Artificial Intelligence Civil Rights Act of 2024
A BILL
To establish protections for individual rights with respect to computational algorithms, and for other purposes.
Sec. 2 Definitions
In this Act:
Collect; collection— The terms collect and collection, with respect to personal data, mean buying, renting, gathering, obtaining, receiving, accessing, or otherwise acquiring such data by any means.
Commission— The term Commission means the Federal Trade Commission.
Consequential action— The term consequential action means an act that is likely to have a material effect on, or to materially contribute to, access to, security and authentication relating to, eligibility for, cost of, terms of, or conditions related to any of the following:
Employment, including hiring, pay, independent contracting, worker management, promotion, and termination.
Education and vocational training, including assessment, proctoring, promotion of academic integrity, accreditation, certification, admissions, and provision of financial aid and scholarships.
Housing and lodging, including rental and short-term housing and lodging, home appraisals, rental subsidies, and publicly supported housing.
Essential utilities, including electricity, heat, water, municipal trash or sewage services, internet and telecommunications service, and public transportation.
Health care, including mental health care, and dental, vision, and adoption services.
Credit, banking, and other financial services.
Insurance.
Actions of the criminal justice system, law enforcement or intelligence operations, immigration enforcement, border control (vetting, screening, and inspection), child protective services, child welfare, and family services, including risk and threat assessments, situational awareness and threat detection, investigations, watchlisting, bail determinations, sentencing, administration of parole, surveillance, use of unmanned vehicles and machines, and predictive policing.
Legal services, including court-appointed counsel services and alternative dispute resolution services.
Elections, including voting, redistricting, voter eligibility and registration, support or advocacy for a candidate for Federal, State, or local office, distribution of voting information, election security, and election administration.
Government benefits and services, as well as identity verification, fraud prevention, and assignment of penalties.
A public accommodation.
Any other service, program, product, or opportunity which has a comparable legal, material, or similarly significant effect on an individual’s life as determined by the Federal Trade Commission through rules promulgated pursuant to section 553 of title 5, United States Code.
Covered algorithm—
In general— The term covered algorithm means a computational process derived from machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity, that, with respect to a consequential action—
creates or facilitates the creation of a product or information;
promotes, recommends, ranks, or otherwise affects the display or delivery of information that is material to the consequential action;
makes a decision; or
facilitates human decision making.
Modified definition by rulemaking— The Commission may promulgate regulations under section 553 of title 5, United States Code, to modify the definition of the term covered algorithm as the Commission considers appropriate.
Covered language— The term covered language means the 10 languages with the most speakers in the United States, according to the most recent data collected by the United States Census Bureau.
De-identified data— The term de-identified data means information—
that does not identify and is not linked or reasonably linkable to an individual or a device, regardless of whether the information is aggregated; and
with respect to which any developer or deployer using such information—
takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual;
publicly commits in a clear and conspicuous manner—
to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and
to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and
contractually obligates any person that receives the information from the developer or deployer—
to comply with all of the provisions of this paragraph with respect to such information; and
to require that such contractual obligations be included in all subsequent instances for which the information may be received.
Deployer—
In general— The term deployer means any person, other than an individual acting in a non-commercial context, that uses a covered algorithm in or affecting interstate commerce.
Rule of construction— The terms deployer and developer shall not be interpreted to be mutually exclusive.
Developer—
In general— The term developer means any person, other than an individual acting in a non-commercial context, that designs, codes, customizes, produces, or substantially modifies an algorithm that is intended or reasonably likely to be used as a covered algorithm for such person's own use, or use by a third party, in or affecting interstate commerce.
Assumption of developer responsibilities— In the event that a deployer uses an algorithm as a covered algorithm, and no person is considered the developer of the algorithm for purposes of subparagraph (A), the deployer shall be considered the developer of the covered algorithm for the purposes of this Act.
Rule of construction— The terms developer and deployer shall not be interpreted to be mutually exclusive.
Disparate impact—
In general— The term disparate impact means an unjustified differential effect on an individual or group of individuals on the basis of an actual or perceived protected characteristic.
Unjustified differential effect— For purposes of subparagraph (A), with respect to the action, policy, or practice of a person, a differential effect is unjustified if—
the person fails to demonstrate that such action, policy, or practice causing the differential effect is necessary to achieve a substantial, legitimate, and nondiscriminatory interest; or
in the event the person demonstrates such interest, an alternative action, policy, or practice could serve such interest with less differential effect.
Application to covered algorithms— With respect to demonstrating that a covered algorithm causes or contributes to a differential effect, the covered algorithm is presumed to be not separable for analysis and may be analyzed holistically as a single action, policy, or practice, unless the developer or deployer proves that the covered algorithm is separable by a preponderance of the evidence.
Harm— The term harm, with respect to a consequential action, means a non-de minimis adverse effect on an individual or group of individuals—
on the basis of a protected characteristic;
that involves the use of force, coercion, harassment, intimidation, or detention; or
that involves the infringement of a right protected under the Constitution of the United States.
Independent auditor—
In general— The term independent auditor means an individual that conducts a pre-deployment evaluation or impact assessment of a covered algorithm in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment.
Exclusion— An individual is not an independent auditor of a covered algorithm if such individual—
is or was involved in using in a commercial context, developing, offering, licensing, or deploying the covered algorithm;
at any point during the pre-deployment evaluation or impact assessment, has an employment relationship (including a contractor relationship) with a developer or deployer that uses, offers, or licenses the covered algorithm; or
at any point during the pre-deployment evaluation or impact assessment, has a direct financial interest or a material indirect financial interest in a developer or deployer that uses, offers, or licenses a covered algorithm, not including routine payment for the auditing services described in subparagraph (A).
Individual— The term individual means a natural person in the United States.
Personal data—
In general— The term personal data—
means information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or an individual's device; and
shall include derived data and unique persistent identifiers.
Exclusion— The term personal data does not include de-identified data.
Process— The term process, with respect to personal data, means to conduct or direct any operation or set of operations performed on such data, including analyzing, organizing, structuring, retaining, storing, using, or otherwise handling such data.
Protected characteristic— The term protected characteristic means any of the following actual or perceived traits of an individual or group of individuals:
Race.
Color.
Ethnicity.
National origin or nationality.
Religion.
Sex (including a sex stereotype, pregnancy, childbirth, or a related medical condition, sexual orientation or gender identity, and sex characteristics, including intersex traits).
Disability.
Limited English proficiency.
Biometric information.
Familial status.
Source of income.
Income level (not including the ability to pay for a specific good or service being offered).
Age.
Veteran status.
Genetic information or medical conditions.
Any other classification protected by Federal law.
Public accommodation—
In general— The term public accommodation means—
a business that offers goods or services to the general public, regardless of whether the business is operated for profit or operates from a physical facility;
a park, road, or pedestrian pathway open to the general public;
a means of public transportation; or
a publicly owned or operated facility open to the general public.
Exclusions— The term public accommodation does not include a private club or establishment described in section 101(b)(2).
State— The term State means each of the 50 States, the District of Columbia, Puerto Rico, the United States Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.
State data protection authority— The term State data protection authority means an independent public authority of a State that supervises, investigates, and regulates data protection and security law in the State, including handling complaints lodged against persons for violations of State and relevant Federal laws.
Transfer— The term transfer, with respect to personal data, means to disclose, release, disseminate, make available, license, rent, or share such data orally, in writing, electronically, or by any other means.