Laws around employment background checks are constantly in motion. Employers must stay up to date with the changes, especially when they work in multiple states. What you can do in one state, and sometimes in one county, is not allowed in another state or county.
One area that is getting a lot of attention is privacy laws. The Federal Government is working to update the Privacy Act of 1974. The Act established rules on how governing federal agencies could collect, maintain, use, and disclose personal information. That law was put into place over 59 years ago when things like AI did not exist.
Representative Lori Trahan issues a report stating that the act “is now structurally incapable of protecting Americans in an era defined by cloud computing, data brokers, and AI.” Because of this, she is looking to bring the act up to modern-day conditions.
Organizations such as The Leadership Conference on Civil and Human Rights were sent an RFI and they responded that the updates are needed and cited how “Elon Musk and the so-called Department of Government Efficiency (DOGE) have accessed, collected, and combined previously secure federally held data” and how that is a threat to individual’s personal information.
Oklahoma has worked on privacy legislation for seven years. The state’s Senate Bill 546 was approved by the House and is now awaiting approval from the Senate.
Bill 546 provides oversight on businesses that control, process, or derive at least 50% of their gross revenue from data sales. If the bill is passed by the Senate and is enacted by the Governor, it will take effect on January 1, 2027.
The Kentucky Consumer Data Protection Act (KCDPA), codified in KRS 367.3611 to 367.3629 became effective January 1, 2026. This Act created new obligations for businesses and gives new consumer rights for residents of the state. Data governed by the FCRA is exempt so this should not affect background reporting.
The Maine Senate passed an amended version of Legislative Document 1822, which is the Maine Online Data Privacy Act. Because the House had already passed the bill before it was amended, the House and Senate will have to work together to finalize the bill. Among other things, the bill contains a prohibition on the sale of “sensitive data.”
Oregon’s Senate Bill 1546 is an AI chatbot safety bill. This bill requires AI chatbot operators to require “safety notifications and measures for all users while additional obligations will be attached to users who operators have ‘reason to believe’ are minors.” Disclosures for transparency on speaking with a chatbot are also required.
It is worth watching all of the new laws around privacy to see if/when the laws will include private information reported in employment background checks.
Sources: nkytribune.com; iapp.org; biometricupdate.com