{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Explainer","Passed Legislation","Proposed Legislation (2023)"],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":3,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Explainer","index":0,"n_rows":30,"n_cols":2,"rows_kept":30,"cut":false,"hidden":false,"merged":[[0,0,0,1]]}
["This document serves as a 50-state survey of proposed, passed, or enacted legislation related to automated decisionmaking."]
[]
["Column ","Explanation"]
["Jurisdiction","Refers to the state, municipality or territory where the bill was enacted. "]
["Name","Official full name of the bill."]
["Bill No.","Bill number."]
["Reference/Link","Link to online version of the bill. "]
["Type (Drop Down)","Indication of whether the bill has passed or is proposed/pending."]
["Date Enacted ","Date the bill was enacted."]
["Date Effective","Date the bill went into effect."]
["Sector (Drop Down)","Refers to the sector of the bill. Options include but are not limited to: \n-Comprehensive Privacy Bill. ADS exists  as part of the comprehensive privacy bill.\n-Employment. ADS in the employment context.\n-Government. ADS oversight.\n-Non-Policing Criminal Justice. ADS in the non-policing criminal justice context can mean any area that is tangential to the criminal justice system such as bailing and parole. \n-Policing. ADS in the policing context such as in the use of police cameras.\n-Task Force. ADS oversight by a task force or similar body.\n-General Use. ADS regulation, not sector-specific.  \n"]
["Subsector (e.g., parole, bail, and sentencing; resume sorting, hiring)","This section includes a breakdown of options within a sector -- for example, government task forces (that are aimed at determining how to regulate and to what extent to permit ADS). "]
["Enforcement Entity (e.g., state AG, specific department or taskforce)","Indication of the enforcement entity. For state bills, the Attorney General is typically the enforcement entity."]
["Ban (Y/N)","Yes/No dropdown indicating if legislation bans use of AI algorithms or ADS."]
["Explain (e.g.,  exceptions/ qualifications or is it a total ban)"]
["Notice  Requirement (Y/N)","Yes/No dropdown indicating  whether there is a consumer notice requirement for use of ADS."]
["Explain (e.g., who must receive notice.)"]
["Reporting  Requirement (Y/N)","Yes/No dropdown indicating  whether there are any obligatory reporting requirements for ADS such as for what purpose the AI is used, who it is reported to, etc."]
["Explain (e.g., for what purpose, who is it reported to)."]
["Input Limitations (Y/N)","Yes/No dropdown indicating whether inputs to algorithms are limited to mitigate disparate impact (e.g., no zip codes, etc.)."]
["Explain (e.g., prohibitions on certain types of information)"]
["Explanation Requirement (Y/N)"]
["Explain"]
["Open Source Requirement (Y/N)","Yes/No dropdown indicating that the algorithm used for ADS must be disclosed."]
["Explain"]
["Audit / Bias Checks? (Y/N)","Yes/No dropdown indicating whether the algorithm can be audited or that there are explicit restrictions regarding bias."]
["Explain"]
["If Yes to Audit / Bias Check - who conducts them? "]
["Other Characteristic?"]
["Additional Comments/ Questions"]

{"sheet":"Passed Legislation","index":1,"n_rows":42,"n_cols":27,"rows_kept":42,"cut":false,"hidden":false,"merged":[[0,0,0,4],[0,5,0,6],[0,7,0,8],[0,10,0,25]]}
["Legislation (as of July 2023)",null,null,null,null,null,null,"Sector ",null,null,"Details"]
["Jurisdiction","Name","Bill No.","Reference/Link","Type (Drop Down)","Date Enacted ","Date Effective","Sector (Drop Down)","Subsector (e.g., parole, bail, and sentencing; resume sorting, hiring)","Enforcement Entity (e.g., state AG, specific department or taskforce)","Ban (Y/N)","Explain (e.g.,  exceptions/ qualifications or is it a total ban)","Notice  Requirement (Y/N)","Explain (e.g., who must receive notice.)","Reporting  Requirement (Y/N)","Explain (e.g., for what purpose, who is it reported to).","Input Limitations (Y/N)","Explain (e.g., prohibitions on certain types of information)","Explanation Requirement (Y/N)","Explain","Open Source Requirement (Y/N)","Explain","Audit / Bias Checks? (Y/N)","Explain","If Yes to Audit / Bias Check - who conducts them? ","Other Characteristic?","Additional Comments/ Questions"]
["Alabama","An Act To establish the Alabama Council on Advanced Technology and Artificial Intelligence","AL S.B. 78","https://legiscan.com/AL/text/SB78/2021","passed","2021-04-29","2022-04-29","Government","Use and Development","Council ","N","The law establishes the Alabama Council on Advanced Technology and Artificial Intelligence to review and advise the Governor and the Legislature on all aspects of the use and development of advanced technology and artificial intelligence. Section 1.(a). ","N","N/A","Y","\"The council shall submit to the Governor and Legislature an annual report each year on any recommendations the council may have for administrative or policy action relating to advanced technology and artificial intelligence. The report shall be available electronically and posted on the website of the office of the Governor, the Legislature, and the Department of Commerce.\" Section 1(i). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","Berkley Acquisition and Use of Surveillance Technology","Mun. Code § 2.99","https://berkeley.municipal.codes/BMC/2.99","passed","2018-03-13","2018-03-13","Government","Acquisition of ADS","City Council","N","The city seeks to establish a thoughtful process regarding the procurement and use of Surveillance Technology. 2.99.010. \n\nThe City Manager must present a Surveillance Use Policy for each Surveillance Technology to the Police Review Commission, prior to adoption by the City Council. 2.99.030(2).","Y","Requires City Council Approval to purchase and use technology. 2.99.030\n(1).","Y","Requires a written report concerning a specific surveillance technology that gathers data. The report must include how the technology is used, how often it is used, where it is used, and why it is used. The report must also include the race of each person subject to the technology. 2.99.030(5).","N","N/A","N","N/A","N","N/A","N","N/A",null,null,"Notwithstanding any other provision of this Chapter, it shall be a violation of this ordinance for the City Manager or any person acting on the City Manager’s behalf to obtain, retain, request, access, or use: i) any Face Recognition Technology; or ii) any information obtained from Face Recognition Technology, except for personal communication devices as defined by Section 2.99.020 or section 2.99.030(4). 2.99.030(5). \n\nAdditionally, note that the city of Berkeley has faced legal action for failing to follow this ordinance; on November 30, 2021 a nonprofit organization sued the City for failing to seek prior approval before acquiring new surveillance technology.  See https://secure-justice.org/blog/secure-justice-sues-berkeley-again.\n\nAn example of the type of approval report required by the ordinance can be found here:  https://berkeleyca.gov/sites/default/files/documents/2022-11-03%20Item%2032%20Resolution%20Accepting%20the%20Annual.pdf"]
["California","California Privacy Rights Act (CPRA)","Cal. Civ. Code § 1798.100","https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5","passed","2020-11-03","2023-01-01","Comprehensive Privacy","General Use","State AG","N","\nThe California Attorney General has been given the authority to issue \"regulations governing access and opt-out rights with respect to businesses’ use of automated decisionmaking technology, including profiling and requiring businesses’ response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer.\" 1798.185(a)(16). \n\nProfiling means \"any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" 1798.140(z). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","Oakland Regulation on City's Acquisition and Use of Surveillance Technology","Code of Ordinance 9.64","https://library.municode.com/ca/oakland/codes/code_of_ordinances?nodeId=TIT9PUPEMOWE_CH9.64REACUSSUTE","passed","2018-05-05","2018-05-05","Government","Acquisition of ADS","City Council","N","City staff  is not prohibited from using ADS, rather, it must obtain City Council approval prior to any of the following:\nA. Accepting state or federal funds or in-kind or other donations for surveillance technology;\nB. Acquiring new surveillance technology, including but not limited to procuring such technology without the exchange of monies or consideration;\nC. Using new surveillance technology, or using existing surveillance technology or the information it provides for a purpose, in a manner, or in a location not previously approved by the City Council pursuant to the requirements of this Chapter; or\nD. Entering into a continuing agreement or written agreement with a non-city entity to acquire, share or otherwise use surveillance technology or the information it provides, including data sharing agreements.\nE. Notwithstanding any other provision of this Section, nothing herein shall be construed to prevent, restrict or interfere with any person providing evidence or information derived from surveillance technology to a law enforcement agency for the purposes of conducting a criminal investigation or the law enforcement agency from receiving such evidence or information. 9.64.030 (1)(A)-(E).","Y","Public Disclosure Requirement: \n\n\"It shall be unlawful for the city to enter into any surveillance-related contract or other agreement that conflicts with the provisions of this Article, and any conflicting provisions in such future contracts or agreements, including but not limited to non-disclosure agreements, shall be deemed void and legally unenforceable.\n\nTo the extent permitted by law, the city shall publicly disclose all of its surveillance-related contracts, including any and all related non-disclosure agreements, if any, regardless of any contract terms to the contrary.\"  9.64.060.","Y","The Act requires the city council to prepare an \"Annual Surveillance Report\" to submit to the Privacy Advisory Commission. The report shall be a written report concerning a specific surveillance technology that must include:\nA. A description of how the surveillance technology was used, including the type and quantity of data gathered or analyzed by the technology;\nB. Whether and how often data acquired through the use of the surveillance technology was directly shared with outside entities, the name of any recipient entity, the type(s) of data disclosed, under what legal standard(s) the information was disclosed, and the justification for the disclosure(s);\nC. Where applicable, a breakdown of what physical objects the surveillance technology hardware was installed upon; \nD. Where applicable, a breakdown of where the surveillance technology was deployed geographically;\nE. A summary of community complaints or concerns about the surveillance technology, and an analysis of the technology's adopted use policy and whether it is adequate in protecting civil rights and civil liberties;\nF. The analysis shall also identify the race of each person that was subject to the technology's use. 9.64.010 (1)(A-E), (2). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","San Francisco Stop Secret Surveillance","No. 190110","https://sfgov.legistar.com/View.ashx?M=F&ID=7206781&GUID=38D37061-4D87-4A94-9AB3-CB113656159A","passed","2019-06-14","2019-07-15","Government ","Acquisition of ADS","City Department","N","A Department must obtain Board of Supervisors approval by ordinance of a Surveillance Technology Policy under which the Department will acquire and use Surveillance Technology, prior to engaging in any of the following:\n(1) Seeking funds for Surveillance Technology, including but not limited to applying for a grant, or accepting state or federal funds, or public or private in-kind or other donations;\n(2) Acquiring or borrowing new Surveillance Technology, including but not limited to acquiring Surveillance Technology without the exchange of monies or other consideration;\n(3) Using new or existing Surveillance Technology for a purpose, in a manner, or in a location not specified in a Surveillance Technology Policy ordinance approved by the Board in accordance with this Chapter 19B; or \n(4) Entering into agreement with a non-City entity to acquire, share, or otherwise use Surveillance Technology;  \n(5) Entering into an oral or written agreement under which a non-City entity or individual regularly provides the Department with data or information acquired through the \nentity’s use of Surveillance Technology. SEC. 19B.2. (a)(1)-(5).","Y","Requires public disclosure of the type of Surveillance Technology used by city departments: \n\n(a)   Each Department possessing or using Surveillance Technology before the effective date of this Chapter 19B shall submit an inventory of its Surveillance Technology to COIT, within 60 days of the effective date of this Chapter. COIT shall publicly post the inventory on COIT’s website.  Sec. 19B.5 (a). ","Y","A Department that obtains approval for the acquisition of Surveillance Technology under Section 19B.2 must submit to the Board of Supervisors and COIT, and make available on its website, an Annual Surveillance Report for each Surveillance Technology used by the City Department within 12 months of Board approval of the applicable Surveillance Technology Policy, and annually thereafter on or before November 1. If the Department is unable to meet the deadline, the Department may submit a request to COIT for an extension of the deadline. COIT may extend the deadline for good cause. SEC. 19B.6 (a). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","The Body Camera Accounability Act","AB 1215","https://www.aclunc.org/our-work/legislation/body-camera-accountability-act-ab-1215","passed","2019-10-08","10/8/2019 (Until 1/1/2023)","Government","Facial Recognition",null,"Y","Prohibits a law enforcement agency or law enforcement officer from installing, activating, or using any biometric surveillance system in connection with an officer camera or data collected by an officer camera. “Facial recognition or other biometric surveillance” does not include the use of an automated or semiautomated process for the purpose of redacting a recording for release or disclosure outside the law enforcement agency to protect the privacy of a subject depicted in the recording, if the process does not generate or result in the retention of any biometric data or surveillance information.“Use” means either of the following, alone or in combination:\n(A) The direct use of a biometric surveillance system by a law enforcement officer or law enforcement agency.\n(B) A request or agreement by a law enforcement officer or law enforcement agency that another law enforcement agency or other third party use a biometric surveillance system on behalf of the requesting officer or agency.\n(b) A law enforcement agency or law enforcement officer shall not install, activate, or use any biometric surveillance system in connection with an officer camera or data collected by an officer camera.\n(c) In addition to any other sanctions, penalties, or remedies provided by law, a person may bring an action for equitable or declaratory relief in a court of competent jurisdiction against a law enforcement agency or law enforcement officer that violates this section.\n(d) This section does not preclude a law enforcement agency or law enforcement officer from using a mobile fingerprint scanning device during a lawful detention to identify a person who does not have proof of identification if this use is lawful and does not generate or result in the retention of any biometric data or surveillance information.\n(e) This section shall remain in effect only until January 1, 2023, and as of that date is repealed."]
