1. Home
  2. |Insights
  3. |New York City Delays Enforcement Date for AEDT Law and Issues “Final Rule”

New York City Delays Enforcement Date for AEDT Law and Issues “Final Rule”

Client Alert | 2 min read | 04.06.23

Today, the New York City Department of Consumer and Worker Protection (“DCWP”) announced the “Final Rule” for the New York AEDT law (Local Law 144), and stated that the enforcement date is moved back from April 15, 2023, to July 5, 2023.

This is the second time the DCWP has changed the enforcement date for New York’s new AEDT law, which requires companies that use an automated employment decision tool to conduct a bias audit and notify job candidates. Crowell has monitored the law’s progress since last year.

In addition to pushing back the enforcement date by approximately ten weeks, the DCWP issued new rules that it states define terms and clarify requirements related to the bias audit, publishing results, and notice. The changes include:

  • Modifying the definition of “machine learning, statistical modeling, data analytics, or artificial intelligence.” The DCWP specifically states that the modification “expand[s]” the scope of this definition;
  • Adding a new requirement that the number of individuals in the “unknown” category must be stated in the summary results;
  • Allowing the auditor to exclude a category that comprises less than 2% of the data being used for the bias audit from the calculations of impact ratio;
  • Clarifying when an employer or agency may rely on a bias audit using another’s historical data;
  • Clarifying that the number of applicants in a category and scoring rate for the category must be included in the summary results.

The notice also provides new examples of how to comply with the law and clarifies existing examples. Crowell will continue to monitor how Local Law 144 progresses over the next ten weeks.

Insights

Client Alert | 11 min read | 05.17.24

FTC Finalizes Modifications to Broaden the Applicability of the Health Breach Notification Rule

On April 26, 2024, the Federal Trade Commission (“FTC”) announced a final rule (“Final Rule”) modifying the Health Breach Notification Rule (“HBNR”). The Final Rule, which largely finalizes changes proposed in a Notice of Proposed Rulemaking published last year (“2023 NPRM”), broadens the scope of entities subject to the HBNR, including many mobile health applications (“apps”) and similar technologies, and clarifies that breaches subject to the HBNR include not only cybersecurity intrusions but also unauthorized disclosures, even those that are voluntary. The Final Rule will take effect 60 days after its publication in the Federal Register....