Loading page…
The newly circulated legal analysis describes notice, data-access and human-review rights for covered vendor reports—not a blanket rule for AI-assisted hiring.
Listen to this story
Delaware’s 2027 amendments create limited privacy rights for residents whose personal-data-based vendor reports inform hiring, despite employment data remaining generally excluded from the state law. For qualifying reports outside the federal Fair Credit Reporting Act, controllers must pass duties to employer recipients through contracts, including adverse-action notices and access to human review. Ogletree says the rules may reach vendor screening and ranking before formal background checks; the package also expands coverage and assessment requirements, with penalties of up to $10,000 per violation.
Governor Matt Meyer signed the amendments on September 2, 2026; they take effect January 1, 2027.
The report provisions apply when reports inform decisions granting or denying employment opportunities to Delaware residents, but exclude reports covered by the federal Fair Credit Reporting Act.
Residents may request personal data and profiling sources, the identities of report recipients over the prior 24 months, and correction of inaccurate data.
In a legal analysis republished October 19, employment law firm Ogletree Deakins explains how Delaware’s coming privacy amendments reach certain vendor reports used in hiring. Starting January 1, 2027, covered reports will carry notice and human-review rights, with obligations passed to employers through vendor contracts rather than a blanket rule covering employment data.
Governor Matt Meyer signed the amendments on September 2, 2026. Ogletree’s October 16 analysis examines how they narrow an employment-data exclusion in the Delaware Personal Data Privacy Act, which first took effect in January 2025.
Coverage depends on the report and its use. Ogletree describes vendor reports outside the consumer-report category, not furnished or disclosed in compliance with the federal Fair Credit Reporting Act. They must inform decisions granting or denying employment opportunities to Delaware residents. Reports can include recommendations, summaries and automated decisions based on personal data or profiling.
The firm interprets the amendments as addressing a gap before formal background checks. Vendors may use outside data and automated tools to source, screen or rank candidates, with employers relying on that information before the federally regulated background-check stage.
For covered reports, the controller—the party responsible for data processing—must impose contractual duties on third-party recipients. Those include notifying residents of an adverse action and describing the personal data used. The notice must explain rights to obtain information and have the controller perform a human review of the adverse action.
The same package lowers the general coverage threshold from 35,000 to 10,000 Delaware consumers. For businesses deriving at least 20% of annual revenue from personal-data sales, it falls from 10,000 to 5,000.
Controllers processing data on at least 50,000 Delaware consumers must conduct impact assessments for specified higher-risk activities, including certain profiling. Assessments must document intended uses, foreseeable harms, performance measures, known limitations and safeguards after deployment. Violations of the privacy law can carry civil penalties of up to $10,000 each.
Loading discussion...
Join the conversation
Explain when a right to appeal would be enough.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.