["Colorado","Colorado Privacy Act","Senate Bill 21-190 ","2021a_190_signed.pdf (colorado.gov)","passed","2021-07-08","2023-07-01","Comprehensive Privacy","General Use","State AGs and District Attorneys","N","A consumer has the right to opt out of processing for purposes of \"profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.\" Sec. 6-1-1306(a)(C).\n\nProfiling is defined as \"any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" Sec. 6-1-1303(20). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controllers cannot conduct processing that presents \"a heightened risk of harm to a consumer without conducting and documenting a data protection assessment... '[P]rocessing that presents a heightened risk of harm to a consumer' includes... processing personal data for purposes of targeted advertising or for profiling if the profiling presents a reasonably foreseeable risk of (i) Unfair of deceptive treatment of, or unlawful disparate impact on, consumers; (II) Financial or physical injury to consumers; (III) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers if the intrusion would be offensive to a reasonable person; or (iv) other substantial injury to consumers.\" Sec. 6-1-1309 (2)(a)(i)-(iv).   "]
["Colorado ","Concerning Protecting Consumers from Unfair Discrimination in Insurance Practices","Senate Bill 21-169","https://www.leg.colorado.gov/sites/default/files/2021a_169_signed.pdf","passed","2021-07-06","2021-09-09","Insurance","Anti-discrimination","The Commissioner","N","The law does not ban insurers' use of ADS in all instances. It prohibits \"Unfair discrimination based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression in any insurance practice; and (II) The use of external consumer data and information sources, as well as algorithms and predictive models using external consumer data and  information sources, which use has the result of unfairly discriminating based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression\" and furthermore, it provides that \"[a]fter notice and rule-making by the commissioner of insurance, require insurers that use external consumer data and information sources, algorithms, and predictive models to control for, or otherwise demonstrate that such use does not result in, unfair discrimination.\" Section 1(2)(a)-(b). ","N","N/A","Y","Rules adopted pursuant to this section must require each insurer to \"establish and maintain a risk management framework or similar processes or procedures that are reasonably designed to determine, to the extent practicable, whether the insurer's use of external consumer data and information sources, as well as algorithms and predictive models using external consumer data and information sources, unfairly discriminates based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression\" and that the insurer must \"provide an assessment of the results of the risk management framework or similar processes or procedures and actions taken to minimize the risk of unfair discrimination, including ongoing monitoring.\" Section 2(3)(b)(iii)-(iv). ","N","N/A","Y","\"Rules adopted pursuant to this section must require each insurer to: ... (ii) provide an explanation of the manner in which the insurer uses external consumer data and information sources, as well as algorithms and predictive models using external consumer data and information sources, for the particular type of insurance and insurance practice.\" Section 2 (3)(b)(II). ","N","N/A","N","N/A"]
["Connecticut","Connecticut Data Privacy Act","Public Act No. 22-15","https://www.cga.ct.gov/2022/ACT/PA/PDF/2022PA-00015-R00SB-00006-PA.PDF","passed","2022-06-17","2023-07-01","Comprehensive Privacy","General Use","State AG","N","\nA consumer has the right to opt out of the processing of personal data for the purpose of \"profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Public Act No. 22-15 Section 4.\n\n\"Process\" or \"processing\" means any operation or set of operations performed, whether by manual or automated means, on \npersonal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data. Public Act No. 22-15 Section 1(20). \n\n\"Profiling\" means any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.\" Public Act No. 22-15 Section 1(22). ","Y","\nCompanies must give consumers notice of what data of theirs is being collected and how that data is being used. Consumer may opt out of selling or sharing their data. \n\nConsumers under the age of 16 must provide consent to data collection in the first instance.  Public Act No. 22-15 Section 3(c). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Requires a controller to conduct and document a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer. \n\nProcessing that presents a heightened risk of harm to a consumer includes: \"processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of: (a) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (b) financial, physical or reputational injury to consumers, (c) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person, or (d) other substantial injury to consumers.\" Public Act No. 22-15 Section 8. ","Enforcement timeline: \n\nJuly 1, 2023 – The CTPDA becomes effective. This is the recommended target date for full compliance.\n\nDecember 31, 2024 – The last date of the enforcement grace period.\n\nJanuary 1, 2025 – Businesses are required to have controls in place to collect consent and respond to consumer opt-out requests. The Connecticut Attorney General, at their discretion, may offer opportunities to cure alleged violations."]
["Connecticut","An Act Concerning Artificial Intelligence, Automated Decision-making and Personal Data Privacy ","SB 1103","https://legiscan.com/CT/text/SB01103/2023","passed","2023-06-07","2023-07-01","Government","Government Use","Department of Administrative Services","N","Does not ban ADS, but rather provides that no later than December 31, 2023, and annually thereafter, the Department of Administrative Services shall conduct an inventory of all systems that employ artificial intelligence and are in use by any state agency. Section 1(b)(1). \n\nAdditionally, provides that beginning on February 1, 2024, the Department of Administrative Services shall perform ongoing assessments of systems that employ artificial intelligence and are in use by state agencies to ensure that no such system shall result in any unlawful discrimination or disparate impact described in subparagraph (B) of subdivision (1) of subsection (b) of section 2 of this act. Section 1(c). \n\nArtificial Intelligence means \"(A) an artificial system that (i) performs tasks under varying and unpredictable circumstances without significant human oversight or can learn from experience and improve such performance when exposed to data sets, (ii) is developed in any context, including, but not limited to, software or physical hardware, and solves tasks requiring human-like perception, cognition, planning, learning, communication or physical action, or (iii) is designed to (I) think or act like a human, including, but not limited to, a cognitive architecture or neural network, or (II) act rationally, including, but not limited to, an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communication, decision-making or action, or (B) a set of techniques, including, but not limited to, machine learning, that is designed to approximate a cognitive task.\" Section 1(1). \n\nFurthermore, requires that the Office of Policy and Management shall develop and establish policies and procedures concerning the development, procurement, implementation, utilization and ongoing assessment of systems that employ artificial intelligence and are in use by state agencies no later than February 1, 2024. Section 2(b)(1). ","N","N/A","Y","The law establishes a working group to: \"(1) Make recommendations concerning, and develop best practices for, the ethical and equitable use of artificial intelligence in state government; (2) make recommendations concerning the policies and procedures developed pursuant to subsection (b) of section 2 of this act; (3) assess the White House Office of Science and Technology Policy's 'Blueprint for an AI Bill of Rights' and similar materials and make recommendations concerning the (A) regulation of the use of artificial intelligence in the private sector based, among other things, on said blueprint, and (B) adoption of a Connecticut artificial intelligence bill of rights based on said blueprint; and (4) make recommendations concerning the adoption of other legislation concerning artificial intelligence.\" Section 4(b). The working group shall submit its report no later than February 1, 2024 and will terminate on the date that it submits is report or by February 1, 2024 (f). ","N","N/A","N","N/A","N","N/A","N","Does not require audit/bias checks, but note that beginning on February 1, 2024, no state agency shall implement any system that employs artificial intelligence (1) unless the state agency has performed an impact assessment, in accordance with the policies and procedures established pursuant to subsection (b) of this section, to ensure that such system will not result in any unlawful discrimination or disparate impact. Section 2(c). ",null,"Requires that on December 31, 2023, and annually thereafter, the Judicial Department shall conduct an inventory of the department's systems that employ artificial intelligence. Section 3(b)(1). "]
["Delaware","Delaware Personal Data Privacy Act","HB 154","https://legis.delaware.gov/json/BillDetail/GenerateHtmlDocument?legislationId=140388&legislationTypeId=1&docTypeId=2&legislationName=HB154","passed","06/30/2023 [awaiting governor action]","2025-01-01","Comprehensive Privacy","General Use","Department of Justice","N","A consumer has the right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. § 12D-104(6)(c). \n\n“Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements. § 12D-102(25). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"A controller that controls or processes the data of not less than 100,000 consumers, excluding data controlled or processed solely for the purpose of completing a payment transaction, shall conduct and document, on a regular basis, a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer, which includes: \"[t]he processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of any of the following: (a) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (b) [f]inancial, physical, or reputational injury to consumers; (c). [a] physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; and (d) [o]ther substantial injury to consumers.\" § 12D-108(a)(3). "]
["Florida","Florida Digital Bill of Rights","SB 262","https://www.flsenate.gov/Session/Bill/2023/262/BillText/er/PDF","passed","2023-06-06","2024-07-01","Comprehensive Privacy","General Use","Department of Legal Affairs","N","An online platform that provides an online service, product, game, or feature likely to be predominantly accessed by children may not profile a child unless the platform can both \"demonstrate it has appropriate safeguards in place to protect children,\" and \"Profiling is necessary to provide the online service, product, or feature requested for the aspects of the online service, product, or feature with which the child is actively and knowingly engaged\" or \"[t]he online platform can demonstrate a compelling reason that profiling does not pose a substantial harm or privacy risk to children.\" § 501.1735(2)(b)(1)-(2). \n\nProfiling means \"any form of automated processing performed on personal information to evaluate, analyze, or predict personal aspects relating to the economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of a child.\" § 501.1735 (1)(i). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"A controller must comply with requests to \"opt-out of processing of personal data for purposes of... profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.\" § 501.705(2)(e)(3). \n\nA controller shall conduct a data impact assessment for \"[t]he processing of personal data for purposes of profiling if the profiling presents a reasonably foreseeable risk of: (1) [u]nfair or deceptive treatment of or unlawful disparate impact on consumers; (2) [f]inancial, physical, or reputational injury to consumers; (3) [a] physical or other intrusion on the solitude or seclusion, or the private affairs or concerns, of consumers, if the intrusion would be offensive to a reasonable person; or (4) [o]ther substantial injury to consumers.\" §  501.703(1)(c)(1)-(3). "]
["Georgia","Not yet titled","HB 203","https://custom.statenet.com/public/resources.cgi?id=ID:bill:GA2023000H203&ciq=ncsl&client_md=b3513f3bc1757e3247c28b083c67e451&mode=current_text","passed","2023-05-02","2023-07-01","Health Care","General Use","Office of Attorney General (fines)","Y","This law regulates automated eye assessments. Eye assessments \"means an assessment of the ocular health and visual status of a patient that may include... objective refractive data or information generated by an automated testing device, including an autorefractor, in order to establish a refraction diagnosis for the correction of vision disorders. This may include synchronous or asynchronous telemedicine technologies.\" The law states that prescriber may not \"use the data or information obtained from an eye assessment as the sole basis for issuing a prescription.\"","Y","Prescribers must \"disclose to patients and require acceptance in advance as a term of use that:\n\n(A) The eye assessment is not a replacement of an eye examination;\n\n(B) The eye assessment cannot be used to generate an initial prescription for contact lenses or spectacles or first renewal of the initial prescription; and\n\n(C) The eye assessment may only be used if the patient has had an eye examination within the previous 24 months.\"","N","N/A","N","N/A","Y","Prescribers must \"disclose to patients and require acceptance in advance as a term of use that:\n\n(A) The eye assessment is not a replacement of an eye examination;\n\n(B) The eye assessment cannot be used to generate an initial prescription for contact lenses or spectacles or first renewal of the initial prescription; and\n\n(C) The eye assessment may only be used if the patient has had an eye examination within the previous 24 months.\"","N","N/A","N","N/A"]
["Hawaii","Twenty-First Century Privacy Law Task Force","H.C.R.  225 (2019)","HCR225 HD1 (hawaii.gov)","passed","2019-03-03","Adopted in April 2019","Task Force","State Commission ","State Legislature","N","The legislation establishes a commission to study twenty-first century technologies for the collection, storage, security, and destruction of consumer data privacy and recommend laws to provide utmost protection to citizens of the state.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Hawaii","Urging Congress To Begin A Discussion Considering The Benefits And Risks Of Artificial Intelligence Technologies","SR123 and SCR179","https://custom.statenet.com/public/resources.cgi?id=ID:bill:HI2023000SCR179&ciq=ncsl&client_md=3d892e51a8c29791a39d2783a1ec71da&mode=current_text\n\nhttps://custom.statenet.com/public/resources.cgi?id=ID:bill:HI2023000SR123&ciq=ncsl&client_md=9505f0415a56b8239964a45d4c1e6ad5&mode=current_text","passed","2023-04-01","2023-04-01","Government ","Research/general oversight","N/A","N","This resolution warns against the unintended consequences of AI and urges Congress to discuss the benefits and risks of AI."]
["Idaho","Idaho Statute Title 19 Civil Procedure","Idaho Code 19-1910","https://legislature.idaho.gov/statutesrules/idstat/title19/t19ch19/sect19-1910/#:~:text=(c)%20No%20builder%20or%20user,a%20criminal%20or%20civil%20case.","passed","1905-07-11","Added in 2019","Non-Policing Criminal Justice (e.g., Parole, Bail, Sentencing)","Pre-Trial Criminal Procedure","State, Municipalities","N","A municipality cannot implement a pre-trial assessment tool without first demonstrating that the algorithm is free of bias with respect to any class of individuals protected against discrimination by state or federal law. § 1.","N","N/A","Y","Validation of freedom of bias must be posted on the state or any political subdivision's website using the algorithm. Any system in use must be open to public inspection. § 1.","N","Although the statute does not specifically mention any input limitations, this statute effectively will limit inputs that cause bias through the other requirements listed in this row. ","N","N/A","Y","Under the statute all documents, records and information used to build or validate the risk assessment shall be open to public inspection auditing, and testing. No assertion of trade secret will block discovery. § 1.","Y","It is mandatory to conduct audits/bias checks prior to use. § 1.","The state or political subdivision desiring use of the algorithm will conduct."]
