Think AI Is Unregulated? Think Again – Part 2

In our previous blog “Think AI is Unregulated? Think Again – Part 1” we addressed considerations regarding discrimination, background screening, and health data. Just as the field of laws and statutes governing employment actions is broad, so is the overlap with AI as a tool in employment processes. We continue the conversation here, focusing on employee privacy and data rights, information security and retention, and transparency.

Statutes that safeguard employee privacy, govern workplace surveillance, and protect sensitive information can all be triggered by the deployment of AI. Overlooking these obligations could expose employers to significant compliance risk, even when the underlying technology appears to be neutral or beneficial.

Balancing Innovation with Employee Privacy and Data Rights

Having significant implications for workplace privacy, many AI systems are now integrated into employee monitoring tools that track productivity, screen activity, and even observe behavioral patterns. In states like Connecticut and New York, employers are already required to provide notice to employees before deploying these electronic monitoring technologies.

The legal stakes rise when AI tools record or analyze sensitive data such as biometric information, keystrokes, or real-time voice communications. These functions can trigger federal and state wiretap statutes such as the Federal Wiretap Act. In “two-party consent” states like California, Pennsylvania, and Florida, it is unlawful to intercept electronic communications unless all parties are informed and agree. Employers deploying AI to silently transcribe meetings or assess sentiment in emails must be careful, because without adequate notice and consent, these modern tools can lead to direct legal exposure under well-established privacy laws.

Furthermore, AI tools that use facial recognition, voice analysis, or fingerprint scanning fall under specific biometric privacy laws in several states, including Illinois, Texas, and California. These laws generally require informed consent before collecting biometric data, clear policies on data retention and destruction, and secure handling of sensitive information. In California, the California Privacy Rights Act also gives employees certain rights related to automated decision-making and profiling. Employers must be transparent about what data is collected, how it is used, and whether employees can opt out of certain AI-driven decisions. While technology is advancing quickly, the underlying requirement for transparency and consent remains a cornerstone of workplace law.

Strengthening Data Security and the Federal Trade Commission’s Enforcement Standards

AI tools often collect and analyze vast datasets of sensitive employee information, which raises significant concerns regarding data security and system integrity. The Federal Trade Commission (FTC) has indicated that organizations may be subject to enforcement actions if they fail to protect this data from misuse or unauthorized disclosure. However, the Commission’s oversight extends beyond simple data breaches. Under Section 5 of the Federal Trade Commission Act, the agency has the authority to penalize companies for “unfair or deceptive acts or practices.” This means that if an employer misleads employees about how their data is being used, such as promising that AI monitoring is anonymous when it is actually being used for individual performance reviews, the company could face a major federal investigation.

Document Retention and Discovery Challenges

AI introduces new complexities in litigation, particularly when it influences employment decisions or creates documentation that may become part of an employee’s personnel file. When AI tools are used in hiring, evaluations, performance tracking, or disciplinary processes, the associated data and system outputs may be subject to discovery. Protocols and procedures for tracking AI prompts and outputs are still lacking in many employment contexts, leading to further challenges producing necessary documents if a court requires disclosure of this information to assess how or why a particular employment action was taken.

AI use can also continue beyond the length of the employment relationship. Some systems retain employee data after termination, including biometric identifiers, monitoring records, or digital avatars. Employers should implement clear data retention and deletion practices that extend to AI-generated or AI-collected content. If former employee likenesses or voices are used in synthetic content, express consent should be obtained in advance.

Employer Action: Promoting Transparency and Maintaining Workplace Trust

Beyond strict legal obligations, the way employers deploy AI significantly impacts organizational culture and employee trust. When employees do not understand how these systems function or what specific data is being collected, the resulting confusion often leads to internal friction and increased legal exposure. Transparency should not be viewed merely as a cultural goal, but as a practical strategy to mitigate the risks of “algorithmic opacity.”

By providing clear, accessible disclosures about AI-driven decision-making, employers can satisfy the notice requirements of state privacy laws while simultaneously reducing the likelihood of employee-led challenges. Building a “human-in-the-loop” framework, where employees understand that a person remains responsible for final outcomes, helps demystify the technology. Ultimately, maintaining an open dialogue about the purpose and limitations of AI tools ensures that innovation does not come at the cost of the employer-employee relationship.

How HR Works Can Help

HR Works will continue to provide tools, advice, insights, and other resources to guide HR professionals through these changes. In addition to these considerations, our  downloadable checklist   will steer you in the right direction. Don’t hesitate to  contact us   today if you’re seeking a partner to lead your HR department through AI adoption and governance with an approach that is manageable, compliant, and business-driven.