12.3 AEDTs, Background Checks, Testing, and Social Media

12.3 AEDTs, Background Checks, Testing, and Social Media

CIPP/US BoK 2.6.1 competency IV.B PI1 is pre-employment screening. Domain IV still contributes only 4–6 questions, but this performance indicator is the one most likely to appear as a multi-step scenario: an algorithm scores résumés, a CRA report arrives, a polygraph or drug screen is mentioned, and someone looks at Instagram. Unbundle the tools. Each one has its own owner and its own notice rule.

Automated employment decision tools and NYC Local Law 144

An automated employment decision tool (AEDT) is a computational process — machine learning, statistical modeling, data analytics, or artificial intelligence — that issues a simplified output (a score, ranking, classification, or recommendation) used to substantially assist or replace discretionary hiring, promotion, or other employment decisions. Bias in that output is a Title VII / ADA / ADEA problem everywhere in the United States. The BoK also names a specific local statute you must be able to identify: New York City Local Law 144 of 2021.

The New York City Department of Consumer and Worker Protection (DCWP) enforces Local Law 144. Enforcement of the law and its rules began on 5 July 2023. An employer or employment agency may not use an AEDT on a New York City candidate or employee unless all of the following are true:

1. The tool has been subject to a bias audit within one year of the use.
2. The audit is performed by an independent auditor (not the vendor or the employer using the tool).
3. A summary of the results is publicly available, typically on the employer's website.
4. Required notices go to candidates or employees. DCWP's educational materials, revised June 2023, state that notice must be provided 10 business days before the AEDT is used. The notice covers the fact of use, how the tool will be used, the job qualifications and characteristics it will assess, and the types of data collected. Candidates must also be told they may request an alternative selection process or accommodation where one is reasonably available.

DCWP can assess civil penalties of $500 for a first violation and $1,500 for subsequent violations; each day of continuing violation is a separate violation. A December 2025 New York State Comptroller audit criticized DCWP's early enforcement and is a 2026 signal of tighter follow-up — but it did not repeal the audit, posting, or notice duties. Local Law 144 does not require the employer to stop using a tool that the audit shows is biased; Title VII and the EEOC still might. Do not promote Local Law 144 into a federal statute, and do not treat a later human "override" as a substitute for the audit and notice.

Scenario. A national retailer uses a résumé scorer on every U.S. applicant. For the New York City cohort, the vendor's 2022 audit is stale, no summary is posted, and the first time applicants hear about the tool is a rejection email. Local Law 144 is already broken (no audit within one year, no public summary, no 10-business-day notice). Separately, if the scorer systematically downgrades older or minority applicants nationwide, the EEOC still has a Title VII or ADEA file. Two regimes, one algorithm.

FCRA background checks

When the employer uses a CRA to assemble criminal, credit, driving, or other consumer information for employment purposes, the FCRA employment-use path applies. The FTC's employer guidance is the checklist Domain IV expects. In-house calls to a former supervisor, or a public-record search the employer runs itself without a CRA, are not consumer reports.

Authorization may appear on the same piece of paper as the stand-alone disclosure; the disclosure itself still cannot be mixed into the application. State investigative-consumer-report and credit-check-for-employment laws can add extra notices. Title VII still limits how criminal or credit information may be used even after a perfect FCRA sequence.

Personality, psychological, and polygraph testing

Personality and psychological evaluations sit on the ADA line taught in section 12.1. If the instrument is designed to identify a mental disorder or impairment, the EEOC treats it as a medical examination. Medical examinations are forbidden pre-offer. A trait inventory that measures honesty, preferences, or work style, and that is not used to diagnose, may be a non-medical screen — but if it has an unjustified disparate impact, Title VII still applies. When in doubt on the exam, ask whether the tool is likely to elicit disability information. If yes, it waits until after a conditional offer and goes in the separate medical file.