["Illinois","Artificial Intelligence Video Interview Act","820 ILCS 42","https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=4015&ChapterID=68","passed","2019-08-01","2020-01-01","Employment","Employment Interview","Department of Commerce and Economic Opportunity (report to the General Assembly and Governor any finding of racial bias)","N","An employer that asks applicants to record video interviews and uses an artificial intelligence analysis of the applicant-submitted videos when considering applicants for positions may not use the artificial intelligence without notice and advance consent. § 5.","Y","The applicant must be provided with notice and consent. § 5.","Y","If the employer relies solely on AI to determine whether an applicant will be selected for an in-person interview, they must then provide the race and ethnicity of each applicant invited or denied an in-person interview and offered a position and tabulated by the employer to Commerce annually. § 20.","N/A","N/A","Y","Employer must explain the AI process to applicants and obtain consent prior to use. § 5.","N","N/A","Y","The state must analyze the data reported annually to determine whether the data discloses a racial bias in the use of AI. § 20 (c).","Department of Commerce and Economic Opportunity"]
["Illinois","Illinois Future of Work Act","IL H.B. 645","https://custom.statenet.com/public/resources.cgi?id=ID:bill:IL2021000H645&ciq=ncsl&client_md=d49cc5fd8ce6386c082c848a14eeb265&mode=current_text","passed","2021-08-19","Enacted August 2021","Task Force","State Commission ","Governor and the General Assembly","N","The  legislation established the Illinois Future of Work Task Force to develop tools to assess the impact of proposed technologies and evaluate their costs and benefits on workers, employers, the public and the State.","N","N/A","N","N/A","N","N/A","N","N/A","N/A","N/A","N","N/A"]
["Indiana","A bill for an act to amend the Indiana Code concerning trade regulation/Indiana Data Privacy Act","SB 5","https://iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf","passed","2023-05-01","2026-01-01","Comprehensive Privacy","N/A","State AG","N","The legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as: \"any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health or health records, personal preferences, interests, reliability, behavior, location, or movements.\" Ch. 2. Sec. 23. \n\nConsumers have with the right to opt-out of processing of personal data for purposes of “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” Ch. 3, Sec. 1(b)(5).","N",null,"N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller must conduct data protection impact assessment for activities including the processing for purposes of profiling if there is a reasonably foreseeable risk of: \"(A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) financial, physical, or reputational injury to consumers; (C) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, if such intrusion would be offensive to a reasonable person; or (D) other substantial injury to customers.\" and the processing of sensitive data. Ch. 6, Sec. 1(b)(3)(A)-(D). "]
["Iowa","An Act Relating to Consumer Data Protection, Providing Civil Penalties, and Including Effective Date Provisions ","Senate File 262","Iowa Legislature - BillBook","passed","2023-03-28","2025-01-25","Comprehensive Privacy","General Use","State AG","N","A consumer may request to obtain a copy of the consumer's personal data, except as to personal data that is defined as personal information pursuant to section 715C.1 that is subject to security breach protection, that the consumer previously provided to the controller in a portable and, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means. ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Maryland","An Act Concerning Economic Development - Industry 4.0 Technology Grant Program","HB 622","https://fastdemocracy.com/bill-search/md/2023/bills/MDB00027588/#billtexts","passed","2023-05-08","2023-10-01","Employment","Manufacturing","Department of Commerce","N",null,"N",null,"N",null,"N",null,"N",null,"N",null,"N"]
["Montana","Montana Consumer Data Privacy Act","SB 384","https://leg.mt.gov/bills/2023/billpdf/SB0384.pdf","passed","2023-05-19","2024-10-01","Comprehensive Privacy","General Use","State AG","N","A consumer may opt out of the processing of the consumer's personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["New York","New York City Automated Employment Decision Tools","Intro 1894-2022","https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=4344524&GUID=B051915D-A9AC-451E-81F8-6596032FA3F9","passed","2021-12-11","2023-04-15","Employment","Hiring","The corporation counsel or such other persons designated by the corporation counsel on behalf of the department. § 20-873.","N","\"In the city, it shall be unlawful for an employer or an employment agency to use an automated employment decision tool to screen a candidate or employee for an employment decision unless: (1) Such tool has been the subject of a bias audit conducted no more than one year prior to the use of such tool; and (2) A summary of the results of the most recent bias audit of such tool as well as the distribution date of the tool to which such audit applies has been made publicly available on the website of the employer or employment agency prior to the use of such tool.\" § 20-871(1)-(2).","Y","\"In the city, any employer or employment agency that uses an automated employment decision tool to screen an employee or a candidate who has applied for a position for an employment decision shall notify each such employee or candidate who resides in the city of the following:\n1. That an automated employment decision tool will be used in connection with the assessment or evaluation of such employee or candidate that resides in the city. Such notice shall be made no less than ten business days before such use and allow a candidate to request an alternative selection process or accommodation;\n2. The job qualifications and characteristics that such automated employment decision tool will use in the assessment of such candidate or employee. Such notice shall be made no less than 10 business days before such use; and\n3. If not disclosed on the employer or employment agency’s website, information about the type of data collected for the automated employment decision tool, the source of such data and the employer or employment agency’s data retention policy shall be available upon written request by a candidate or employee. Such information shall be provided within 30 days of the written request. Information pursuant to this section shall not be disclosed where such disclosure would violate local, state, or federal law, or interfere with a law enforcement investigation.\" § 20-871(b).","N","N/A","N","N/A","N","N/A","N","N/A","Y","In order to use the tool, it must have been the subject of a bias audit conducted no more than one year prior to using the tool AND a summary of the results of the most recent bias audit of such tool and distribution date of tool to which the audit applies has been made publicly available on the website of the employer or employment agency prior to the use of such tool. § 20-871(1)-(2). \n\nBias audit is defined as an “impartial evaluation by an independent auditor” that must assess at minimum the tool’s disparate impact on persons of any component 1 category that employers must report to the EEOC pursuant to 42 U.S.C. 2000e-8(c). § 20-870. ","City is responsible for conducted audits.",null,"This local law was set to take effect on January 1, 2023, but the enforcement of this act has been postponed pending further notice and comment. A public hearing will be held on January 23, 2023. The DCWP will continue accepting public comments through that date. \n\nThe new proposed enactment date is April 15, 2023. \n\nThe DCWP released a report on December 23, 2022 with proposed rules for the enforcement of the AEDT law. \n\nPending further proposed comments and approvals, the current proposed changes for the law are: \n(1)Modifying the definition of AEDT to ensure it is focused; (2) Clarifying that an “independent auditor” may not be employed or have a financial interest in an employer or employment agency that seeks to use or continue to use an AEDT or in a vendor that developed or distributed the AEDT; (3) Revising the required calculation to be performed where an AEDT scores candidates; (4) Clarifying that the required “impact ratio” must be calculated separately to compare sex categories, race/ethnicity categories, and intersectional categories; (5) Clarifying the types of data that may be used to conduct a bias audit; (6) Clarifying that multiple employers using the same AEDT may rely upon the same bias audit so long as they provide historical data, if available, for the independent auditor to consider in such bias audit; and (7) Clarifying that an AEDT may not be used if its most recent bias audit is more than one year old.\n\nSee https://www.jdsupra.com/legalnews/new-proposed-rules-for-nyc-s-automated-9856808/; Information regarding public hearing: https://rules.cityofnewyork.us/wp-content/uploads/2022/09/DCWP-NOH-AEDTs-1.pdf"]
["New York","New York City POST Act","Int 0487-2018  ","https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=3343878&GUID=996ABB2A-9F4C-4A32-B081-D6F24AB954A0","passed","2020-07-15","2020-07-15","Policing","Police Use","City police department","N",null,"N",null,"Y","The POST Act requires NYPD to post a surveillance technology impact and use policy for each new and existing surveillance technology it utilizes, and requires NYPD to take and consider public comment on such impact and use policies before deploying new surveillance technologies.","N",null,"N",null,"N",null,"Y","The act requires the Department of Investigation to audit these surveillance technology impact and use policies.","City police department"]
["New York","New York City Automated decision systems used by agencies","Int 1696-2017","https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=3137815&GUID=437A6A6D-62E1-47E2-9C42-461253F9C6D0","passed","2018-01-11","2018-01-11","Government","Government Use","Task force","N",null,"N",null,"Y","Task force charged with providing recommendations on how the city may be accountable to the public for its automated decision systems and how agencies should address harms due to their automated decision systems.","N",null,"N",null,"N",null,"N"]
["New York","An Act to amend the education law, in relation to the use of biometric identifying technology","Assembly Bill A6787D (2019-2020) ","https://www.nysenate.gov/legislation/bills/2019/A6787","passed","2020-12-22","2020-12-22","Education","School Use","Commissioner (of Education)","Y","Places a temporary moratorium on the use of facial recognition in NYS schools.","N","As the law stands, there is no official requirement that notice be given to students, guardians and district residents. But before biometric information technology can be utilized or purchased, the commissioner must release a report that considers and presents recommendations on multiple aspects of biometric technology use, including (among other things) \"whether, and in what manner, the use of such technology should be disclosed by signs and the like in such schools, as well as communicated to parents, guardians, students, and district residents.\"","Y","The commissioner cannot purchase or permit the utilization of biometric identifying technology, until they issue \"a report prepared in consultation with the department's chief privacy officer, making recommendations as to the circumstances in which the utilization of such technology is appropriate in public and nonpublic elementary and secondary schools [...] and what restrictions and guidelines should be enacted to protect individual privacy, civil rights, and civil liberty interests. Such report shall be made public and presented to the governor, the temporary president of the senate, and the speaker of the assembly...\"","N","The language of the bill does discuss \"whether, and in what manner such biometric identifying technology should be assessed and audited, including but not limited to.... adherence to appropriate standards of algorithmic fairness, accuracy, and other performance metrics, including with respect to subgroups of persons based on race, national origin, gender, and age.\" But there is no explicit prohibition placed on what input data is being utilized by this technology.","N",null,"N",null,"Y","The publishing of the comissioner's report - which is required before any biometric technology can be used/purchased - should discuss \"whether, and in what manner such biometric identifying technology should be assessed and audited, including but not limited to, vendor                                                       datasets, adherence to appropriate standards of algorithmic fairness, accuracy, and other performance metrics, including with respect to subgroups of persons based on race, national origin, gender, and age.\"","Unclear."]
["North Dakota","An act to amend and reenact subsection 8 of section 1-01-49 of the North Dakota Century Code, relating to the definition of person; and to declare an emergency","House Bill No. 1361","https://legiscan.com/ND/text/HB1361/2023","passed","2023-04-12","2023-04-12","Government ",null,null,"N","This act amends the North Dakota Code to clarify that AI is not a person.","N",null,"N",null,"N",null,"N",null,"N",null,"N",null,"N"]
["Oregon","Oregon Consumer Privacy Act","SB 619","https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled","passed","2023-06-23","2023-07-01","Comprehensive Privacy","General Use","State AG","N","A consumer may opt out of the controller's processing of personal data for the purpose of \"[p]rofiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance.\" 3(1)(D)(c). \n\nA controller may not \"[p]rocess a consumer’s personal data for the purposes of targeted advertising, of profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance or of selling the consumer’s personal data without the consumer’s consent if the controller has actual knowledge that, or willfully disregards whether, the consumer is at least 13 years of age and not older than 15 years of age.\" Section 5(2)(c). \n\n“Profiling” means an automated processing of personal data for the purpose of evaluating, analyzing or predicting an identified or identifiable consumer’s economic circumstances, health, personal preferences, interests, reliability, behavior, location or movements. Section 1(16). ","Y","A controller shall provide to consumers a reasonably accessible, clear and meaningful privacy notice that \"[p]rovides a clear and conspicuous description of any processing of personal data in which the controller engages for the purpose of targeted advertising or for the purpose of profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance, and a procedure by which the consumer may opt out of this type of processing.\" Section 5(2)(h). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"\"A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer...Using the personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (i) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) Financial, physical or reputational injury to consumers; (iii) Physical or other types of intrusion upon a consumer’s solitude, seclusion or private affairs or concerns, if the intrusion would be offensive to a reasonable person; or (iv) Other substantial injury to consumers.\" 8(1)(a)(D). "]
["Pennsylvania ","Ordinance amending and supplementing the Pittsburgh Code of Ordinances at Title One: Administrative, Article III: Organization, Chapter 116: Department of Public Safety to regulate the use of facial recognition and predictive policing technology.","Ordinance Number 2020-0647","https://pittsburgh.legistar.com/LegislationDetail.aspx?ID=4622347&GUID=5CD9C6B4-206A-4EE9-8876-5C99EC002683&Options=&Search=","passed ","2020-09-22","2020-09-24","Government","Facial recognition ","City Council","Y","Requires approval for city for police use and acquisition of facial recognition or predictive policing technology except when exigent circumstances exist. \n\n\"The Department of Public Safety shall not obtain, retain, access, or use Facial Recognition Technology or Predictive Policing Technology, or make use of information collected, captured, recorded, retained, processed, intercepted, analyzed, derived, or effected through the use of Select Surveillance Technology by another entity without the approval of City Council, or unless permitted through the stipulations of this Ordinance.\" Section (C)(1). ","Y","Should the Department of Public Safety temporarily make use of Select Surveillance Technology in response to exigent circumstances, the Director of the Department of Public Safety shall notify City Council within 30 days of the commencement of such action, provided that such information is not classified or privileged as a matter of law. Section (C)(5)(a) ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Rhode Island","Article X Automated red light enforcement","Art X Sec 15-121","Chapter 15 - MOTOR VEHICLES AND TRAFFIC | Code of Ordinances | Providence, RI | Municode Library","passed",2020,2020,"Non-Policing Criminal Justice (e.g., Parole, Bail, Sentencing)","Traffic: automated red light enforcement","City police department","N","Providence allows the use of automated red light cameras. ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Providence allows the use of automated red light cameras. \n\n\"The owner of a motor vehicle shall be liable for a civil monetary penalty imposed pursuant to this section if such motor vehicle is found, as evidenced by information obtained from a traffic-control signal monitoring device lawfully installed within the city, to have failed to comply with R.I.G.L. sec. 31-13-6. The penalty imposed shall be designated by R.I.G.L. sec. 31-41.1-4.\"  Sec. 15-122. \n\nDetection by a red light camera creates a rebuttable evidentiary presumption in any prosecution of the violation. Sec. 15-123. ","The state legislature is currently considering a similar bill, SB 2510, that would authorize use of automated speed enforcement systems throughout the state. As of 5/17/2022, the state senate committee has recommended the measure be held for further study. See https://legiscan.com/RI/bill/S2510/2022.  "]
["Tennessee","Tennessee Information Protection Act","SB 73/HB 1181","https://wapp.capitol.tn.gov/apps/Billinfo/default.aspx?BillNumber=SB0073&ga=113","PASSED","2024-05-04","2025-07-01","Comprehensive Privacy","N/A","State AG","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection and addresses ADS in the context of profiling, though it does not place constraints or prohibitions on processing. \"Profiling\" means a form of automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. 47-18-3201(20). ","Y","Controller must disclose in privacy notice its processing of personal information for targeted advertising. Sec. 47-18-3204(d). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller must conduct data protection assessment for specified processing activities, including processing for purposes of targeted advertising, processing for purposes of profiling presents a reasonably foreseeable risk of \"(A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where the intrusion would be offensive to a reasonable person; or (D) Other substantial injury to consumers and processing of sensitive data.\" Sec. 47-18-3206(a)."]
["Texas","Artificial Intelligence Advisory Protection Act","HB 2060","https://custom.statenet.com/public/resources.cgi?id=ID:bill:TX2023000H2060&ciq=ncsl&client_md=7f917a24ed4a10a5df71df259c5b47ef&mode=current_text","passed","2023-06-13","2023-06-13","Task Force (Advisory council)","Research/general oversight","State Legislature","N","This act creates an advisory council to study the effects of AI and report findings to the legislature.\n\n\"Automated decision system\" means an algorithm, including an algorithm incorporating machine learning or other artificial intelligence techniques, that uses data-based analytics to make or support governmental decisions, judgments, or conclusions. Sec. 2054.621(3)\n\n\"Automated final decision system\" means an automated decision system that makes final decisions, judgments, or conclusions without human intervention. Sec. 2054.621(4)\n\n\"Automated support decision system\" means an automated decision system that provides information to inform the final decision, judgment, or conclusion of a human decision maker. Sec. 2054.621(5)","N","N/A","Y","AUTOMATED DECISION SYSTEMS INVENTORY REPORT. (a) Not later than July 1, 2024, each agency in the executive and legislative branches of state government, using money appropriated to the agency by this state, shall submit an inventory report of all automated decision systems that are being developed, employed, or procured by the agency. \n\nthe inventory report must include a description of:\n\n(1) the name and vendor of the automated decision system, if any;\n\n(2) the automated decision system's general capabilities, including:\n\n(A) reasonably foreseeable capabilities outside the scope of the agency's proposed use; and\n\n(B) whether the automated decision system is used or may be used for independent decision-making powers and the impact of those decisions on the residents of this state;\n\n(3) the types of data inputs that the technology uses;\n\n(4) how the data described by Subdivision (3) is generated, collected, and processed;\n\n(5) the types of data the automated decision system is reasonably likely to generate;\n\n(6) whether the automated decision system has been tested by an independent third party, has a known bias, or is untested for bias;\n\n(7) the purpose and proposed use of the automated decision system, including:\n\n(A) the decisions the automated decision system will be used to make or support;\n\n(B) whether the automated decision system is an automated final decision system or an automated support decision system; and\n\n(C) the automated decision system's intended benefits, including any data or research relevant to the outcome of those results;\n\n(8) how automated decision system data is securely stored and processed and whether the agency intends to share access to the automated decision system or data from that automated decision system with any other entity, and why; and\n\n(9) the information technology fiscal impacts of the automated decision system, including:\n\n(A) initial acquisition costs and ongoing operating costs, such as maintenance, licensing, personnel, legal compliance, use auditing, data retention, and security costs;\n\n(B) any cost savings that would be achieved through the use of the technology; and\n\n(C) any current or potential sources of funding, including any subsidies or free products being offered by vendors or governmental entities.\n\n(b) Not later than March 1, 2024, the council, in consultation with the department, shall prescribe the form, contents, and manner of submission of the automated decision systems inventory report required under this section.\n\n(c) Each agency shall submit the report required under this section to the:\n\n(1) department;\n\n(2) council; and\n\n(3) standing committees of the senate and house of representatives with primary jurisdiction over state agency information technology. Sec. 2054.623","N","N/A","N","N/A","N","N/A","Y","The report must assess \"whether the automated decision system has been tested by an independent third party, has a known bias, or is untested for bias\"  Sec. 2054.623(6)."]
