory reasons. 

Following the settlement, the EEOC issued a release stating: “Age discrimination is unjust and unlawful. Even when technology automates the discrimination, the employer is still responsible. Workers facing discrimination from an employer’s use of technology can count on the EEOC to seek remedies.”

Similarly, Workday, a commonly used HR software platform for employers, was sued in a class action lawsuit on the theory that its AI tools were applied in a discriminatory fashion to exclude job applicants based on their age. Workday has denied the allegations, including on the basis that it cannot be found liable as it functioned as a vendor rather than an employer. 

As evidenced by these examples, employers must ensure their AI tools do not result in discriminatory practices or outcomes, as prohibited under applicable anti-discrimination statutes.

2. Data Privacy and Security for Employees and Customers

The use of AI often involves processing and storing personal employee data. As such, the legal impact of AI related to data privacy and security can be significant. Companies must ensure that privacy laws are not breached in the collection, storage, and use of personal data. Failure to competently manage data can result in expensive and time-consuming litigation for employers.  

Employers must ensure transparency in how they use employee data and obtain proper consent when necessary. Employers must also be ethical in data collection practices, including collection from employee emails, performance reviews, and personal information, particularly if the information is to be used to train AI algorithms or is otherwise shared with third parties. 

Employers must also be careful with data collected from their customers. As an example, Peloton was recently sued in a class action lawsuit centered on allegations that Drift, a third-party marketing company used by Peloton, improperly used AI-processed chat data between Peloton customers and company representatives without permission. Peloton has denied the allegations. 

Even more recently, LinkedIn was sued by users on the theory that it shared users’ private messages with other companies to train AI models. LinkedIn, with more than a billion users worldwide, has denied the allegations. 

Companies can reduce risk by utilizing regular audits and monitoring AI systems for data privacy issues. Mitigation can also include data minimization, meaning employers only collect the necessary information for AI functioning, as well as privacy by design, wherein privacy is integrated into the design and development of AI systems from inception. Lastly, as described above, companies would be well served to obtain informed consent where necessary so employees and customers understand and can authorize how their data will be used prior to collection. This type of transparency and disclosure can reduce the chance of litigation down the road.  

3. Employee Monitoring and Privacy

The use of AI for purposes of employee monitoring or tracking also raises concerns about privacy and surveillance. AI systems used to monitor or track employees must be properly implemented, including the potential need for notification or consent, particularly if the tracking has the potential to capture personal information beyond work-related tasks. 

The EEOC recently issued a fact sheet warning employers they could be in violation of federal anti-discrimination laws prohibiting workplace bias by requiring employees to use smartwatches, headsets, and other wearable technology. The fact sheet reminded employers that anti-discrimination laws apply to the collection and use of information obtained from these technologies. For example, collection of health and biometric data could rise to the level of a medical examination and request for disability-related information, which the Americans with Disabilities Act (ADA) explicitly limits. The ADA likewise requires employers to safeguard employee medical information.

Employers should also be careful in using data collected by this technology, particularly in the context of an adverse employment decision and with employees who fall within a protected category. Employers must always balance the need for monitoring with respect for employee privacy rights, ensuring compliance with relevant state and federal anti-discrimination laws. 

In conclusion, while AI offers numerous benefits in the workplace, it also presents complex legal challenges. Employers should proactively address these issues through compliance with employment laws, data privacy regulations, and ethical standards to ensure AI technologies are implemented responsibly and effectively.

Robert B. Hinckley Jr. is a Managing Shareholder at Buchalter.