Employers and employment agencies must disclose the data collected and their retention policy for the tool
Context fileUnder NYC Local Law 144 (automated employment decision tools), NYC Administrative Code Section 20-871(b)(3); 6 RCNY Section 5-303
What does it require?
Unless already disclosed on the website, an employer or employment agency must provide, within 30 days of a written request from a candidate or employee, information about the type of data the automated employment decision tool collects, the source of that data, and the employer's or agency's data retention policy. The DCWP rules allow this information to be posted publicly instead of answered case by case.
Practical action
Publish a short data notice for the tool covering data types, sources and retention, or set up a 30-day response process for written requests.
Who does it apply to?
Employers and employment agencies using an automated employment decision tool for New York City residents.
- Sectors
- Employment and HR
- Use cases
- AI in hiring and employment
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessData protection officer · once per ai systemPrivacy and data-protection controls for AI
Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use
Data notice with types, sources and retention.
-
supportsProcessData governance lead · once per ai systemData governance and dataset documentation
Serves 8 recorded duties · evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use
Source of the data inventory disclosed.
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Data collection and retention notice for the tool | document | |
| Request response log | register |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every New York (United States) duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| NIST AI RMF 1.0 | MAP 2.2, MEASURE 2.10 | Data documentation and privacy transparency. | medium |
| ISO/IEC 42001:2023 | Annex A.7.2, A.8.5 | Data management and information for interested parties. | medium |
Cite this record
AIPolicyTracker (2026). “Employers and employment agencies must disclose the data collected and their retention policy for the tool (NYC Local Law 144 (automated employment decision tools))”. https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure (accessed 24 September 2026). Data licensed CC BY 4.0.
Cite the official text alongside it: Automated Employment Decision Tools (AEDT), NYC Department of Consumer and Worker Protection, https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page.
Similar obligations in other instruments
- Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
- Deployers must use the provider's transparency information in their data protection impact assessment — EU AI Act, European Union
- Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
- Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.