["Texas","Texas Data Privacy and Security Act","H.B. 4","https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm","passed","2023-06-06","2024-03-01","Comprehensive Privacy",null,"State AG","N","A controller shall comply with an authenticated consumer request to exercise the right to: opt out of the processing of the personal data for purposes of profiling. \"Profiling\" means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.",null,null,"Y","A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data: the processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk. ","N","N/A","N","N/A","N","N/A","N","N/A"]
["Tennessee","Deployment of surveillance or electronic data gathering devices onto public rights-of-way requires metropolitan council approval.","Nashville Code of Laws 13.08.080","https://library.municode.com/tn/metro_government_of_nashville_and_davidson_county/codes/code_of_ordinances?nodeId=CD_TIT13STSIPUPL_DIVIGERE_CH13.08STALSI","passed","2017-06-01","2017-07-01","Non-Policing Criminal Justice (e.g., Parole, Bail, Sentencing)","Roadways","Metro Gov't of Nashville and Davidson County","Y","\"Approval by the metropolitan council, by a resolution adopted after a public hearing, shall be required prior to any of the following actions by the Metropolitan Government of Nashville or Davidson County, the departments, boards or commissions thereof, or any individual or entity acting upon its behalf: (1) Installing surveillance technology onto or within the public right-of-way, unless: (a) the same type of surveillance technology is already in use by the entity; and (b) the number of new devices does not represent more than a fifty percent increase in the total number of devices of the same type already in use by the department, board, or commission seeking installation, as compared to the number of devices in use at the time of this ordinance's implementation or at the time of the last such approval by the metropolitan council, whichever is more recent.\" 13.08.080(C)(1). \n\nThe law imposes additional restrictions on license plate readers (LPR) for police officers: a department wishing to acquire LPR technology must comply with a usage and privacy policy, and this policy must be posted on the department's website. The policy forbids the use of an LPR system that is capable of facial recognition. 13.08.080(G)(1).\n\nFurthermore, whenever a license plate reader alerts on a plate, law enforcement, before taking any action, must confirm visually that a plate matches the number and state identified in the alert, that the alert is still active by calling dispatch, whether the alert pertains to the registrant of the car and not the car itself, and that the license plate is on the list for one of the authorized purposes listed. 13.08.080(G)(1)(v). ","Y ","Any department of the metropolitan government that uses a license plate scanner must post a usage and privacy policy publicly on the department's website. ","N","Beginning July 1, 2017, approval by the metropolitan council, by a resolution adopted after a public hearing, shall be required prior to any of the following actions by the Metropolitan Government of Nashville or Davidson County, the departments, boards or commissions thereof, or any individual or entity acting upon its behalf: (1) Installing surveillance technology onto or within the public right-of-way, unless: (a) the same type of surveillance technology is already in use by the entity; and (b) the number of new devices does not represent more than a fifty percent increase in the total number of devices of the same type already in use by the department, board, or commission seeking installation, as compared to the number of devices in use at the time of this ordinance's implementation or at the time of the last such approval by the metropolitan council, whichever is more recent. (2) Entering into an agreement with a private entity to acquire, share or otherwise use surveillance technology or the information it provides if such agreement includes exchange of any monetary or any other form of consideration from any source, including the assessment of any additional fees, interest, or surcharges on unpaid fines or debts absent approval by the metropolitan council; (3) Accepting state or federal funds or in-kind or other donations for surveillance technology; (4) Acquiring new surveillance technology, including but not limited to procuring such technology without the exchange of monies or consideration; (5) Entering into an intergovernmental agreement regarding the installation of surveillance technology or use of the information it provides within the Dwight D. Eisenhower National System of Interstate and Defense Highways; or (6) Acquiring or entering into an agreement to acquire surveillance footage or data captured by technology owned by a person or business without the direct consent of that person or business absent a judicial warrant or order to the contrary. 13.08.080(c)(1)-(6).","N","N/A","N","N/A","N","N/A","Y","Audit performed to the LPR and access history at least one time per year and an audit trail of access to system for a period of no less than 3 years. Officers must record date, time, and location, any investigative or enforcement actions and the self identified race and ethnicity of the driver if provided voluntarily by the driver following the law enforcement officer's request. See 13.08.080(g)(1)-(5).","The district attorney general, or a designee, or the public defender, or a designee, or the executive director of the community oversight board, or a designee may audit.",null,"The Nashville city council has considered other similar bills that would amend this section in relation to the use of license plate scanners. BL2020-581 would have allowed the use of LPRs if they met specific requirements. BL2020-494 would have only allowed the use of LPRs in relation to reckless driving. BL2020-582 would have allowed a more expansive use of LPRs. All these attempts to amend this section have failed. "]
["Tennessee","Tennessee Information Protection Act","SB0073/HB1181","https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=SB0073","passed","2023-05-11","2023-07-01","Comprehensive Privacy","General Use",null,null,"Controllers must comply with an authenticated consumer request to exercise the right to opt out of controller's processing of personal information for purposes of \"[p]rofiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.\" 47-18-3203(a)(2)(E)(iii). \n\nProfiling \"means a form of solely automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" 47-18-3201 (21).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"A controller shall conduct and document a data protection assessment of \"[t]he processing of personal information for purposes of profiling, where the profiling presents a reasonably foreseeable risk of: (A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where the intrusion would be offensive to a reasonable person; or (D) Other substantial injury to consumers.\" 47-18-3206(a)(3)(A)-(D). "]
["Utah","Consumer Privacy Act","Senate Bill 227","https://le.utah.gov/~2022/bills/static/SB0227.html","passed","2022-03-24","2023-12-31","Comprehensive Privacy","Consumer Protection ","State AG","N","This law does not explicitly address ADS. It does include provisions concerning sensitive data. Sensitive data includes biometric data. Biometric data means data generated by automatic measurements of an individual's unique biological characteristics with the exception of photographs, video or audio recording or information captured in a health setting. 13.61-101 (6)(a)","Y","Sensitive data may not be processed without first presenting the consumer with clear notice and an opportunity to opt out of the processing. 13.61-302 (3)(a)","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Vermont","An Action relating to the use and oversight of artificial intelligence in State Government","VT HB 410","https://legislature.vermont.gov/Documents/2022/Docs/ACTS/ACT132/ACT132%20As%20Enacted.pdf","passed","2022-05-24","2022-05-24","Non-Policing Criminal Justice (e.g., Parole, Bail, Sentencing)","Research/general oversight",null,"N","\"The Agency of Digital Services shall conduct a review and make an inventory of all automated decision systems that are being developed, employed, or procured by State government. The inventory shall include the following for each automated decision system: \n(1) the automated decision system’s name and vendor; \n(2) a description of the automated decision system’s general capabilities, including: (A) reasonably foreseeable capabilities outside the scope of the agency’s proposed use; and (B) whether the automated decision system is used or may be used for independent decision-making powers and the impact of those decisions on Vermont residents; \n(3) the type or types of data inputs that the technology uses; how that data is generated, collected, and processed; and the type or types of data the automated decision system is reasonably likely to generate; \n(4) whether the automated decision system has been tested for bias by an independent third party, has a known bias, or is untested for bias;\n(5) a description of the purpose and proposed use of the automated\ndecision system, including: (A) what decision or decisions it will be used to make or support; (B) whether it is an automated final decision system or automated support decision system; and (C) its intended benefits, including any data or research relevant to the outcome of those results;\n(6) how automated decision system data is securely stored and processed and whether an agency intends to share access to the automated decision system or the data from that automated decision system with any other entity, which entity, and why; and \n(7) a description of the IT fiscal impacts of the automated decision system, including: (A) initial acquisition costs and ongoing operating costs, such as maintenance, licensing, personnel, legal compliance, use auditing, data retention, and security costs; (B) any cost savings that would be achieved through the use of the technology; and (C) any current or potential sources of funding, including any subsidies or free products being offered by vendors or governmental entities.\" § 3305(b)","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Creation of the Artificial Intelligence Commission to support the ethical use and development of AI in the state relating to the use and oversight of AI in State government operations. The Advisory Council is to provide advice and counsel to the Director of the Division of Artificial Intelligence with regard to the Division's responsibilities to review all aspects of artificial intelligence systems developed, employed, or procured in State government. § 5013(a). ","On or before January 15, 2024, the Council shall, among other things, develop and submit to the House Committee on Energy and Technology and the Senate Committees on Finance and Government Operations recommendations for a clear use and data management policy for State government, which will include protocols for: how and when automated decision making systems will be deployed or used and by whom; whether the automated decision system gives notices to individual impacted; whether the automated decision system ensures that the agency can explain the basis for its decision to any impacted individual in terms understandable to a layperson; and what policies the State should have for third party entities to disclose potential conflicts of interest. Sec. 7(1)-(4). "]
["Virginia","Consumer Data Protection Act","Code of Virginia  Chapter 53 59.1-575","https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/#:~:text=%C2%A7%2059.1%2D575.,branding%20with%20another%20legal%20entity.","passed","2021-03-02","2023-01-01","Comprehensive Privacy","Consumer Protection ","State AG","N","A consumer may opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. § 59.1-577(5)(i)-(iii). Such profiling includes the provision or denial of financial/lending services, housing, insurance, education, criminal justice, employment, health care services. However, it notes that government agencies and GLBA regulated entities such as financial institutions and insurance companies are not subject to this opt out provision. See § 59.1-576 (B). \n\nProfiling is defined as \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" § 59.1-575.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Section 59.1-580 provides that data controllers must contract a data protection assessment with respect to:  \"the processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) financial, physical, or reputational injury to consumers; (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (iv) other substantial injury to consumers.\" § 59.1-580 (3). The AG may request the results of these assessments pursuant to a civil action or investigation."]
["Washington","2021-2023 Fiscal Biennium Operating Appropriations","WA SB 5092","https://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Passed%20Legislature/5092-S.PL.pdf?q=20221108205212","passed","2021-04-25","2021-04-25","Policing","State Government","Chief Information Officer","N","This bill provides an appropriation for the creation of a chief information officer who must convene a working group  to examine how automated decision making systems can best be reviewed before adoption and while in operation and be periodically audited to ensure that such systems are fair, transparent, accountable and do not improperly advantage or disadvantage Washington residents. Sec. 151.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,null,"The office of the chief information officer released their first report in December 2021.  It can be found here:  https://watech.wa.gov/sites/default/files/public/privacy/Automated%20Decision%20Systems%20Workgroup%20Report.pdf.  "]
["Washington","Ballot Initiative #2 for Bellingham, Washington","Ballot Initiative #2","https://peoplefirstbellingham.org/two/index.html","passed","2021-11-02","2021-11-02","Government","Facial Recognition","City AG/Police","Y","Ban on use of facial recognition technology by city officials as well as a ban on predictive policing technology generally. \n\nIt is unlawful for the City or/and City official to obtain, retain, store, possess, access, use or collect any facial recognition technology or data or information derived from facial recognition technology. Nor can a contract or agreement with any third party be entered into by the City of Bellingham or an official for facial recognition technology. Additionally, similar restrictions are placed upon the City and its officials in regards to predictive policing technology and use in criminal or civil trials. The exceptions include: conflicts with the Constitution, State of Washington or any federal or state law, redacting to protect privacy of subject, privately owned consumer devices for commercial use or security and facial recognition by the city or it's officials in order to secure entry or access to restricted buildings and spaces. Section 3(1).\n\nSection 6 also imposes a prohibition on the city's acquisition or use of predictive policing technology. Section 6(1). Section 7 bans the use of evidence obtained from predictive policing technology in criminal and civil trials. Section 7.   \n\n\"Predictive Policing Technology\" is defined as \"software that is used to predict information or trends about crime or criminality in the present or future, including but not limited to the characteristics or profile of any person(s) likely to commit a crime, the identity of any person(s) likely to commit crime, the locations or frequency of crime, or the person(s) impacted by predicted crime. Such software typically uses algorithms to sort through large data sets.\" Section 2(5). ","Y","\"In the event that any data or information on an individual is obtained, retained, stored, possessed, accessed, used, collected, or derived in violation of [the ordinance], that individual should be notified within thirty (30) days of the violation by registered mail.\" Section 8(2). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Section 4 provides that no data or information that is obtained, retained, stored, possessed, accessed, used, collected, or derived from any facial recognition technology or other use of facial recognition in violation of Section 3, and no evidence derived therefrom, may be used by the City of Bellingham or City of Bellingham officials as evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority."]

