Stop Spying Bosses Act
This bill establishes requirements for employers with respect to the collection and disclosure of certain worker data. The requirements apply to employers with more than 10 workers, including government employers.
For example, employers must disclose to their workers (including job applicants) any workplace surveillance by the employer, including (1) what data is collected, (2) how the data is used, and (3) how such surveillance affects workers' performance assessments.
Further, employers may not use workplace surveillance for certain purposes, such as to (1) monitor a worker's activities related to a labor organization, (2) collect a worker's health information that is unrelated to the worker's job duties, (3) monitor a worker who is off duty or in a sensitive area, or (4) use an automated decision system (e.g., machine learning or artificial intelligence techniques) to predict the behavior of a worker that is unrelated to the worker's job .
Employers must disclose to a worker any work-related decision that relies on workplace surveillance data and allow the worker to review the data. Employers also must meet certain requirements before transferring surveillance data to a third party.
Additionally, the bill establishes the Privacy and Technology Division within the Department of Labor to implement and enforce the workforce surveillance requirements. The bill also provides for enforcement by private right of action, states, and other specified agencies.
[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 262 Introduced in Senate (IS)]
<DOC>
118th CONGRESS
1st Session
S. 262
To prohibit, or require disclosure of, the surveillance, monitoring,
and collection of certain worker data by employers, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
February 2, 2023
Mr. Casey (for himself, Mr. Booker, Mr. Schatz, Mr. Fetterman, and Ms.
Warren) introduced the following bill; which was read twice and
referred to the Committee on Health, Education, Labor, and Pensions
_______________________________________________________________________
A BILL
To prohibit, or require disclosure of, the surveillance, monitoring,
and collection of certain worker data by employers, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Stop Spying Bosses Act''.
SEC. 2. DEFINITIONS.
For purposes of this Act:
(1) Administrator.--The term ``Administrator'' means the
Administrator of the Privacy and Technology Division
established under section 5.
(2) Aggregated data.--The term ``aggregated data'' means
data with respect to covered individuals of an employer that
the employer has combined or collected together in a summary or
other form that prevents the identification of any specific
individual.
(3) Applicant.--The term ``applicant'', with respect to an
employer, means an individual who applies, or applied, to be
employed by, or otherwise perform work for remuneration for,
the employer.
(4) Automated decision system.--
(A) In general.--The term ``automated decision
system'' means a system, software, or process that--
(i) uses computation, in whole or in part,
to determine outcomes, make or aid decisions
(including through evaluations, metrics, or
scoring), inform policy implementation, collect
data or observations, or otherwise interact
with individuals or communities, including such
a system, software, or process derived from
machine learning, statistics, or other data
processing or artificial intelligence
techniques; and
(ii) is not passive computing
infrastructure.
(B) Passive computing infrastructure.--For purposes
of this paragraph, the term ``passive computing
infrastructure'' means any intermediary technology that
does not influence or determine the outcome of a
decision, make or aid in a decision (including through
evaluations, metrics, or scoring), inform policy
implementation, or collect data or observations,
including web hosting, domain registration, networking,
caching, data storage, or cybersecurity.
(5) Automated decision system output.--The term ``automated
decision system output'' means any information, assumptions,
predictions, scoring, recommendations, decisions, evaluations,
metrics, or conclusions generated by an automated decision
system.
(6) Biometric information.--
(A) In general.--The term ``biometric information''
means any information generated from the technological
processing of an individual's unique biological,
physical, or physiological characteristics that is
linked or reasonably linkable to an individual,
including--
(i) fingerprints;
(ii) voice prints;
(iii) iris or retina scans;
(iv) facial or hand mapping, geometry, or
templates; or
(v) gait or personally identifying physical
movements.
(B) Exclusion.--The term ``biometric information''
does not include--
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) information generated from a digital
or physical photograph, or an audio or video
recording, that cannot be used to identify an
individual.
(7) Covered individual.--The term ``covered individual'',
with respect to an employer, means an individual--
(A) who is employed by, or otherwise performing
work for remuneration for, the employer, including such
an individual who is--
(i) any individual performing work for
remuneration for an employer described in
clauses (i)(I) and (ii) of paragraph (10)(A);
(ii) any individual performing work for
remuneration for an entity described in
paragraph (10)(A)(i)(II);
(iii) any individual performing work for
remuneration for an employing office described
in paragraph (10)(A)(i)(III);
(iv) any individual performing work for
remuneration for an employing office described
in paragraph (10)(A)(i)(IV); or
(v) any individual performing work for
remuneration for an employing agency described
in paragraph (10)(A)(i)(V); or
(B) who is an applicant to the employer.
