Photo of Keith Ybanez

Keith represents clients in a wide range of labor and employment litigation matters. He is dedicated to working closely with clients in order to assess and analyze risk while executing appropriate and cost-effective strategies for all phases of litigation. While Keith has a broad background in litigation, he chose to focus his practice on labor and employment because of the opportunities the area presented to offer preventative counsel outside of the courtroom.

Keypoint: Colorado employers and controllers that collect and process biometric data and identifiers will need to comply with disclosure, consent, and retention requirements beginning on July 1, 2025.

In late April, the Colorado legislature passed HB 1130, which amends the Colorado Privacy Act (CPA) to add protections for an individual’s biometric data and identifiers. Subject to the procedural formalities in the legislature, the bill will move to Colorado Governor Jared Polis for consideration. Assuming the bill becomes law, it will go into effect on July 1, 2025, and create several new obligations for entities that collect biometric data and identifiers. In addition, the bill’s requirements will apply to more entities than are currently covered by the CPA and will apply to employee data.

In the below article, we first provide a brief overview of the CPA’s existing treatment of biometric data. We then discuss the new obligations created by HB 1130.

Keypoint: New York City issued final regulations on the use of automated employment decision tools by employers, with enforcement to begin on July 5, 2023.

The New York City Department of Consumer and Worker Protection (DCWP) adopted its Final Rule to implement Local Law 144, which regulates the use of “automated employment decision tools” (AEDTs) to screen applicants or employees in the city. The DCWP also announced that it will begin enforcing the law on July 5, 2023.

Keypoint: After a January hearing, New York City continues to consider comments to a new law regulating employers’ use of automated employment decision tools, with enforcement to begin “in the coming months.”

New York City moves closer to implementing Local Law 144, the first major U.S. law governing the use of AI employment technologies. On January 23, 2023, the New York City Department of Consumer and Worker Protection (DCWP), the agency charged with enforcing the law, held a second public hearing on the law’s proposed rules to address several ambiguities related to key definitions and the scope of the law. Within the past week, the DCWP published a transcript of the hearing and announced that it would finalize its rules and begin enforcement “in the coming months.”

Keypoint: Employers who use automated employment decision tools in New York City will receive additional guidance on complying with Local Law 144 before enforcement begins on April 15, 2023.

New York City employers who use automated employment decision tools (“AEDTs”) now have until April 15, 2023, to prepare for compliance with New York City Local Law 144 which regulates usage of such tools. The law was to go into effect on January 1, 2023.

In the below post, we provide a brief overview of the law and its current rulemaking process.

Keypoint: Businesses subject to the CCPA will need to revise their compliance programs before the exemptions expire on January 1, 2023.

As previously reported, the California legislature had been considering multiple bills to extend the employee and business-to-business data exemptions under the California Consumer Privacy Act (CCPA). On August 31st, however, the California legislature adjourned without extending the exemptions which automatically expire on January 1, 2023 – the same day the California Privacy Rights Act (CPRA) goes into effect.

Generally speaking, the current exemptions apply to (1) personal information of job applicants, employees, owners, directors, officers, and independent contractors in the context of the individual’s employment or application for employment and (2) personal information reflecting written and verbal communications or a transaction where the consumer is acting in a business-to-business commercial transaction. With the exemptions set to expire, California will become the first state to apply comprehensive restrictions on the collection and use of such information.

Businesses subject to the CCPA and that have California employees or deal with other California companies will need to engage in substantial efforts to update their privacy programs. We outline some of the necessary steps below.

Keypoint: As of May 7, 2022, New York employers that monitor or intercept employee emails, internet usage, or telephone communications must provide written notice to those employees.

On May 7, 2022, an amendment to the New York Civil Rights Act goes into effect that requires private employers with places of business anywhere in the state to provide employees a written notice if the employer monitors or intercepts employee emails, internet access or usage, or telephone conversations. The written notice must communicate that “any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system . . . may be subject to monitoring at any and all times by any lawful means.”