{"sheet":"Proposed Legislation (2023)","index":2,"n_rows":39,"n_cols":27,"rows_kept":39,"cut":false,"hidden":false,"merged":[[0,0,0,6],[0,7,0,8],[0,10,0,26]]}
["Proposed Legislation (as of July 2023)",null,null,null,null,null,null,"Sector ",null,null,"Details"]
["State","Name","Bill No.","Reference/Link","Type (Drop Down)","Date of Proposal","Status of Legislation","Sector (Drop Down)","Subsector (e.g., parole, bail, and sentencing; resume sorting, hiring)","Enforcement Entity (e.g., state AG, specific department or task force)","Ban (Y/N)","Explain (e.g., exceptions/ qualifications or is it a total ban)","Notice  Requirement (Y/N)","Explain (e.g., who must receive notice)","Reporting  Requirement (Y/N)","Explain (e.g., for what purpose, who is it reported to)","Input Limitations (Y/N)","Explain (e.g., prohibitions on certain types of information)","Explanation Requirement (Y/N)","Explain","Open Source Requirement (Y/N)","Explain","Audit / Bias Checks? (Y/N)","Explain","If Yes to Audit / Bias Check - who conducts them? ","Other Characteristics?","Additional Comments/ Questions"]
["California","An act to add Chapter 25 (commencing with Section 22756) to Division 8 of the Business and Professions Code, relating to artificial intelligence","AB-331","Bill Text - AB-331 Automated decision tools. (ca.gov)","proposed","2023-01-30","In committee: Held under submission. 5/18/2023","General Use","N/A","State AG and other public attorneys in the state","N","While this law does not explicitly ban Artificial Intelligence, it sets the framework for the regulation of \"Automated decision tools\" which are defined as \"a system or service that uses artificial intelligence and has been specifically developed and marketed to, or specifically modified to, make, or be a controlling factor in making, consequential decisions.\" 22756(c). \n\nBoth deployers and developers must perform impact assessments for the use of Automated decision tools on or before January 1, 2025, and annually thereafter. 22756.1(a)-(b). However note that there is a carve out for developers with fewer than 25 employees unless, as of the end of the prior calendar year, the deployer deployed an automated decision tool that impacted more than 999 people per year. 22756(d).  \n\nAdditionally, \"[a] deployer shall not use an automated decision tool in a manner that contributes to results in algorithmic discrimination.\" 22756.6. (a). \n\nDeployer means \"a person, partnership, state or local government agency, or corporation that uses an automated decision tool to make a consequential decision.\" 22756(e). \n\nDeveloper means \"a person, partnership, state or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligence system or service for the intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by a third party.\" 22756(f). ","Y","Deployers—at the time that the tool is being used to make a consequential decision—must notify individuals about why and how the tool is being used and provide a plain language description of the tool that includes a disclosure of any human components and how any automated component is used to inform a consequential decision. 22756.2(a). \n\n\"A deployer shall, at or before the time an automated decision tool is used to make a consequential decision, notify any natural person that is the subject of the consequential decision that an automated decision tool is being used to make, or be a controlling factor in making, the consequential decision.\" 22756.2(a). \n\nDeployers must provide: \"(A) A statement of the purpose of the automated decision tool. (B) Contact information for the deployer. (C) A plain language description of the automated decision tool that includes a description of any human components and how any automated component is used to inform a consequential decision\" and \"[i]f a consequential decision is made solely based on the output of an automated decision tool, a deployer shall, if technically feasible, accommodate a natural person’s request to not be subject to the automated decision tool and to be subject to an alternative selection process or accommodation.\" 22756.2(a).  \n\nAdditionally, \"[a] developer shall provide a deployer with a statement regarding the intended uses of the automated decision tool and documentation regarding all of the following: (1) The known limitations of the automated decision tool, including any reasonably foreseeable risks of algorithmic discrimination arising from its intended use. (2) A description of the type of data used to program or train the automated decision tool. (3) A description of how the automated decision tool was evaluated for validity and explainability before sale or licensing.\" 22756.3(a)(1)-(3). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"\"If a consequential decision is made solely based on the output of an automated decision tool, a deployer shall, if technically feasible, accommodate a natural person’s request to not be subject to the automated decision tool and to be subject to an alternative selection process or accommodation.\" 22756.2.(b)(1). \n\nThe bill includes a private right of action against deployers for uses that result in algorithmic discrimination, though the plaintiff bears the burden of demonstrating that the deployer’s use of the automated decision tool resulted in algorithmic discrimination that caused actual harm to the person bringing the civil action. 22756.6.(b)(2). \n\nAdditionally, the bill includes cybersecurity requirements. Specifically, that \"[a] deployer or developer shall establish, document, implement, and maintain a governance program that contains reasonable administrative and technical safeguards to map, measure, manage, and govern the reasonably foreseeable risks of algorithmic discrimination associated with the use or intended use of an automated decision tool.\" 22756.4.(a)(1)."]
["California","An act to add Section 11546.45.5 to the Government Code, relating to automated decision systems.","A 302","https://legiscan.com/CA/text/AB302/id/2814759","proposed","2023-01-26","Referred to the Committee on Governmental Organization and the Committee on Judiciary on 06/07/2023. ","Task Force","Government","Department of Technology","N","Does not ban the use of ADS, but rather, requires that \"on or before September 1, 2024, the Department of Technology shall conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency.\" 11546.45.5(b). \n\nAutomated decision system means \"a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.\" 11546.45.5(a)(1). \n\nHigh-risk automated decision system means \"an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.\" 11546.45.5(a)(3). ","N","N/A","Y","\"On or before January 1, 2025, and annually thereafter, the department shall submit a report of the comprehensive inventory described in subdivision (b) to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization.\" 11546.45.5(d)(1). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","Artificial intelligence (Senate Concurrent Resolution 17)","SCR 17","https://legiscan.com/CA/text/SCR17/id/2670350","proposed","2023-01-30","6/13 hearing postponed by Committee","Government","General Use","N/A","N","Does not ban the use of ADS, but rather affirms the California Legislature's commitment to President Biden’s vision for safe AI and the principles outlined in the “Blueprint for an AI Bill of Rights,” including: Safe and Effective Systems, Algorithmic Discrimination Protections, Data Privacy, Notice and Explanation, and Human Alternatives, Consideration, and Fallback. ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["California ","Department of Technology: Office of Artificial Intelligence: state agency public interface: use of AI.","SB 313","https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB313","proposed","2023-02-06","5/18 hearing: Held in committee and under submission as of 5/18/2023.","Government ","Government Use","Department of Technology: Office of Artificial Intelligence","N","Does not ban the use of ADS, bur rather, would enact the California AI-ware Act, which would establish, within the Department of Technology, the Office of Artificial Intelligence, and would grant the office the power and authority necessary to guide the design, use, and deployment of automated systems by a state agency to ensure that all AI systems are designed and deployed in a manner that is consistent with state and federal laws and regulations regarding privacy and civil liberties and that minimizes bias and promotes equitable outcomes for all Californians. \n\nThe law would provide the Office of Artificial Intelligence with \"the power and authority necessary to guide the design, use, or deployment of automated systems by a state agency to ensure that all AI systems are designed and deployed in a manner that is consistent with state and federal laws and regulations regarding privacy and civil liberties and that minimizes bias and promotes equitable outcomes for all Californians.\" 11549.83. ","Y","A state agency that utilizes generative artificial intelligence must communicate directly \"with a person, either through an online interface or telephonically, shall clearly and in a conspicuous manner identify to that person that their interaction with the state agency is being communicated through artificial intelligence\" and furthermore, \"[a] state agency that utilizes generative artificial intelligence to directly communicate with a person shall provide on the agency’s internet website clear instructions, or a link to a page with clear instructions, informing the person when and how the person can directly communicate with a person from the state agency.\" 11549.84(a)-(b). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["California","Department of Technology: advanced technology: research","SB 398","https://legiscan.com/CA/text/SB398/id/2782396","proposed","2023-02-09","Referred to the Committee on Governmental Organization on 4/18/2023","Government","Research ","Department of Technology","N","Does not ban the use of ADS, bur rather, dedicates \"funds to research the feasibility and risks of using advanced technology, such as artificial intelligence dialogue systems, to improve government services\" and provides that \"upon appropriation by the Legislature, the Department of Technology shall develop and implement a comprehensive research plan to study the feasibility of using advanced technology to improve government services\" and \"provides for the Government Services Advanced Technology Act, which would require the Department of Justice, upon appropriation by the Legislature, to develop and implement a comprehensive research plan to study the feasibility of using advanced technology to improve state and local government services.\" 1546.8(b)-(c). ","N","N/A","Y","On or before January 1, 2026, the Department of Technology shall provide a report to the Legislature on its research findings. 1546.8(e). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["District of Columbia","Stop Discrimination by Algorithms Act 2023","25-114","https://legiscan.com/DC/text/B25-0114/id/2683540","proposed","2023-02-02","Notice of Intent to Act on B25-0114 Published in the DC Register on 2/10/2023","General Use ","Private Sector","Attorney General for the District of Columbia","N","Does not ban the use of ADS, but rather, provides that \"[a] covered entity shall not make an algorithmic eligibility determination or an algorithmic information availability determination on the basis of an individual’s or class of  individuals’ actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, source of income, or disability in a manner that segregates, discriminates against, or otherwise makes important life opportunities unavailable to an individual or class of individuals.\" Section 4(a). \n\nCovered entity means \"any individual, firm, corporation, partnership, cooperative, association, or any other organization, legal entity, or group of individuals however organized, including entities related by common ownership or corporate control, that either makes algorithmic eligibility determinations or algorithmic information availability determinations, or relies on algorithmic eligibility determinations or algorithmic information availability determinations supplied by a service provider, and that meets one of the following criteria: (A) Possesses or controls personal information on more than 25,000 District residents; (B) Has greater than $15 million in average annualized gross receipts for the 3 years preceding the most recent fiscal year; (C) Is a data broker, or other entity, that derives 50 percent or more of its annual revenue by collecting, assembling, selling, distributing, providing access to, or maintaining personal information, and some proportion of the personal information concerns a District resident who is not a customer or an employee of that entity; or (D) Is a service provider.\" Section 3(4). ","Y","A covered entity shall \"develop a notice about how the covered entity uses personal information in algorithmic eligibility determinations and algorithmic information availability determinations\" and the notice shall include: \"(A) What personal information the covered entity collects, generates, infers, uses, and retains; (B) What sources the covered entity uses to collect, generate, or infer personal information; (C) Whether the personal information is shared, sold, leased, or exchanged with any service providers for any kind of consideration, and if so, the names of those service providers, including subsidiaries of the service providers; (D) A brief description of the relationship between the personal information and the algorithmic information availability or algorithmic eligibility determinations; (E) How long the covered entity will hold the personal information; and (F) The rights provided under this act.\" Section 6(a).  \n\nAdditionally, the notice must be continuously and conspicuously available (meeting certain requirements for posting and/or delivery) and must be updated within 30 days after changing its collection or use practices or policies in away that affects the content of the notice. Section 6(3)-(4). ","Y","A covered entity shall annually submit a report containing the results of the audit mandated under this section to the Office of the Attorney General for the District of Columbia on a form provided by the Office of the Attorney General.\n\nThe report must include: \"(A) The types of algorithmic eligibility determination and algorithmic information availability determination that the covered entity makes; (B) The data and methodologies that the covered entity uses to establish 268 the algorithms; (C) The optimization criteria of the algorithms used to make the determinations; (D) Any data or sets of data used to train the algorithms, and the source or sources of that data; (E) The methodologies the covered entity uses to render the determinations; (F) Any performance metrics the entity uses to gauge the accuracy of the assessments, including accuracy, confidence intervals, and how those assessments are obtained; (G) The frequency, methodology, and results of the impact assessments or risk assessments that the entity has conducted; (H) Within the description of each of the above decisions, the rationale for each of these decisions; (I) Whether the covered entity has received complaints from individuals regarding the algorithmic eligibility determinations and algorithmic information availability determinations it has made; and (J) If the covered entity has determined that one or more of the exemptions referred to in section 4(b) apply to practices that would otherwise violate section 4(a), a declaration and explanation of the covered entity’s reliance on those exemptions.\" Section 7(b)(1). ","N","N/A","N","N/A","N","N/A","Y","\"A covered entity shall annually audit its algorithmic eligibility determination and algorithmic information availability determination practices to: \n(1) Determine whether the processing practices discriminate in a manner prohibited by section 4 of this act; \n(2) Analyze disparate-impact risks of algorithmic eligibility determinations and algorithmic information availability determinations based on actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, genetic information, source of income, or disability; \n(3) Create and retain for at least 5 years an audit trail that records, for each algorithmic eligibility determination...\n(4) Conduct annual impact assessments of (A) Existing systems that render algorithmic eligibility determinations and algorithmic information availability determinations; and (B) Prior to implementation, new systems that render algorithmic eligibility determinations and algorithmic information availability determinations; \n(5) Conduct the audits under paragraphs (1), (2), and (3) of this subsection in consultation with third parties who have substantial information about or participated in the covered entity’s algorithmic eligibility determinations and algorithmic information availability determinations, including service providers; and \n(6) Identify and implement reasonable measures to address risks of an unlawful disparate impact identified in the audits and impact assessments conducted under paragraphs (1), (2), and (3) of this subsection, including the risks posed by determinations made by the covered entity’s service providers.\" Section 7(a). ","Covered Entity and additionally, must be conducted in consultation with a third party who has substantial information about or has participated in the covered entity's eligibility determinations and algorithmic ability determinations. "]
