Delaware amendments would tighten rules for AI-assisted employment decisions

Delaware’s privacy law is set for a significant expansion in how it governs personal data used in profiling and some employment-related decisions, according to an analysis by law firm Ogletree Deakins. The firm says Gov. Matt Meyer signed the amendments on Sept. 2, 2026, with the changes scheduled to take effect Jan. 1, 2027.

The amendments would preserve the law’s general exclusion for employment data while adding a separate category of “residents” and bringing certain profiling and reports into scope. That could matter when an employer relies on a vendor’s report to screen or rank a Delaware job applicant using outside data, particularly before a formal background check governed by the Fair Credit Reporting Act, Ogletree says.

Under the analysis, a report may be covered when it is used in a decision about employment opportunities, is not a consumer report—or would not be one if disclosed to a third party—and is not furnished or disclosed in compliance with the FCRA. The amendments would require controllers to place obligations on third parties that receive such reports, including notice to residents when an adverse action is taken and information about the data behind it. Residents could also request human review of an adverse action.

The analysis says residents could request information about the personal data held about them, the sources used in profiling, and the third parties that received a report concerning them during the preceding 24 months. Controllers would have 30 days to respond and would need to provide an opportunity to correct inaccurate data.

The changes would also broaden the law’s definition of sensitive data to include mental and physical health treatment or diagnoses, neural data, certain financial information that enables access to an account, and inferences revealing those details. The law would prohibit selling sensitive data except under specified conditions, including that the sale be strictly necessary to provide or maintain a service the consumer requested, with clear notice and a five-year record of consent.

Other provisions described by Ogletree would require impact assessments for certain high-risk processing, including profiling that could lead to unlawful discrimination, financial injury, or privacy intrusion. The assessments would cover intended uses, foreseeable harms, data categories, performance measures and limitations, transparency, monitoring, and safeguards. The amendments would also lower the law’s coverage thresholds beginning in 2027, expanding the number of businesses potentially subject to it.

The law firm says violations can carry civil penalties of up to $10,000 per violation and notes that the amendments treat anti-bias testing—or the absence of it—as relevant to claims involving unlawful discrimination. It recommends that employers review their use of AI in recruiting, performance reviews, discipline, and termination ahead of the stated effective date.