California Privacy Protection Agency Board Advances Proposed Regulations on Automated Decision-Making Technology and Risk Assessments

The California Privacy Protection Agency (“CPPA”) is making strides in advancing regulations to address automated decision-making technology (“ADMT”) and risk assessments for the processing of personal information. At its recent meeting on March 8, 2024, the Board of the CPPA voted 3-2 to move forward with proposed regulations, signaling a significant step towards enhancing consumer privacy rights in the digital age.

While the vote does not officially initiate the formal rulemaking process, it paves the way for staff to begin preliminary paperwork. The Board will need to review and vote on the draft rules for ADMT, privacy risk assessments, and cyber audits once again to kickstart the formal rulemaking process, expected to happen in July 2024 at the earliest.

The draft rules aim to increase transparency and accountability in the use of ADMT by requiring businesses to notify consumers before utilizing such technology. Additionally, consumers would have opt-out and access rights when ADMT is employed, and businesses would need to conduct risk assessments when processing personal information, especially when training ADMT or AI.

Board members have differing opinions on the scope of the regulations, particularly regarding the requirements for ADMT. General Counsel Philip Laird mentioned that the Board has already received a substantial amount of feedback, with plans to gather more input through a “roadshow” across California before the next meeting.

The CPPA’s efforts align with a broader trend of state legislatures addressing the regulation of AI and automated technologies. For more information on the CPPA’s draft ADMT regulations and other state legislative developments in AI, you can visit the links provided. Stay tuned for further updates on California’s privacy protection initiatives as the CPPA continues to work towards finalizing these crucial regulations.