Lie-detector tests are a federal ban with named holes, not a "state variation" topic. Under the EPPA, as WHD Fact Sheet #36 states, a private employer generally may not require, request, or suggest a lie-detector test for applicants or employees, may not use the results, and may not retaliate. Polygraph tests — not voice-stress or other lie detectors — may be used only in limited cases and only with WHD's procedural rights (written notice, right to refuse or stop, limits on questions, limits on disclosure):

• Prospective employees of armored-car, security-alarm, and security-guard firms who will protect facilities, materials, or operations affecting health or safety, national security, or currency and similar instruments.
• Prospective employees of pharmaceutical manufacturers, distributors, or dispensers who will have direct access to controlled substances, and certain current pharmaceutical employees in an ongoing investigation.
• Current employees reasonably suspected of involvement in a specific workplace incident that caused economic loss, who had access to the property, after a statement of the incident and the basis for suspicion.

Governments are excluded from EPPA. A cashier job at an ordinary retailer is not a security or pharma exception. A blanket "everyone takes a polygraph" program is the classic wrong answer.

Drug and alcohol testing

There is no single federal privacy statute that sets private-sector drug testing for every employer. The federal floor that does exist is transportation-specific: the Omnibus Transportation Employee Testing Act and 49 C.F.R. Part 40, administered by the Department of Transportation's Office of Drug and Alcohol Policy and Compliance. Part 40 tells safety-sensitive transportation employers — aviation, trucking (including CDL), railroads, transit, pipelines, and related modes — how to test. Modal rules (for example, FMCSA or FAA) say who is tested and when (pre-employment, random, post-accident, reasonable suspicion, return-to-duty). Part 40 procedures are not optional local policy.

Outside DOT, testing is a state-variation topic. Some states restrict random testing of non-safety-sensitive workers, require a confirmed lab result, or limit cannabis testing after legalization. A drug test that is also a medical examination (for example, a screen that reveals lawful prescription use) must respect the ADA's three stages and confidentiality rules. OSHA's 1910.1020 access right does not treat ordinary drug- and alcohol-test results used to assess substance use as exposure records.

Social media, passwords, and unionized workforces

Public posts are usually low-AEP. Searching an applicant's public LinkedIn or Instagram is common and is not, by itself, an FCRA pull — unless the employer hires a CRA to assemble a social-media consumer report, in which case the FCRA steps return. Two overlays still catch people:

• Password-request bans. Many states — including California (Labor Code § 980), Illinois, and New York — prohibit employers from demanding social-media usernames or passwords, requiring the applicant to friend the recruiter, or requiring the applicant to display a personal account in the interview. There is no general federal password statute. Teach this as a state overlay, and do not invent a nationwide count.
• NLRA Section 7. Comments about wages or working conditions on social media can be protected concerted activity. Disciplining that speech, or maintaining a rule that a reasonable employee would read as a ban on it, is an NLRB issue — especially in a unionized or organizing workplace. That analysis survived the February 2025 rescission of GC 23-02 because it rests on the statute, not on the rescinded memo.

Ban-the-box is a fair-chance overlay, not a federal privacy statute

Ban-the-box (fair-chance) laws delay when an employer may ask about criminal history, often until after an interview or a conditional offer. They exist in many states and cities. The federal Fair Chance Act (2019) applies to federal agencies and certain federal contractors; it is not a general private-sector privacy statute. On CIPP/US, name ban-the-box as a state or local hiring-privacy / fair-chance overlay. It does not replace the FCRA, Title VII's criminal-records guidance, or Local Law 144.

Scenario. A private hospital in a ban-the-box city uses an AEDT on City residents, pulls a CRA criminal report, asks every RN applicant for Instagram passwords, and requires a polygraph "because we handle drugs." Work the stack: Local Law 144 for the AEDT (if the city is New York); FCRA disclosure / authorization / pre-adverse / adverse for the CRA report; a state password statute for the Instagram demand; EPPA for the polygraph — a hospital RN job is not automatically the pharmaceutical-manufacturer exception, which is about firms authorized to manufacture, distribute, or dispense controlled substances and about direct access roles that WHD recognizes. Ban-the-box may also have required the hospital to wait before asking about convictions. One hire, five regimes.