The APRA provisions apply to algorithms that “facilitate” any decision that poses a risk. This is overly broad. For example, the New York City law applies only where an automated employment decision tool is the most important factor in the hiring decision. Payroll/HCM industry software supports recruitment and hiring, but these systems do not make decisions, which are left to the employer. The provisions on covered algorithms should only apply where algorithms are a predominant factor in making a hiring decision. Existing anti-discrimination laws already offer protections against bias.
Some APRA provisions apply directly to service providers, which is contrary to the structure of virtually every privacy law. Compliance obligations should be placed on covered entities that have the direct relationship with the individual. Service providers are not in direct contact with the individuals, and often will not know whether they have been given a privacy statement, for example. Compliance responsibility must be placed on entities that have a direct relationship with the individual and determine the purposes and means of processing.
APRA pre-emption would also have no effect on the California Privacy Rights Act (CPRA) as it applies to employee data, leaving the California Privacy Protection Agency (CPPA) with rulemaking authority only with respect to employee data. This could result in it adopting a host of rules governing employee privacy, and might lead to California effectively establishing the rules for employee privacy nationwide. Strong pre-emption is vital for a Federal privacy law, and leaving this structure in place would not serve that goal. The APRA should also pre-empt the CPRA as it applies to employee data.