AI and data privacy
Tackling the challenges of AI and data privacy in the workplace
The U.S. federal government aims to loosen AI restrictions as states such as California tighten regulations at the state level. Italy passes legislation that addresses AI use in the workplace, but this conflicts with the pre-existing Workers’ Statute. Members of the European Parliament call for updated requirements on the use of algorithmic management in the workplace. Vietnam introduces stricter standards for data collection in employment and recruitment scenarios.
Key takeaways
- Governments are taking diverging approaches to regulating AI, with the United States loosening oversight while others impose stricter rules.
- Recent moves in Europe suggest an increasing emphasis on transparency and worker safeguards around the use of AI at work.
- Principles-based frameworks encourage responsible AI use without creating direct compliance implications.
- Data privacy reforms are increasingly intersecting with employment.
Artificial intelligence (AI) has found its way into almost every area of society, including governments, health care, education, and everyday workplaces. But as the impact and capabilities of this transformative technology grow, so does the challenge of regulating it.
The United Nations has outlined the need for globally coordinated AI governance in order to maximize its benefits while managing risks. That call is broadly supported by many governments, including Italy, which implemented new rules on AI that extend to workplace use. Meanwhile, some jurisdictions are simply encouraging citizens and employers to abide by responsible AI guidelines, while stopping short of putting legal requirements in place.
However, there is a divide in the United States between federal efforts to allow the use of AI with minimal regulation and state efforts to impose tighter restrictions. This split is creating a complex compliance landscape.
Meanwhile, data privacy is also a focus in some jurisdictions. In Vietnam, the government has approved tighter restrictions on gathering and processing personal data.
“
Approaches to regulating AI continue to vary widely across jurisdictions.”
U.S. federal AI rules loosen as states crack down
The Trump administration released the United States’ AI intelligence roadmap in July 2025. Titled “Winning the Race: America’s AI Action Plan,” the document makes clear the country’s desire to win the AI race and achieve “global dominance in artificial intelligence.” It notes a need to cut back on red tape and bureaucratic hurdles that could prevent the nation from making progress on the AI front, and notes the administration’s January 2025 revocation of a Biden-era executive order. That order called for guidelines and best practices for safe, secure, and trustworthy AI systems, as well as the formation of an AI Task Force.
But while the federal government aims to remove restrictions on AI use, some U.S. states are seeking to impose them. In California, amendments to the Fair Employment and Housing Act that took effect in October 2025 prevent employers from using AI systems in recruitment if those systems discriminate against candidates because of a protected characteristic. This applies to both disparate treatment and disparate impact discrimination. Auditing protocols to ensure the systems are bias-free may help employers defend legal actions, but the law does not specifically require it. The effort by California follows other state and city AI employment-related laws, such as in Utah, Colorado, and New York.
Tension between the federal government and the states in their approach to AI was highlighted on 11 December 2025. President Trump issued an executive order directing a whole-of-government effort to establish a future federal AI policy framework and to take steps to preempt state laws that seek to regulate AI.
“
New rules are emerging to clarify how AI can be used in employment decisions.”
Global developments on workplace AI
The EU AI Act applies automatically across the EU, without needing local implementing law. Some countries are introducing complementary laws reflecting national priorities. In September 2025, Italy became the first country in the EU to pass a domestic law that regulates AI systems. The Italian AI Law includes regulations for AI in the workplace, stating that employers must inform job applicants and employees when an AI system is being used in recruitment, performance evaluation, monitoring, or other employment-related decisions. The “logic, criteria, and purposes” of any decision made by AI as it relates to employment must be disclosed, and any such decision must respect anti-discrimination and equal treatment principles already in place. Additionally, any AI use in the workplace must protect the confidentiality and integrity of workers, and in certain instances, trade unions or worker representatives must be consulted about the use of AI tools for monitoring or decision making. The law took effect on 10 October 2025.
However, questions remain about how the AI Law aligns with the longstanding Workers’ Statute, which places strict controls on the circumstances in which employers can adopt tools to monitor employees’ work activities. Although the right of workers to be informed about the use of artificial intelligence is now expressly guaranteed by the new AI Law, further amendments are needed because the high level of control made possible by new AI systems goes beyond what is permitted by the Workers’ Statute. To resolve this, the government is preparing a series of implementing decrees over the next year to clarify how the AI Law should operate in practice.
It seems that further legislation may be in the pipeline at the EU level, specifically regulating AI in the employment context beyond the restrictions for the gig economy sector already contained in the Platform Workers Directive. In November 2025, Members of the European Parliament called for new rules on the use of algorithmic management in the workplace, proposing that workers should not be hired or fired based on a decision taken solely by an algorithm. The proposed legislation would require human oversight of decisions and for workers to be informed on how algorithmic tools impact working conditions, when they are used to make decisions, what type of data they collect or process, and how human oversight is ensured.
Japan has chosen to take a principles-based approach to AI, in contrast to the EU’s more restrictive requirements. It has not implemented legislation regarding AI use in the workplace, but the country’s AI Promotion Act encourages companies to cooperate with government AI policies. The Act establishes principles that should guide AI regulation, including ensuring transparency in the use, research, development, and utilization of AI. The Act’s aim is to promote innovation while mitigating risks.
Elsewhere in the region, the Indonesian government said in January 2025 that it plans to introduce new AI regulation soon, which could come in the form of a presidential regulation or ministerial decree. However, there has been no suggestion that any such legislation would target employers’ use of AI, and it seems likely that it would adopt a “light-touch,” innovation-friendly regulatory framework based on high-level principles of safety, accountability, and ethics, rather than detailed prescriptive rules. This could be viewed as consistent with the principles-based approach adopted in Japan and would be in line with the existing 2023 Ministerial Circular on Ethical Guidelines for Artificial Intelligence.
“
Data privacy reforms are shaping how employers collect and use employee information.”
Employment data privacy reforms
AI regulation often overlaps with data privacy law. Vietnam’s Personal Data Protection Law was passed in June 2025 and came into effect on 1 January 2026. The law introduces more stringent rules around collecting and retaining the personal data of employees and prospective employees, stating that organizations are required to obtain consent to process data in most cases, and this consent must be voluntary, informed, and specific. Organizations may only gather information that is directly relevant to recruitment or employment, and candidate data must be deleted if the individual is not hired, unless the candidate agrees otherwise. It also includes rules and expectations for companies using AI to ensure that ethical standards are in place. Employers already familiar with EU GDPR requirements will not find the new law surprising.
Related content

AI Hub | Latest Global Developments | Hogan Lovells

White House issues executive order to establish a federal AI policy and preempt state laws

Initial reflections on Law 132/25: Italy’s approach to AI

Confidentiality in the Digital Age: The Singapore approach
Explore by topic
This website is operated by Hogan Lovells International LLP, whose registered office is at Atlantic House, Holborn Viaduct, London, EC1A 2FG. For further details of Hogan Lovells International LLP and the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses ("Hogan Lovells"), please see our Legal Notices page. © 2026 Hogan Lovells.
Attorney advertising. Prior results do not guarantee a similar outcome.







