"Privacy is the most global right of all and the least valued by free people." – Louis Brandeis, U.S. Supreme Court Judge, 1928
Introducing new technologies within the industrial sector is a contribution of great importance for the improvement of production processes and decision making. However, the main constituent of any organization is still the human component, which is, in fact, the most susceptible to be impacted by technological changes in their work environment. From the above, it follows the need to determine the type of impact on job positions that are exercised by the implementation of Artificial Intelligence techniques, as well as the possibilities of reducing unwanted effects.
Many transnational companies have implemented the use of software in their recruitment processes. This AI software is fed according to the general needs of the company and are usually centralized in a database, generally located outside of Costa Rica. In general, these programs ask the candidate for information that could be considered "objective" according to the job position, such as academic degree, foreign language management, experience or years of practice, etc. However, I have detected how this software also requests "subjective" information such as age, gender, economic situation, marital status, among others.
In June of 2017, a critical labor reform came into force in Costa Rica, in which a new chapter to regulate the subject of discrimination was created. As a novelty, an article that explicitly prohibits discrimination in the recruitment processes was included; this was not a regulated matter in our country, and it was little talked about. Today, the reform mentioned above not only prohibits discrimination in these processes, but imposes hefty fines on companies or recruiting agents who engage in discriminatory practices in the recruitment processes.
Our legislation established as causes of discrimination an essential list, such as gender, age, sexual preference, color, race, nationality, among others. However, it also incorporated the phrase "as well as any other analogous form of discrimination¨. This "numerous apertus" is the one that is generating the most complaints and litigation, and which has changed how companies recruit and how they communicate the results of their recruiting. As an example, it was common that many companies in our country, in their job application forms, requested information such as blood type, marital status, spouse's name, number of children, etc.; which had to be modified after the reform.
According to new Costa Rican legislation, a company that includes these "subjective" questions in the job application could generate situations that imply discrimination (whether or not it exists) and be strongly penalized for it.
II Data Protection
Since 2011, there has been a law in Costa Rica that protects people against the processing of their personal data. This law is a "copy paste" of the first Spanish regulation and is based on the reiterated jurisprudence of the Constitutional Chamber regarding the scope of the privacy rights of each person. In accordance with this law, an institution was created, which has an obligation to ensure compliance with current regulations. The main characteristic of our legislation is that the owner of the information has the right to self-determination and management of it, and the right may not be renounced.
Since the law came into effect, no company that I have advised has received an audit on the control, use, or management of its internal databases, with which it is evident that the system works only by the complaint of the owner of the information.
Parallel to this regulation, since the last century, there were companies in our region that collected information and sold it. These companies, before the creation of the law, modified their processes; however, they have not ceased to exist and are still current in their business, and are now using more efficient and faster software's to update records. Therefore, it is easy for a company today to determine the financial situation of a job applicant and take into account, for example, this element for its recruiting process. Thus, despite the existing regulations in our legislation, discriminatory acts in the recruitment processes can still be carried out with relative ease, without the applicant having any way of knowing it.
Costa Ricn law does not specifically regulate the use of artificial intelligence in employment relationships. However, our legislation seems to provide a higher expectation of privacy and protection in the use of each worker's personal information. Under this line, all the personal information that the company obtains from the worker due to the job position is considered confidential.
One of the basic requirements of our legislation is that the worker must provide informed consent on the company’s use of such information. Thus, the company has an obligation to inform the worker about:
a) The existence of a personal character database;
b) the purposes for which these data are collected;
c) the recipients of the information, as well as who can consult it;
d) the mandatory or optional nature of their answers to the questions asked during the data collection;
e) the treatment that will be given to the requested data;
f) the consequences of refusing to provide the data;
g) the possibility of exercising their privacy rights; and
h) the identity and address of the person in charge of the database.
However, in practice, few companies comply with these disclosure requirements, so there are many companies causing infractions. One of the most particular examples of this is the transfer of data of workers to health or life insurance providers. Neither the company nor the worker has real control of how these providers use the data.
The use of "spying" computer software, which collects and processes a worker’s data such as the effective use of their equipment for the intended purpose, time spent on social networks or navigating the web, personal calls, etc., are not limited or prohibited in our legislation, and they are even usable to sanction the worker as long as the company has warned the worker that there is no expectation of privacy in the workplace. Our Constitutional Chamber has also endorsed this criterion.
However, little has been discussed about the use or transfer of such information or metrics, which, in theory, would be prohibited by the current regulatory framework.
Companies recruiting in Costa Rica must adapt their recruiting processes to accommodate Costa Rican law, especially with regard to discrimination. Though artificial intelligence is rapidly advancing globally, Costa Rican law does not directly regulate the impacts or effects of it. Moreover, it is not also a topic that at least in political discourse is considered.
Our data protection legislation is neither effective nor adapted to new trends. In practice, it is proven that there are many infractions to the right to privacy or data protection, but our system is insufficient to solve it.