["Hawaii","Consumer Data Protection Act","SB 974","https://www.capitol.hawaii.gov/session/measure_indiv.aspx?billtype=SB&billnumber=974&year=2023","proposed","2023-01-20","Referred to the Committee on \nCommerce and Consumer Protection and the Committee on Ways and Means on 1/27/2023","Comprehensive Privacy","N/A","State AG","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as: \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" Sec. 1. \n\nConsumers have the right to opt-out of processing of personal data for purposes of  “[p]rofiling in furtherance of decisions made by the controller that result[] in the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities.” Sec. 3(a)(5).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Hawaii","Consumer Data Protection Act ","SB 1110","https://www.capitol.hawaii.gov/session/measure_indiv.aspx?billtype=SB&billnumber=1110&year=2023","proposed","2023-01-20","Referred to the Committee on \nCommerce and Consumer Protection, the Committee on Judiciary, and the  Committee on Ways and Means on 1/27/2023","Comprehensive Privacy","N/A","State AG, Office of Consumer Protection, private right of action","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as: \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" Sec. 1.\n\nConsumers have the right to opt-out of processing of personal data for purposes of “[p]rofiling in furtherance of decisions made by the controller that ... produce legal or similar significant effects.” Sec. 3(a)(5).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller must conduct a data protection assessment for processing activities including processing personal data for purposes of targeted advertising, processing for purposes of profiling where there is a reasonably foreseeable risk of: \"(A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical intrusion or other intrusion upon the solitude or seclusion, or the private affairs or concerns of consumers, where the intrusion would be offensive to a reasonable person; or (D) other substantial injury to consumers.\" Sec. 6(b)(3)(A)-(D). "]
["Illinois","Safe Patients Limit Act","SB 2314","https://legiscan.com/IL/text/SB2314/2023","proposed","2023-02-10","Added Sen. Kimberly A. Lightford as Chief Co-Sponsor on 3/30/2023","Health","Nursing","Illinois Department of Public Health","N","Does not ban ADS, but does explicitly provide that \"a hospital, long-term acute care hospital, ambulatory surgical treatment center, or other health care facility shall not adopt a policy that...substitutes recommendations, decisions, or outputs of health information technology, algorithms used to achieve a medical or nursing care objective at a facility, systems based on artificial intelligence or machine learning, or clinical practice guidelines for the independent nursing judgment of a direct care registered professional nurse or penalize a direct care registered professional nurse for overriding the technology or guidelines if, in that registered nurse's judgment, and in accordance with that registered nurse's scope of practice, it is in the best interest of the patient to do so.\" 50-15.15(c)(2). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Illinois ","Anti-Click Gambling Data Analytics Collection Act","HB 2570","https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=112&GA=103&DocTypeId=HB&DocNum=2570&GAID=17&LegID=&SpecSess=&Session=","proposed","2023-02-15","Referred to the Rules Committee on 3/10/2023","Gaming","Gambling","Not specified","N","The proposed legislation does not ban the use of ADS, but does provide that an entity that \"operates a remote gambling platform or a subsidiary of the entity shall not collect data from a participant with the intent to predict how the participant will gamble in a particular gambling or betting scenario.\" Section 10. ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Illinois","Illinois Data Privacy and Protection Act","HB 3385","https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=112&GA=103&DocTypeId=HB&DocNum=3385&GAID=17&LegID=148551&SpecSess=&Session=","proposed","2023-02-17","Rule 19(a) / Re-referred to Rules Committee","Comprehensive Privacy","N/A","The Attorney General, State's Attorney, or a municipality's attorney","N","Does not ban use of ADS.\n\nCreates the Illinois Data Privacy and Protection Act. Provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate. Provides that a covered entity and a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection, processing, and transferring of covered data.\n","Y","Each affected individual of covered data transfer","Y","Large data holders must report to AG that the entity maintains (1) internal controls reasonably designed to comply with this Act; and\n(2) internal reporting structures to ensure that such certifying executive officer is involved in and responsible for the decisions that impact the compliance by the large data holder with this Act.","N","N/A","N","N/A","N","N/A","N","N/A"]
["Illinois","An Act Concerning State Government","HB 3563 ","https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=112&GA=103&DocTypeId=HB&DocNum=3563&GAID=17&LegID=148734&SpecSess=&Session=","proposed","2023-02-17","Passed both Houses as of 5/18/2023","Task Force","Government","The Department of Innovation and Technology","N","Does not ban ADS, but creates a task force for Generative AI and Natural Language Processing. Section 5. \n\nThe Task Force is charged with: \"(1) recommending legislation or regulations to protect consumer information as it relates to generative artificial intelligence; (2) recommending model policies for schools to address the use of generative artificial intelligence by students in the classroom; (3) assessing the use of generative artificial intelligence to improve delivery of public services; (5) protecting civil rights and civil liberties of individuals and consumers as it relates to generative artificial intelligence; (6) assessing the use of generative artificial intelligence in the workforce and how this could affect employment levels, types of employment, and the deployment of workers; (7) assessing the challenges of generative artificial intelligence for cybersecurity; and (8) other topics related to generative artificial intelligence software and natural language processing software that may arise from testimony or reports to the Task Force submitted by its members or the public.\" Section 5(e)(1)-(8). ","N","N/A","Y","The Task Force shall file a report by December 31, 2024 with the Governor and the General Assembly covering the Task Force's investigation into generative artificial intelligence software and natural language processing software and the Task Force's responsibilities under subsection (e). Section 5(g). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["Illinois","An Act concerning business","HB 3773","https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=112&GA=103&DocTypeId=HB&DocNum=3773&GAID=17&LegID=&SpecSess=&Session=","proposed","2023-02-17","Re-referred to Rules Committee on 3/10/2023","Employment","Anti-discrimination","Illinois Department of Human Rights","N","Does not ban the use of ADS, but proposes amending the Illinois Human Rights Act to provide that \"[a]n employer that uses predictive data analytics in its employment decisions may not consider the applicant's race or zip code when used as a proxy for race to reject an applicant in the context of recruiting, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure or terms, privileges, or conditions of employment.\" Sec. 2-102(L). \n\nPredictive analytics means \"the use of automated machine learning algorithms for the purpose of statistically analyzing a person's behavior.\" Sec. 2-101(m). \n\nAdditionally, with respect to creditworthiness, the proposed law provides that \"[a]person or entity that relies either partially or fully on predictive data analytics to determine a consumer's creditworthiness may not allow the use of information about the consumer that assigns specific risk factors to the consumer's race or zip code resulting in rejection of credit or other adverse credit-related action to a consumer\" and that \"[a]person or entity that uses predictive data analytics to determine the creditworthiness of more than 50 consumers in a calendar year who are State residents shall, within 90 days after the effective date of this amendatory Act of the 103rd General Assembly, devise procedures to ensure that it does not consider information that assigns specific risk factors to a consumer's race or zip code when rejecting or taking other adverse action on a consumer's application for credit.\" Sec. 2BBBB(a)-(c). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Indiana","A bill for an Act to amend the Indiana Code concerning trade regulation and to make an appropriation","HB 1554","https://iga.in.gov/legislative/2023/bills/house/1554#document-7b76bc15","proposed","2023-01-19","Referred to Committee on Commerce, Small Business and Economic Development on 1/19/2023","Comprehensive Privacy","N/A","State AG","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" Ch. 2. Sec. 31. \n\nConsumers have the right to opt-out of processing of personal data for purposes of “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” Ch. 3, Sec. 1(b)(8).","N",null,"N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller must conduct data protection impact assessment for activities including the processing for purposes of profiling if there is a reasonably foreseeable risk of: \"(A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) financial, physical, or reputational injury to consumers; (C) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, if such intrusion would be offensive to a reasonable person; or (D) other substantial injury to customers.\"  and the processing of sensitive data. Ch. 6, Sec. 1(b)(3)(A)-(D). "]
["Kentucky","Kentucky Consumer Data Protection \nAct","SB 15","https://apps.legislature.ky.gov/record/23RS/sb15.html#actions","proposed","2023-01-03","Referred to Economic Development, Tourism, and Labor Committee on 1/5/2023","Comprehensive Privacy","N/A","State AG (generally); private right of action (for violations of specified consumer data rights)","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as \"means any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.\" Sec. 1(20).\n\nAlthough the bill does not provide consumers with the right to opt-out of processing of personal data for purposes of profiling, it does provide consumers with the right to opt out of targeted advertising and tracking. Sec. 3(2).","N",null,"N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controllers must conduct data protection impact assessments for processing activities including processing personal data for purposes of targeted advertising or tracking; processing for purposes of profiling, where profiling poses as reasonably foreseeable risk of \"(1) Unfair or deceptive treatment of consumers or disparate impact on consumers; (2) Financial, physical, or reputational injury to consumers; (3) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (4) Any other substantial injury to consumers;\n. Sec. 8(1)(C)(1)-(4). "]
["Maine","An Act to Address Unsafe Staffing of Nurses and Improve Patient Care","S 656","https://legislature.maine.gov/bills/getPDF.asp?paper=SP0656&item=1&snum=131","proposed","2023-04-12","In Senate as of 4/12/2023","Health","Nursing","State AG","N","Does not ban ADS, but does provide that a health care facility may not adopt policies or practices that \"[e]mploy health information technology, algorithms used to achieve a medical or nursing care objective, systems based on artificial intelligence or clinical practice guidelines that limit or substitute for the direct care provided by an assigned direct-care registered nurse in the performance of functions that are part of the nursing process, including the full exercise of independent professional judgment, or that limit a direct care registered nurse from acting as a patient advocate in the exclusive interests of the patient.\" § 1798(2). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Massachusetts","Massachusetts Data Privacy Protection Act","SD 745/HD 2281","https://malegislature.gov/Bills/193/SD745; \nhttps://malegislature.gov/Bills/193/HD2281","proposed","1/18/2023 (SD 745); 1/19/2023 (HD 2281)","Filed on Senate and House dockets on 1/18/2023 (SD 745) and 1/19/2023 (HD 2281)","Comprehensive Privacy","N/A","State AG; private right of action","N","While not a ban on ADS, employers are prohibited from making hiring or employment-related decisions based solely on information collected via electronic monitoring. Sec. 204(k). In addition, employers must “give the affected employee access to the data and provide an opportunity to correct or explain it.” Sec. 204(k). \n\nThe bill also defines covered algorithms as \"a computational process that uses machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity and that makes a decision or facilitates human decision-making with respect to covered data, including determining the provision of products or services or to rank, order, promote, recommend, amplify, or similarly determine the delivery or display of information to an individual.\" Sec. 1. ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","Large data holders that use covered algorithms “in a manner that poses a consequential risk of harm to an individual or group of individuals” are required to perform impact assessment. Sec. 11(d). Impact assessments are required to include, among other things, descriptions of the algorithm’s “design process and methodologies,” the data used by the algorithm, and steps that the large data holder will take to mitigate potential harms from the algorithm’s use (including disparate impact on the basis of various protected classifications). Sec. 11(d)(1).\n\nCovered entities that develop algorithms intended to use “covered data in furtherance of a consequential decision” are required to conduct pre-deployment evaluations of the algorithms in order to reduce specified risks. Sec. 11(e).\n\nCovered entity may not collect or use personal data in manner that discriminates or has a disparate impact “on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity or disability.” Sec. 11(a). ","Large data holders; covered entities that develop algorithms","Large data holders must conduct privacy impact assessments of their “covered data collecting, processing, and transfer practices.” Sec. 12(e)."]
["Massachusetts","Massachusetts Information Privacy and Security Act","SD 1971/HD 3263","https://malegislature.gov/Bills/193/SD1971; https://malegislature.gov/Bills/193/HD3263","proposed","1/20/2023 (both)","Filed on Senate and House dockets on 1/20/2023","Comprehensive Privacy","N/A","State AG; private right of action (for data breaches)","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as \"any form of automated processing of personal information to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual or household’s economic situation, health, personal preferences, interests, reliability, behavior, location or movements.\" Sec. 2.\n\nThe bill provides that the controller may not rely on “legitimate interests pursued by the controller or by a third party” as lawful basis for processing when said processing is performed “for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the individual.” Sec. 6(b).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","Y","Controller must conduct risk assessment for processing activities including processing personal information for the purposes of targeted advertising, processing for the purposes of “profiling or otherwise systematically and extensively evaluating personal aspects relating to individuals” (provided that such profiling poses specified risks), and processing sensitive information. Sec. 21(b). Risk assessment must include, among other things, analysis of whether the assessed processing activities “present[] a reasonably foreseeable risk of disparate impact on the basis of individuals’ race, color, religion, national origin, sex or disability.” Sec. 21(c)(6). \n\nLarge data holders’ risk assessments must also specify whether the assessed processing activity “is based ... on an algorithmic computational process” that uses artificial intelligence techniques, “makes a decision or facilitates human decision-making with respect to personal information,” and “poses a reasonably foreseeable risk of substantial cognizable harm to individuals.” Sec. 21(d)(1). Risk assessment must then include description of the algorithmic computational process’s “design process and methodologies,” the categories of data that it would process or be trained on, and the outputs of the process. Sec. 21(d)(2). ",null,"Attorney general required to conduct research regarding automated decision-making technologies. Sec. 25(v)(2). "]
