Big Data and Human Resources: Letting the Computer Decide?

Big data analytics can help to address these challenges, which explains why more and more HR departments are turning to them. Analytics can improve talent identification and recruitment, as well as workforce management. Supporters also argue that big data analytics can help provide evidence to debunk commonly held assumptions about employees that are wrong and based on biases. In the HR sphere, however, using big data analytics raises some specific risks and challenges, including increased exposure to discrimination claims, breaches of privacy laws, and reputational and brand damages.

What Is Big Data?

Organizations have always accumulated information, but the amount of data being generated and retained today is growing exponentially. In addition, historically organizations may not have been able to draw value from the data they held, particularly where such data was unstructured. New technologies now enable the analysis of large, complex, and rapidly changing data sets comprised of structured, semi-structured, or unstructured data. In short, “big data” is just data. It’s simply that we have more of it, and we can do more with it.

Recruitment

Organizations are using big data analytics to identify potential recruits with the right skills and experience. New talent management systems can quickly search and analyze huge volumes of applicant data—using concepts, not just keywords. Organizations also are using analytics to analyze hiring data to help measure costs per hire and return on investment, as well as to identify necessary changes in hiring strategy and recruitment collateral to attract more candidates and minimize attrition. Two key stages need to be considered in managing legal compliance with respect to these activities: (1) data collection, and (2) the analysis of that data and a decision-making process based on that analysis.

Collecting and Processing Personal Data for Big Data Analytics

Companies are increasingly mining candidate data from online sources, including job sites and social media sites, for talent identification and recruitment. Privacy issues loom large because information collected about a proposed candidate is considered personal data and may involve the collection of sensitive personal information (e.g., health data, ethnic origin, and sexual orientation).

In Europe, where recruitment activities involve the processing of potential recruits’ personal data (e.g., big data analysis of personal data or conducting background checks on candidates), companies must notify those job applicants of the purposes for which the data is intended to be processed, provide any other information that is necessary to ensure that processing is fair (e.g., the names of data recipients), and ensure the company has a legal basis for processing the personal data (e.g., consent). If a third party is engaged to carry out any processing, a written agreement with appropriate data protection provisions should be entered into between the parties. There are also some regional variations, which mean a company’s processes may need to be modified from country to country.

Automated decision-making processing is particularly problematic under European Union (EU) data protection law. Accordingly, employers that use big data analytics in recruitment need to ensure that there is an element of human judgment involved. It should not be (and typically is not) simply a question of “computer says yes,” but rather an informed decision based on the available data and the interpretation of that data.

In the United States, if a company purchases background reports about candidates, the company will need to be mindful of the Fair Credit Reporting Act and state consumer reporting laws. These laws may come into play any time a company procures information about a candidate or employee from a third party in the business of supplying such information on a commercial basis, even if that information may be publicly available. Federal and state laws also limit the types of information an employer may lawfully request or consider in making employment-related decisions, even if the information has been lawfully obtained.

Across Asia, rules regarding the use of personal data in terms of recruitment vary. In China, employers have certain confidentiality obligations but are viewed as having a fairly broad ability to conduct background checks. Illegal or intrusive methods, however, may be viewed as a breach of privacy. Third-party sources of information should be used with caution, as few legitimate channels of information are available, and the use of personal data from illegal channels can attract civil, and sometimes criminal, liability.

In Hong Kong, the collection and use of personal data are regulated by the Personal Data (Privacy) Ordinance (PDPO). The PDPO is heavily based on the EU Data Protection Directive, and the principles are broadly the same (e.g., personal information must be collected by lawful and fair means). It may be acceptable to collect personal information available on job-seeking or “professional” social media sites such as LinkedIn without express consent. Personal information published on personal social media sites (such as a personal Facebook page), however, will generally require consent to be obtained.

In Japan, personal information about applicants also must be collected by appropriate and fair means. As a rule, personal information must be collected directly from applicants or from third parties with the applicant’s consent. The collection of sensitive personal information without express consent is generally prohibited, except where this is necessary to achieve the employer’s business goals, the employer has notified the applicant of the purposes of such collections, and the employer collects the information directly from the applicant.

Avoiding Discriminatory Impact

Of course, as with all talent identification and recruitment activities, organizations also need to ensure that they do not act in a manner that could be considered discriminatory. In Europe, EU-level directives prohibit discrimination in employment on the basis of sex, race, religion, belief, disability, age, and sexual orientation. The principle of equal treatment means that there must be no direct or indirect discrimination on any of these grounds. A number of additional characteristics also are protected at the national level.

Likewise in the United States, a variety of federal and state laws prohibit discrimination in hiring and employment decisions against applicants and employees based on protected characteristics such as race, age, sex, national origin, religion, and disability. Employers may also face liability if they rely on screening or hiring practices that appear neutral on the surface but have a disparate impact on workers in protected classifications, such as disproportionately screening out older candidates or candidates with disabilities. This liability may arise even if the employer had no intent to discriminate or knowledge of the discriminatory impact.

Organizations are generally aware of their obligations in this area in the context of traditional recruitment, but they now need to understand their application in this new age of big data analytics. When identifying keywords and concepts for a data collection exercise, organizations need to apply the same rigor that they would use when creating job advertisements, such as avoiding any terms that could be considered directly or indirectly discriminatory (e.g., “recent graduate,” “highly experienced,” “energetic”). Organizations also need to be careful not to discriminate in terms of where they collect data; otherwise, data that is discriminatory on the way in may also be discriminatory on the way out.

Organizations need to ensure that their data analysis and resulting decisions are not discriminatory. It is critical to not blindly accept data without challenge. Given the size of the potential data pool, conclusions may well be based on correlations, rather than being determinative. Proper interpretations and assessments of the results of big data exercises are essential.

