{"id":7137,"date":"2024-03-12T09:43:00","date_gmt":"2024-03-12T09:43:00","guid":{"rendered":"https:\/\/www.brightmine.com\/us\/?post_type=resources&p=7137"},"modified":"2026-09-16T08:30:17","modified_gmt":"2026-09-16T13:30:17","slug":"employee-data-privacy-important-considerations-for-hr","status":"publish","type":"resources","link":"https:\/\/www.brightmine.com\/us\/resources\/hr-compliance\/employee-privacy\/employee-data-privacy-important-considerations-for-hr\/","title":{"rendered":"Employee data privacy: Important considerations for HR"},"content":{"rendered":"\n
\n
\n
\n

by Helena Oroz<\/strong>, Senior Legal Editor at Brightmine<\/p>\n\n\n\n

There’s no such thing as a free lunch, right?<\/p>\n\n\n\n

Organizations<\/a> with the means to train their own artificial intelligence (AI) models with employee data might disagree. AI models are insatiable data consumers, and employee data is plentiful, renewable \u2014 and free.<\/p>\n\n\n\n

Some employers have been quick to warn their employees against feeding publicly available generative AI<\/a> applications with confidential company information. But employers using employee data to train AI models might be ignoring the privacy implications of their own activities.<\/p>\n\n\n\n

Big appetites<\/h2>\n\n\n\n

In basic terms, an artificial intelligence (AI) model is a program, trained on a set of data, that can autonomously make decisions or predictions. Without getting technical, a quality data set is really<\/em> important to AI training, and training an AI model requires a lot of data.<\/p>\n\n\n\n

There are many takes, hot and otherwise, on whether data is “the new oil” (just do a quick Google search on that phrase). As the Federal Trade Commission’s Technology Blog<\/a> recently put it, the comparison comes from looking at data as a raw material mined in massive quantities but useful only when refined; and “there is perhaps no data refinery as large-capacity and as data-hungry as AI.”<\/p>\n\n\n\n

Few rules<\/h2>\n\n\n\n

Employee data privacy protection in the United States is limited. A national comprehensive data protection law does not exist, and most experts say such a law is not realistically on the horizon.<\/p>\n\n\n\n

Some federal laws<\/a> provide limited protection for certain employee information, including:<\/p>\n\n\n\n

\n

Americans with Disabilities Act<\/h3>\n\n\n\n

The Americans with Disabilities Act (ADA), which requires a covered employer to restrict access to employee medical information and maintain it in a confidential manner.<\/p>\n\n\n\n

Health Insurance Portability and Accountability Act<\/h3>\n\n\n\n

The Health Insurance Portability and Accountability Act (HIPAA), which restricts how a “covered entity” may use and disclose protected health information. An employer must be acting as a covered entity (i.e., a health plan or covered health care provider) for HIPAA to apply, though. When an employer reviews medical information in its capacity as an employer, the medical information is considered an employment record under HIPAA and excluded from coverage.<\/p>\n\n\n\n

Genetic Information and Nondiscrimination Act<\/h3>\n\n\n\n

The Genetic Information and Nondiscrimination Act (GINA), which restricts an employer from acquiring or sharing employee genetic information and family medical history.<\/p>\n<\/div>\n\n\n\n

A web of protections has resulted from individual states trying to fill the federal privacy void in various ways, including but definitely not limited to:<\/p>\n\n\n\n

\n

Biometrics laws<\/h3>\n\n\n\n

A handful of states (California, Illinois, Maryland, New York, and Oregon among them) have passed laws that address employer use of finger scans, retinal scans, or other biological\/physical characteristics to identify employees.<\/p>\n\n\n\n

Electronic surveillance<\/h3>\n\n\n\n

Several states have laws on the books regarding workplace monitoring. These laws generally require an employer to provide employees with notice regarding monitoring activities on employer-provided equipment and networks.<\/p>\n\n\n\n

Consumer data protection<\/h3>\n\n\n\n

As of this writing, fourteen states have comprehensive data protection laws<\/a> on the books (not all of which are effective yet) that give covered consumers certain rights with respect to their personal information. These laws give consumers in those states a certain amount of notice and control with respect to their personal data – but only the California Consumer Privacy Act covers employment-related information.<\/p>\n<\/div>\n\n\n\n

Even the strongest state laws of any variety do not, at this time, outright prohibit an employer from training an AI model (its own or a “model-as-a-service”) with employee data – so long as it is otherwise operating within the bounds of applicable laws in its jurisdiction(s). But therein lies the rub: there are some rules. As just about every federal agency that has anything to do with workplace-related AI issues has stated quite plainly: there is no AI exemption from existing law.<\/p>\n\n\n\n

And the laws and regs will keep coming<\/a>. Many AI-related bills are currently under consideration in state legislatures across the country, several of which propose restrictions on employer collection and disclosure of employee personal information. Employers rushing to get in on the AI feeding frenzy before considering their current privacy obligations, and without keeping an eye on their potential future ones, are betting on unknown odds in an unfamiliar game.<\/p>\n\n\n\n

\n

Want to make smarter, more-informed decisions?<\/h2>\n\n\n\n
\n
Learn more<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n

Employee data, employee concerns<\/h2>\n\n\n\n

Many businesses, even those not known as behemoths, have tons of data at the ready. Employers with any sizable workforce have at least two buckets of information at their disposal: information that can be gleaned from the daily work that their employees perform, and personal data about those very same employees.<\/p>\n\n\n\n

Why employee data? It’s plentiful, it’s free, and employers already own it. And considering the dearth of regulation in this particular area, it’s not surprising that employers like employee data as an AI training source.<\/p>\n\n\n\n

But there are other reasons that employers are feeding AI with employee data:<\/p>\n\n\n\n