["Massachusetts","Internet Bill of Rights","HD 3245","https://malegislature.gov/Bills/193/HD3245","proposed","2023-01-20","Filed on House docket on 1/20/2023","Comprehensive Privacy","N/A","State AG; private right of action","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as \"any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.\" Sec. 1. \n\nThe data subject has “right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject,” subject to limited exceptions including: \"if the decision is necessary for entering into, or performance of, a contract between the data subject and a data controller or based on the data subject's explicit consent; provided, that the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express the data subject’s point of view and to contest the decision;\" and \"if the decision is authorized by state or federal law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; provided, that the decision shall not be based on special categories of personal data referred to in subsection (a) of section 6 unless clause (i) or (vi) of subsection (b) of said section 6 applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.\" Sec. 17(a)–(b).\n\nAdditionally, consumer has right to obtain from controller information regarding use of automated decision-making and profiling, including “meaningful information about the logic involved, as well as the significance and the predicted consequences of the processing for the data subject.” Sec. 10(a)(ix).  \n\nWhen controller justifies profiling on basis of either public interest or legitimate interests, data subject has right to object to that processing. Sec. 16(a). Data subject also has right to object to profiling for use in direct marketing context. Sec. 16(b).","Y","Where personal data relating to a data subject is collected from the data subject, the controller shall, at the time when personal data is obtained provide the data subject with information regarding “the existence of automated decision-making, including profiling … [and] meaningful information about the logic involved, as well as the significance and the predicted consequences of the processing for the data subject.” Sec. 8(a)(xi). \n\nWhere personal data has not been obtained from the data subject, the controller shall provide the data subject with information regarding \"the existence of automated decision-making, including profiling... [and] meaningful information about the logic involved, as well as the significance and the predicted consequences of the processing for the data subject.\" Sec. 9(a)(xii).\n\nIf personal data concerning the data subject is being processed, the data subject has the right to information concerning \" the existence of automated decision-making, including profiling, referred to in section 17 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the predicted consequences of the processing for the data subject.\" 10(a)(ix).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller required to conduct data protection impact assessment for processing that “is likely to result in a high risk to the rights and freedoms of natural persons,” including automated processing and profiling, large-scale processing of specified types of data, and “systematic monitoring of a publicly accessible area on a large scale.” Sec. 29(a), (c). ","Many of this bill's provisions are modeled on those in the EU GDPR. "]
["Massachusetts","An Act Preventing a Dystopian Work Environment","H 1873","https://malegislature.gov/Bills/193/H1873","proposed","2023-02-16","Referred to Senate Committee on Labor and Workforce Development on 2/16/2023","Employment","Non-discrimination","private right of action","N","Does not ban the US of ADS, but puts constraints on the ways in which an employer may use it: \"(a) An employer or vendor acting on behalf of an employer shall not use ADS outputs regarding a worker’s health as a basis for any employment-related decision. (b) An employer or vendor acting on behalf of an employer shall not solely rely on output from an ADS when determining employee wages. (c) An employer or vendor acting on behalf of an employer shall not solely rely on output from an ADS to make a hiring, promotion, termination, or disciplinary decision. (i) An employer shall conduct its own evaluation of the worker before making a hiring, promotion, termination, or disciplinary decision, independent of the output used from the ADS. This includes establishing meaningful human oversight by a designated internal reviewer to corroborate the ADS output by other means, including supervisory or managerial documentation, personnel files, or the consultation of coworker.  Meaningful human oversight requires that the designated internal reviewer meet the following conditions: (1)The designated internal reviewer is granted sufficient authority, discretion, resources, and time to corroborate the ADS output. (2) The designated internal reviewer has sufficient expertise in the operation of similar systems and a sufficient understanding of the ADS in question to interpret its outputs as well as results of relevant algorithmic impact assessments. (3) The designated internal review has education, training, or experience sufficient to allow the reviewer to make a well-informed decision. (iii) When an employer cannot corroborate the ADS output produced by the ADS, the employer shall not rely on the system to make the hiring, promotion, termination, or disciplinary decision. (iv) When an employer can corroborate the ADS output and makes the hiring, promotion, termination, or disciplinary decision based on that output, a notice.\" Section 4D(a)-(c)(i)-(iv). \n\n\n“Automated Decision System (ADS)” or “algorithm” means \"a computational process, including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that makes or assists an employment-related decision.\" Section 1(a). \n\nAn employer, or a vendor acting on behalf of an employer, that collects, stores, analyzes, interprets, disseminates, or otherwise uses worker data must provide, upon verifiable request, whether the data is being used as an input in an ADS, and if so, what ADS output is generated based on the data and Whether the data was generated as an output of an ADS. ","Y","An employer that controls the collection of worker data shall, at or before the point of collection, inform the workers including whether and how the data will be used to make or assist an employment-related decision, including any associated benchmarks. Section 2(a)(v)-(vi). \n\nAn employer or a vendor acting on behalf of any employer shall provide sufficient notice to workers prior to adopting an ADS. An employer with an existing ADS at the time this part takes effect shall provide notice pursuant to this section within 30 day after this part takes effect. Section 4(a).  Additionally, \"an employer or vendor acting on behalf of an employer shall provide additional notice to workers when any significant updates or changes are made to the ADS or in how the employer is using the ADS.\" Section 4A. Furthermore, an employer or vendor acting on behalf of an employer shall maintain an updated list of all ADS currently in use and \"shall annually, on or before January 1 of each year, provide notice to workers of all ADS currently in use.\" Section 4B(a)-(b). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"The law includes a requirement for Algorithmic Impact Assessments (AIA) (a study evaluating an ADS that makes or assists an employment-related decision). Specifically, it requires that \"[a]n employer that develops, procures, uses, or otherwise implements an ADS to make or assist an employment-related decision shall complete an Algorithmic Impact Assessment (AIA) prior to using the system, and retroactively for any ADS that is in place at the time this part takes effect, for each separate position for which the ADS will be used to make an employment-related decision. When an employer procures an ADS from a vendor, the employer may submit an AIA conducted by the vendor if it meets all of the requirements set forth in this chapter.\" Section 5(a). \n\nAn AIA must include, among other things, \"(i) A detailed description of the ADS and its intended purpose. (ii) A description of the data used by the ADS, including the specific categories of data that will be processed as input and any data used to train the model that the ADS relies on. (iii) A description of the outputs produced by the ADS, including the following:(1) The types of ADS outputs produced by the ADS. (2) How to interpret the ADS outputs. (3)The types of employment-related decisions that may be made on the basis of the ADS outputs. (iv) An assessment of the necessity and proportionality of the ADS in relation to its purpose, including reasons for the superiority of the ADS over non automated decision making methods.(v) An evaluation of the risk of the ADS, including the following risks: (1) Errors, including both false positives and false negatives (2)Discrimination against protected classes. (3) Violation of legal rights of affected workers. (4) Direct or indirect harm to the physical health, mental health, or safety of affected workers. (5) Chilling effect on workers exercising legal rights, including, but not limited to, rights guaranteed by employment and labor laws. (6) Privacy harms, including the risks of security breach or inadvertent disclosure. (7) Negative economic impacts or other negative material impacts on workers, including, but not limited to, impacts related to wages, benefits, other compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, assignment of work, access to work opportunities, job responsibilities, and productivity requirements. (8) Infringement on the dignity and autonomy of affected workers.(vi) The specific measures that will be taken to minimize or eliminate the identified risks. (vii) A description of the methodology used to evaluate the identified risks and mitigation measures. (viii) Any additional components necessary to evaluate the negative impacts of an ADS as determined by the department. Section 5. "]
["Massachusetts","An Act establishing a commission on automated decision-making by government in the Commonwealth","H 64","https://malegislature.gov/Bills/193/H64","proposed","2023-02-16","Referred to the committee on Advanced Information Technology, the Internet and Cybersecurity on 2/16/2023","Task Force","Government Use","Task Force","N","Does not ban ADS, but establishes a \"commission within the executive office of technology services and security for the purpose of studying and making recommendations relative to the use by the commonwealth of automated decision systems that may affect human welfare, including but not limited to the legal rights and privileges of individuals. The commission shall evaluate government use of automated decision systems in the commonwealth and make recommendations to the legislature regarding appropriate regulations, limits, standards and safeguards.\" Section 11(b). ","N","N/A","Y","The commission shall submit an annual report by December 31 to the governor, the clerks of the house of representatives and the senate, and the joint committee on advanced information technology and cybersecurity. Section 11(e). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["Massachusetts","An Act regulating the use of artificial intelligence (AI) in providing mental health services","H 1974","https://malegislature.gov/Bills/193/HD676","proposed","2023-02-16","Referred to the committee on Mental Health, Substance Use and Recovery","Health","Mental Health","Professional Licensing Board","N","Does not ban ADS, but provides that \"any licensed mental health professional who wishes to provide mental health services through the use of AI shall first seek approval from the relevant professional licensing board,\" and \"any AI system used to provide mental health services must be designed to prioritize the safety and well-being of individuals seeking treatment and must be continuously monitored by a licensed mental health professional to ensure its safety and effectiveness.\" Section 3(a)-(b). \n\n\"Artificial Intelligence\" or \"AI\" means \"any technology that can simulate human intelligence, including but not limited to, natural language processing, training language models, reinforcement learning from human feedback and machine learning systems.\" Section 2(a). ","Y","The proposed law provides that \"any licensed mental health professional providing mental health services through the use of AI shall inform patients of the use of AI in their treatment and provide them with the option to receive treatment from a licensed mental health professional\" and that \"any licensed mental health professional providing mental health services through the use of AI shall disclose the use of AI to patients in advance and obtain their informed consent.\" Section 3(c)-(d). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Minnesota","A bill for an act\nrelating to consumer data privacy; requiring a consumer's consent prior to collecting\npersonal information; proposing coding for new law in Minnesota Statutes, chapter 325M","SF 950","https://www.revisor.mn.gov/bills/bill.php?b=Senate&f=SF0950&ssn=0&y=2023&keyword_type=all&keyword=privacy","proposed","2023-01-30","Referred to Commerce and Consumer Protection Committee on 1/30/2023","Comprehensive Privacy","N/A","State AG; private right of action","N","The bill does not explicitly contemplate ADS. It requires that businesses obtain consumer's consent before collecting, using, or disclosing personal information. Sec. 1, subdivision 3(a). ","Y","Consumers' informed consent is required before deploying ADS that collect, use, or disclose personal information.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Missouri","Missouri Technology Task Force ","HB 317","https://house.mo.gov/billtracking/bills231/hlrbillspdf/0710H.01I.pdf","proposed","2023-01-04","Action Postponed as of 04/12/2023, and bill is currently not on a House Calendar","Task Force","General","Task Force","N","This proposes establishing the \"Missouri State Technology Task Force,\" which is tasked with, among other things: evaluating the uses of computing and artificial intelligence to improve the state's technological foundation and customer service; researching and reviewing adaptive technology initiatives for state use, and making recommendations regarding the use of technology and artificial intelligence to improve state management of records and to enable Missouri citizens and agencies to have more efficient electronic communications and access.\" 1.510(7). ","N","N/A","Y","The task force shall report a summary of its activities and any recommendations for legislation to the general assembly before August 28, 2024 and \"[a]fter providing a report to the general assembly as required... the task force shall continue to meet every two years periodically until this section expires. The task force shall provide additional updated summaries of its activities and additional recommendations for legislation to the general assembly, at such times as the task force deems necessary, until the task force is terminated.\" 1.510(8)-(9). ","N","N/A","N","N/A","N","N/A","N","N/A"]
["Nevada","AN ACT relating to technology; creating the Emerging Technologies Task Force within the Department of Business and Industry","NV S 165","https://www.leg.state.nv.us/App/NELIS/REL/82nd2023/Bill/9875/Overview","proposed","2023-02-16","Re-referred to Committee on Finance on 4/7/2023","Task Force","General","Task Force","N","The Task Force shall \"make recommendations for streamlining process, regulatory, structural and other barriers a business engaged in the development of emerging technologies may face in relocating to or expanding operations in this State.\" Emerging technologies means any  technologies that are of a unique type or that have a unique scope of application and would  provide a benefit to the economy of this State if developed, used or produced by businesses  in this State. The term includes, without limitation, blockchain technology, autonomous technology, the Internet of things, robotics and artificial intelligence. Sec. 8","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["New Hampshire","An Act relative to the expectation of privacy","SB 255-FN","https://www.gencourt.state.nh.us/bill_status/billinfo.aspx?id=865&inflect=1","proposed","2023-01-19","Referred to Judiciary Committee on 1/19/2023","Comprehensive Privacy","N/A","State AG","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection. ADS is addressed in the context of profiling, which is defined as \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.\" 507-H:1 (XXXIII). \n\nConsumer has right to opt out of processing of personal data for purposes of targeted advertising and “profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.” Sec. 507-H:4(I)(e).","N","\n\n","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Controller must conduct data protection assessment for “processing activities that present[] a heightened risk of harm to a consumer,” including for purposes of profiling \"here such profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers, financial, physical or reputational injury to consumers, a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person, or other substantial injury to consumers.\" Sec. 507-H:8(I)."]
["New Jersey","An Act concerning the use of automated tools to assist with hiring decisions and supplementing Title 34 of the Revised Statutes","A4909/S1926","https://www.njleg.state.nj.us/bill-search/2022/A4909; \nhttps://www.njleg.state.nj.us/bill-search/2022/S1926","proposed","12/5/2022 (A4909);  3/3/2022 (S1926)","Referred to Science, Innovation and Technology Committee on 1/19/2023 (A4909); referred to Labor Committee on 3/3/2022 (S1926) ","Employment","Automated employment decision tools","Department of Labor and Workforce Development","N","Explicitly prohibits sale of automated employment decision tools unless tool was subject to a bias audit within the past year and sale of the tool includes an \"annual bias audit service that provides the results of the audit to the purchaser\" at no additional cost and the tool is sold or offered for sale with a notice stating that the tool is subject to the provisions of the bill. Sec. 1(b).\n\n“Automated employment decision tool\" is defined as \"any system the function of which is governed by statistical theory, or systems the parameters of which are defined by systems, including inferential methodologies, linear regression, neural networks, decision trees, random forests, and other learning algorithms, which automatically filters candidates or prospective candidates for hire or for any term, condition or privilege of employment in a way that establishes a preferred candidate or candidates.\" Sec. 1. ","Y","Person who uses automated employment decision tool to screen candidate for employment decision must notify candidate within 30 days that automated employment decision tool  was used to evaluate the candidate's application and that the tool \"assessed the job qualifications or characteristics of the candidate.\" Sec. 1(c).","N","N/A","N","N/A","N","N/A","N","N/A","Y","Any automated employment decision tool sold in New Jersey is required to undergo bias audit on annual basis. Sec. 1(b). \n\nBias audit is defined as \"impartial evaluation, including but not limited to testing, of an automated employment decision tool to assess its predicted compliance with the provisions of the “Law Against Discrimination,” P.L. 1945, c. 169 (C. 10:5-1 et seq.), any other applicable law relating to discrimination in employment.\" Sec. 1. ","Not specified, but audit must be \"impartial.\" Sec. 1(a)."]