In particular, organizations should be wary of any predictive decision making that gives results that appear skewed in favor of certain types of candidates. For example, if a big data analytics exercise brings up a short list of potential candidates who have the same race, gender, or other characteristic, it may suggest that there has been a discriminatory input at some point in the big data process.

Although it may be difficult for a candidate to establish that a big data analytical exercise has been discriminatory, particularly given the potentially complicated algorithmic calculations involved and lack of transparency about those algorithms, organizations need to be mindful of the risks. In some cases, if a practice is determined to have a discriminatory impact, the burden may shift back to the employer to defend its methodology. Employers also may be required to disclose detailed information about their big data methodologies in the event of employment litigation or a government investigation. As a result, employers should be prepared to explain and, if necessary, justify their big data analytics methods.

Third-Party Rights

Mining data from third-party sites, such as online job sites, could be a breach of their terms of use and potentially an infringement of intellectual property rights. Web scraping also may be considered a breach of applicable local cybersecurity laws, which prohibit unauthorized access to computer systems. Accordingly, organizations need to ensure that they have adequately addressed all potential legal risks prior to embarking on any data-collecting activities.

Workforce Management

HR departments increasingly are using analytics to monitor and analyze employee data. Many organizations already use analytics to obtain insights into, and target, their customers and are now seeking to obtain the same insights into their workforce by, for example, measuring and improving employee productivity, measuring the impact of HR programs on performance, evaluating current people management practices, improving organizational efficiencies, and identifying potential leaders. Of course, if HR is going to become a more data-driven department, it will need to identify what data it holds on its employees and whether such data simply needs to be collated or more needs to be collected.

The collection of more data is very likely to involve increased employee monitoring. Because the applicable rules relating to such monitoring vary across the world, a company that is rolling out an HR analytics project will need to address monitoring and data collection on a country-by-country basis.

In Europe, employees are afforded certain protections—for example, the right to respect for private life, freedom of speech, and freedom of association—under the European Convention of Human Rights, as incorporated into national law. Employees also have protections under applicable data protection law. There are, however, regional variations that employers need to address. For example, in certain countries, privacy regulators have issued specific guidance on the extent to which employers can monitor their staff. In other countries, such as Germany, work councils’ rules govern staff monitoring. Areas of particular concern include managing employees’ legitimate expectations of monitoring and privacy, having appropriate notices and policies in place with employees, and protecting employees’ rights against discrimination for off-duty activities such as religious, trade union, and political activities.

In the United States, restrictions on monitoring fall under federal laws, including the Electronic Communications Privacy Act, Stored Communications Act, and Computer Fraud and Abuse Act, and state laws that restrict certain types of monitoring activities, such as seeking to gain access to personal social media accounts of applicants or employees. Asia has similar restrictions on monitoring.

Other countries can differ in their approach to monitoring. In China, monitoring publicly available information about employees is permitted, but monitoring employees’ computer use in the workplace may be more susceptible to legal challenge. In Hong Kong, monitoring must (1) serve a legitimate purpose that relates to the function and activities of the employer, (2) be necessary to meet that purpose, and (3) be confined to an employee’s work. Monitoring must be carried out by the least intrusive means and with the least harm to the privacy interests of the employee. Employers also are required to set out the purpose of monitoring in a formal privacy policy that is made available to employees. In Japan, employers wishing to monitor employees should (1) establish (in advance) in-house rules regarding monitoring, (2) set out the purpose of monitoring and notify workers of this purpose and relevant in-house regulations, (3) appoint a responsible official to oversee the monitoring, and (4) check that monitoring is properly implemented.

As with big data recruitment analysis, employers will need to ensure that they avoid automated decision making and process such employee data fairly and in accordance with applicable privacy and employment laws. Again, inputs and algorithms need to be carefully set up to ensure that they do not discriminate, and organizations need to avoid any decision making (predictive or otherwise) that could be considered discriminatory.

Of course, big data analytics is not a panacea. Organizations are complex, and human judgment is always going to be needed to interpret the data in context, taking into account relevant factors such as local market conditions. Complex algorithms may help to identify an organization’s highest performing employees who may be likely to leave the organization in the next 12 months, but HR departments will still need to tread carefully in deciding how to respond (or not) to that data.

It is clear that better, more informed data about a workforce can help drive change in the business, but only if the business is actually prepared to embrace that change. Organizations have to be open to accept what the data is telling them, be prepared to change their systems and processes to take account of the data science, and acknowledge that a period of adoption is likely to be needed. In addition, companies cannot underestimate the expense and effort of any training programs that may be required to roll out an operational change that may be inconsistent with traditional thinking.

Legal compliance is not the only consideration. In this age of international business, the war for talent in certain sectors has never been greater, and companies want to attract and retain the best people. Accordingly, companies need to strike a balance between monitoring staff for the purpose of people management analytics and being seen as a “creepy” employer, where employee movements and communications are extensively monitored in “big brother” style. From the employee’s perspective, much may depend on the nature and extent of the data being collected and what the employer plans to do with that data. To foster employee engagement and trust in analytics, organizations need to explain to their workforce how those analytics will directly benefit the employees and offer, for example, better engagement, transparency, and empowerment.

Conclusion

Big data analytics may offer HR departments the ability to make better, more objective, data-driven decisions about recruitment and workforce management. The value of a big data project, however, will depend very much on the quality of the inputs and project parameters and the careful interpretation of the results. HR departments will need to have appropriate in-house analysis or hire appropriate service providers to help them design the big data program and interpret the resulting data. Of course, if a company uses a third-party provider for HR big data technology and analytics services, the company will need to consider other legal issues, including, in particular, the commercial arrangements (e.g., many HR analytics providers offer analytics on the basis of cloud-based software as a service), intellectual property rights, and data ownership.