["New York","New York Privacy Act","S. 365 / A3593","https://www.nysenate.gov/legislation/bills/2023/S365 ","proposed","2023-01-04","Referred to Consumer Protection Committee on 1/4/2023","Comprehensive Privacy","N/A","State AG; private right of action","N","Automated decisionmaking is defined as \"a computational process, including one derived from machine learning, artificial intelligence, or any other automated process, involving personal data that results in a decision affecting a consumer.\" Sec. 1102(8). \n\nADS is also addressed in the context of profiling, which is defined as \"any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Profiling does not include evaluation, analysis, or prediction based solely upon a natural person's current search query or current visit to a website or online application, if no personal data is retained after the completion of the activity for the purposes identified in this subdivision.\" Section 1100(20). \n\nAdditionally, the bill defines targeted advertising as \"advertising based on profiling.\" 1100(28). \n\nConsumer has right to opt out of processing of personal data for purposes of targeted advertising and “profiling in furtherance of decisions that produce legal or similarly significant effects.” Sec. 1102(2)(a).","Y","When controller makes an automated decision that \"materially contributes to a denial of financial or lending services, housing, public accommodation, insurance, health care services, or access to basic necessities ... or produces legal or similarly significant effects,\" controller must disclose to the consumer that the decision was made through an automated process and both provide and explain the consumer’s appeal process. Sec. 1102(8)(a). The appeal process must allow for the consumer to \"obtain meaningful human review of the decision.\" Sec. 1102(8)(a)(ii).","N","N/A","N","N/A","N","N/A","N","N/A","Y","Controller or processor that uses automated decision-making in context of “financial or lending services, housing, public accommodation, insurance, education enrollment, employment, health care services, or access to basic necessities … or producing legal or other similarly significant effects” must conduct annual impact assessment of its automated decisionmaking processes. Sec. 1102(8)(c). This assessment must, among other things, described and evaluate “how the automated decision-making process was tested for accuracy, fairness, bias and discrimination,” assess whether the system produces discriminatory results, and propose mitigations for any discriminatory results. Sec. 1102(8)(c)(i). ","External, independent auditor or researcher","Controllers must perform regular data protection assessments “for processing activities that present a heightened risk of harm to the consumer,” such as processing for purposes of targeted advertising, processing sensitive data, and processing for purposes of profiling (where such profiling poses specified risks). Sec. 1103(1)(a).\n\nAdditionally, controllers or processors engaged in automated decision-making affecting certain industries (including financial or lending services, housing, public accommodation, insurance, education enrollment, employment, health care services etc.) must annually conduct an impact assessment of such automated decision-making that: \"(A) Describes automated decision-making processes including the design and training data used to develop the automated decision-making process, how the automated decision-making process was tested for accuracy, fairness, bias and discrimination; and (B) assess whether the automated decision-making system produces discriminatory results on the basis of a consumer's or class of consumer's actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial, status, biometric information, lawful source of income or disability and outlines mitigations for any identified performance differences across relevant groups impacted by the system such evaluations should be conducted on a system prior to deployment, including in the environment in which a system is going to be used and throughout the lifecycle of a system.\" Sec. 1102(8)(c)(1)(A)-(B). "]
["New York","Digital Fairness Act ","S. 2277","https://www.nysenate.gov/legislation/bills/2023/S2277","proposed","2023-01-19","Referred to Internet and Technology Committee on 1/19/2023","Comprehensive Privacy","N/A","State AG, district attorney, and city attorney (general data rights provisions); private right of action (general data rights provisions); private right of action (in context of challenging ADS decisions)","N","Controller must obtain consent from consumer to conduct any processing of personal information, subject to certain exceptions. Sec. 899-ee.\n\nThe state and any governmental agency, political subdivision, or public benefit corporation are prohibited from purchasing, obtaining, acquiring, employing, using, deploying, or accessing information from an ADS unless the state \"first engages a neutral third party to conduct an automated decision system impact assessment and publishes on its website that automated decision system impact assessment: (I) ... within one year of the effective date of this subdivision and every two years thereafter. (II) of new automated decision systems prior to acquisition and every two years thereafter.\" Sec. 7, subdivision 9 (B)(I)-(II). \n\nAdditionally, upon publication of the automated decision system impact assessment, the public shall have 45 days to submit comments and these comments shall be considered in determining whether to \"purchase, obtain, procure, acquire, employ, use, deploy, or access information from an automated decision system.\" Responses the public comments must also be posted publicly to entity's website within 45 days after the comment period closes. Sec. 7, subdivision 9 (C). \n\nAutomated decision system is defined as \"any software, system, or process that is designed to aid or replace human decision making. Such term may include analyzing complex datasets to generate scores, predictions, classifications, or some recommended action or actions, which are used by agencies to make decisions that impact human welfare.\" § Sec. 7, subdivision 9(A)(I).","Y","State government entities that use ADS must publish automated decision system use policies before purchase or use of such systems. Sec. 7, subdivision 10(b).\n\nState government entities that use ADS must implement “process to provide a plain-language notification to any individual whose personal information is processed by the automated decision system and whom the automated decision system's decision affects of the fact that such system is in use, the system's name, vendor, and version, what decision or decisions [it] will be used to make or support; and what policies and guidelines apply to its deployment.” Sec. 7, subdivision 10(e).","Y","Office of Information Technology Services required to publish, within two years of the Act’s effective date, study of statistical impacts of ADS on protected classes. Sec. 7, subdivision 9(f).  \n\nState government entities that use ADS must publish annual metrics regarding “the number of requests for human review of a decision rendered by the automated decision system it received and the outcome of such human review.” Sec. 7, subdivision 10(h).","N","N/A","Y","State government entities that use ADS must implement “process to provide a plain-language notification to any individual whose personal information is processed by such automated decision system and whom such automated decision system's decision affects, of the involvement of an automated decision system in making the decision, the degree of human intervention in the system, how the automated decision system made the decision, the justification for the decision, the variables considered in rendering the decision, whether and how the decision deviated from the automated decision's system's recommendation, how the individual may contest the decision ... and the process for requesting human review of the decision.” Sec. 7, subdivision 10(f). ","Y","ADS acquired by the state must rely on open-source software. Sec. 8, subdivision 21. \n\nState contracts with ADS vendors may not include nondisclosure or similar provisions. Sec. 9, subdivision 23.","Y","State government entities are required to conduct ADS impact assessment before procuring or using an ADS. Sec. 7, subdivision 9(b). ADS impact assessments must include, among other things, analysis of “the risk that such automated decision system may result in or contribute to inaccurate, unfair, biased, or discriminatory decisions impacting individuals.” Sec. 7, subdivision 9(a)(ii). \n\nCommittee on Open Government required to conduct annual audits of ADS use policies, focusing on whether a given entity complies with its policy and recommending revisions to the policy, as appropriate. Sec. 7, subdivision 10(d). ","Neutral third party (impact assessments); Committee on Open Government (use policy audits)","State government entities that use ADS must develop process for human review of ADS decisions. Sec. 7, subdivision 10(g). "]
["New York","An Act to amend the labor law, in relation to establishing criteria for the use of automated employment decision tools","A. 567","https://www.nysenate.gov/legislation/bills/2023/A567","proposed","2023-01-09","Referred to Labor Committee on 1/9/2023","Employment","Automated employment decision tools","State AG, \"the commissioner\" (undefined), and \"the department\" (undefined)","N","Employer using automated employment decision tool must comply with the following requirements: (1) conduct annual disparate impact analysis of the tool; (2) make a summary of the tool's most-recent disparate impact analysis publicly available on the employer's website prior to implementation or use; and (3) annually provide to \"the department\" a summary of the tool's most-recent disparate impact analysis. Sec. 203-f(2).\n\nAutomated employment decision tool is defined as \"any system used to filter employment candidates in a way that establishes a preferred candidate or candidates without relying on candidate-specific assessments by individual decision makers. Automated employment decision tools shall include personality tests, cognitive ability tests, resume scoring systems and any system whose function is governed by statistical theory, or whose parameters are defined by such systems, including inferential methodologies, linear regression, neural networks, decision trees, random forests and other artificial intelligence or machine learning algorithms. The term \"automated employment decision tool\" does not include a tool that does not automate, support, substantially assist or replace discretionary decision-making processes and that does not materially impact natural persons. Sec. 203(f)(A). ","Y","Employer using automated employment decision tool must post summary of most-recent disparate impact analysis of tool on its website prior to implementation or use of tool. Sec. 203-f(2)(b).","Y","Employer using automated employment decision tool must annually provide to \"the department\" a summary of the most-recent disparate impact analysis pertaining to the tool. Sec. 203-f(2)(c). ","N","N/A","N","N/A","N","N/A","Y","Employer must ensure that an annual disparate impact analysis of any automated employment decision tool in use is conducted. Sec. 203-f(2)(a). ","Not specified, but analysis must be \"impartial.\" Sec. 203-f(1)(b)."]
["New York","An Act creating a temporary state commission to study and investigate how to regulate artificial intelligence, robotics and automation","A4969 (S. 6402)","NY State Assembly Bill A4969 (nysenate.gov)","proposed","2023-02-27","Passed Assembly","Task Force","General","Task Force","N","New York State artificial intelligence, robotics and automation commission (hereafter \"commission\"), is hereby created to study and make determinations on issues including but not limited to:\n   (a) current law within this state addressing artificial intelligence, robotics and automation;\n   (b) comparative state policies that have aided in creating a regulatory structure for artificial intelligence, robotics and automation, and whether such measures would be similarly effective in this state;\n   (c) criminal and civil liability regarding violations of law caused by entities equipped with artificial intelligence, robotics and automation;\n   (d) the impact of artificial intelligence, robotics and automation on employment in this state;\n   (e) the impact of artificial intelligence, robotics and automation on the acquiring and disclosure of confidential information;\n   (f) potential  restrictions  on  the  use of artificial intelligence, robotics and automation in weaponry;\n   (g) the potential impact on the technology industry of any regulatory measures proposed by this study; and\n   (h) public sector applications of artificial intelligence and cognitive technologies.","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Oklahoma","Oklahoma Computer Data Privacy Act ","HB 1030","http://www.oklegislature.gov/BillInfo.aspx?Bill=hb1030&Session=2300","proposed","2023-01-04","Introduced on 1/4/2023","Comprehensive Privacy","N/A","State AG","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection (it does not contemplate ADS' impact on privacy specifically).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Rhode Island","An Act Relating to State Affairs and Government - Commission to Monitor the Use of Artificial Intelligence in State Government ","S 0117","S0117.pdf (rilegislature.gov)","proposed","2023-05-25","Pending: Senate Judiciary Committee","Task Force","General","Task Force","N","The committee is established to monitor the use of artificial intelligence in state government, for the purpose of continuously studying, monitoring, and making recommendations relative to the use by the state of automated decision systems that may affect human welfare, including, but not limited to, the legal rights and privileges of individuals. (Sec. 42-165-2) The commission shall submit an annual report by December 31 of each year to the governor and to the clerks of the house of representatives and the senate.","N","N/A","N","N/A","N",null,"N",null,"N",null,"N","N/A"]
["Vermont","An act relating to restricting electronic monitoring of employees and employment-related automated decision systems","H. 114","https://legislature.vermont.gov/Documents/2024/Docs/BILLS/H-0114/H-0114%20As%20Introduced.pdf","proposed","2023-01-26",null,"Employment","General","State AG","N","An employer shall not use an automated decision system in a manner that violates law, makes predictions, identifies, profiles or predicts likelihood an employee will take legal action, makes predictions about employees' emptions, uses customer data as input of the automated decision system.","N",null,"N","N/A","Y","An employer may not uses customer or client data, including customer or client reviews and feedback, as an input of the automated decision system.","N","N/A","N","N/A","N","N/A"]
["Vermont","An Act relating to enhancing consumer privacy","H.121","https://legislature.vermont.gov/bill/status/2024/H.121","proposed","2023-01-26","Referred to Committee on Commerce and Economic Development on 1/26/2023","Comprehensive Privacy","N/A","State AG; State's Attorney; Department of Financial Regulation; private right of action (biometric information only)","N","The proposed legislation is a comprehensive privacy bill aimed at general consumer protection and does not addresses ADS specifically. Consumers have right to opt out of processing of personal information \"for purposes of targeted advertising, predictive analytics, [and] tracking.\" Sec. 2432(e).","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A"]
["Washington","Establishing guidelines for government procurement and use of automated decision systems in order to protect consumers, improve transparency, and create more market predictability.","SB 5356","https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Bills/Senate%20Bills/5356.pdf#page=1","proposed","2023-01-13","Public hearing in the Senate Committee on Environment, Energy & Technology on 2/15/2023 ","Government","Procurement","Private right of action","N","The proposed legislation does not ban ADS, but requires adoption and  guidance for agencies regarding the development, procurement, and use of automated decision systems by a public agency and the development of guidance for agencies to use when prioritizing analysis of automated decision systems. Section 3(1)-(2). Such guidance with respect to prioritizing analysis of automated decision systems must include \"a prioritization framework or frameworks for identifying the order in which to examine existing and proposed automated decision systems\" Section 3(2). ","Y","\"Subject to the staged implementation as outlined in this chapter, a public agency must, at a minimum: (a) Give clear notice in plain language to the people impacted by the automated decision system of the following: (i) The fact that the system is in use; (ii) The system's name, vendor, and version; (iii) What decision or decisions it will be used to make or support; (iv) Whether it is an automated final decision system or automated support decision system and whether and through what  process a human verifies or confirms decisions made by the automated decision system; (v) What policies and guidelines apply to its deployment; and (vi) How people may contest any decision made involving the automated decision system as required pursuant to this section.\" Section 4(8)(a). ","Y","\"A public agency that develops, procures, or uses an automated 24 decision system must follow any conditions set forth in the relevant algorithmic accountability report.\" Section 4(7). \n\n\"Agencies already using an automated decision system as of the effective date of this section must provide a list of automated decision systems in use to the algorithmic accountability review board by January 1, 2024, and use the prioritization framework established under section 3 of this act or adopt and implement an interim prioritization framework to identify the order in which to complete an algorithmic accountability report on each existing automated decision system by January 1, 2026.\" Section 5(1). \n\n\"A public agency intending to newly develop or procure an automated decision system for use between the effective date of this section and January 1, 2026, must as a condition of use of such system, at least one month prior to procurement of, or if internally developed, implementation of such a system produce and file with the office an algorithmic accountability report for that system as described in subsection (4) of this section.\" Section5(2). Furthermore, \"[a]n agency intending to develop or procure an automated decision system for implementation after January 1, 2026, must, as a condition of use of such automated decision system, submit an algorithmic accountability report as described in subsection (4) of  this section and obtain a finding by the algorithmic accountability review board pursuant to (d) of this subsection.\" Section 5(3). ","N","N/A","Y","A public agency, must, at a minimum, be able to \"explain the basis for its decision to any impacted people in terms understandable to a layperson including, without limitation, by requiring the vendor to create such an explanation.\" Section4(8)(d). ","N","N/A","Y","The proposed legislation provides that \"[o]ngoing monitoring or auditing should be performed on automated decision systems that have legal effects on identified or identifiable natural persons to ensure they do not have differential effects on subpopulations that result over time; or discriminate against an individual, or treat an individual less favorably than another, in whole or in part, on the basis of one or more factors enumerated in RCW 49.60.010.\" Section 4(5). ","Does not specify","The proposed legislation creates an algorithmic accountability review board. Section 6(1). \n\nAdditionally, \"[b]eginning December 1, 2023, and updated not less than quarterly, the office shall make publicly available on its website an inventory of all algorithmic accountability reports on automated decision systems that have been proposed for or are being used, developed, or procured by public agencies.\" Section 7(1). \n\nWith respect to audits conducted, \"[b]eginning January 1, 2026, the algorithmic accountability review board shall conduct an annual review of agency audits and compile the information into a report that includes the following: (i) Whether each agency that uses, develops, or procures an  automated decision system has complied with the terms of its approved algorithmic accountability report; (ii) Descriptions of any known or reasonably suspected violations of any algorithmic accountability report policies; (iii) Any systematic issues, such as bias and disproportionate impacts on marginalized or vulnerable communities, raised by use of automated decision systems; and (iv) Recommendations, if any, relating to revisions to this chapter or to specific algorithmic accountability reports.\" Section 7(4). "]
["Washington","People's Privacy Act","HB 1616/SB 5643","https://app.leg.wa.gov/billsummary?BillNumber=1616&Initiative=false&Year=2023;\nhttps://app.leg.wa.gov/billsummary?BillNumber=5643&Chamber=Senate&Year=2023","proposed","1/26/2023 (HB 1616); 1/31/2023 (SB 5643)","Referred to Civil Rights & Judiciary Committee on 1/26/2023 (HB 1616); referred to Environment, Energy & Technology Committee on 1/31/2023 (SB 5643)","Comprehensive Privacy","N/A","State AG; private right of action","Y","Covered entities and state government entities prohibited from using “equipment incorporating artificial intelligence-enabled profiling in any place of public resort, accommodation, assemblage, or amusement … or to use artificial intelligence-enabled profiling to make decisions that produce legal effects or similarly significant effects concerning individuals.” Sec. 8(1)(e).\n\nArtificial intelligence-enabled profiling is defined as \"the automated or semiautomated process by which the external or internal characteristics of an individual are analyzed to determine, infer, or characterize an individual's state of mind, character, propensities, protected class status, political affiliation, religious beliefs or religious affiliation, immigration status, or employability.\" Sec. 8(1)(e).\n\nCovered entities must obtain individual’s consent before processing personal information. Sec. 5(2)(a). ","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A","N","N/A",null,"Covered entities must conduct data protection assessment for processing activities including processing for purposes of targeted advertising and processing for purposes of profiling where there is a reasonably foreseeable risk of \"(i) Unfair or deceptive treatment of, or disparate impact on, individuals; (ii) Financial, physical, or reputational injury to individuals; (iii) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of individuals, where such intrusion would be offensive to a reasonable person; or (iv) Other substantial injury to individuals.\" Sec 10(1)(c)(i)-(iv). "]