(8) Data.--The term ``data'', with respect to a covered
individual, means any information that identifies, relates to,
describes, is reasonably capable of being associated with, or
could reasonably be linked, directly or indirectly, with the
covered individual, regardless of how the information is
collected, inferred, or obtained, including--
(A) personally identifiable information with
respect to the covered individual, including any name,
contact information, government-issued identification
number, financial information, criminal background,
location information, photographs, biometric
information, or employment history associated with the
covered individual;
(B) any information related to the workplace
activities with respect to the covered individual,
including--
(i) human resources information, including
the contents of a personnel file or performance
evaluation;
(ii) work process information, such as
productivity and efficiency information and
information on breaks;
(iii) information that captures workplace
communications and interactions, including
emails, texts, internal message boards, and
customer interaction and ratings;
(iv) device usage and information,
including calls placed or precise geolocation
information;
(v) audio-video information and other
information collected from sensors, including
movement tracking, images, videos, and thermal-
sensor information;
(vi) biometric information;
(vii) information from a personality test
taken by a covered individual, including such a
test given electronically at the beginning of
or during a work shift;
(viii) inputs for an automated decision
system or any automated decision system output;
and
(ix) information that is collected or
generated to mitigate the spread of infectious
diseases, including COVID-19, or to comply with
any public health measure; and
(C) online information with respect to the covered
individual that is collected while the covered
individual is on- or off-duty, including any internet
protocol address associated with the covered
individual, the social media activity of the covered
individual, any advertisement-related tracking
identifier associated with the covered individual, the
internet browsing history of the covered individual, or
other digital sources or unique identifiers associated
with the covered individual.
(9) Employ.--The term ``employ'' has the meaning given such
term in section 3 of the Fair Labor Standards Act of 1938 (29
U.S.C. 203).
(10) Employer.--
(A) In general.--The term ``employer'' means any
person who is--
(i)(I) a covered employer who is not
described in any other subclause of this
clause;
(II) an entity employing a State employee
described in section 304(a) of the Government
Employee Rights Act of 1991 (42 U.S.C. 2000e-
16c(a));
(III) an employing office, as defined in
section 101 of the Congressional Accountability
Act of 1995 (2 U.S.C. 1301);
(IV) an employing office, as defined in
section 411(c) of title 3, United States Code;
or
(V) an employing agency covered under
subchapter V of chapter 63 of title 5, United
States Code; and
(ii) engaged in commerce (including
government), or an industry or activity
affecting commerce (including government).
(B) Covered employer.--In subparagraph (A), the
term ``covered employer''--
(i) means any person engaged in commerce or
in any industry or activity affecting commerce
who employs, or otherwise engages for the
performance of work for remuneration, 11 or
more covered individuals;
(ii) includes--
(I) any person who acts, directly
or indirectly, in the interest of a
covered employer in relation to any
individual performing work for
remuneration for such covered employer;
(II) any successor in interest of a
covered employer;
(III) any public agency; and
(IV) the Government Accountability
Office and the Library of Congress; and
(iii) does not include any labor
organization (other than when acting as an
employer) or anyone acting in the capacity of
officer or agent of such labor organization.
(C) Public agency.--For purposes of this paragraph,
a public agency shall be considered to be a person
engaged in commerce or in an industry or activity
affecting commerce.
(D) Definitions.--For purposes of this paragraph,
the terms ``commerce'', ``person'', and ``public
agency'' have the meanings given the terms in section 3
of the Fair Labor Standards Act of 1938 (29 U.S.C.
203).
(11) Employment-related decision.--The term ``employment-
related decision'' includes a decision by an employer with
regard to--
(A) hiring a covered individual (including any
decision with regard to interviewing or reviewing an
applicant);
(B) firing, taking a disciplinary action against,
demoting, or reassigning duties of a covered
individual; or
(C) any other term, condition, or privilege of
employment or work of the covered individual, such as
relating to pay, scheduling, or hours worked or
promoting a covered individual.
(12) Government entity.--The term ``government entity''
means--
(A) a Federal agency (as such term is defined in
section 3371 of title 5, United States Code);
(B) a State or political subdivision thereof;
(C) any agency, authority, or instrumentality of a
State or political subdivision thereof; or
(D) a Tribal government or political subdivision
thereof.
(13) Indian tribe.--The term ``Indian Tribe'' means any
Indian or Alaska Native tribe, band, nation, pueblo, village,
community, component band, or component reservation
individually identified (including parenthetically) in the list
published most recently as of the date of enactment of this Act
pursuant to section 104 of the Federally Recognized Indian
Tribe List Act of 1994 (25 U.S.C. 5131).
(14) Labor organization.--The term ``labor organization''
has the meaning given the term in section 2(5) of the National
Labor Relations Act (29 U.S.C. 152(5)), except that such term
shall also include--
(A) any organization composed of labor
organizations, such as a labor union federation or a
State or municipal labor body; and
(B) any organization which would be included in the
definition for such term under such section 2(5) but
for the fact that the organization represents--
(i) individuals employed by the United
States, any wholly owned Government
corporation, any Federal Reserve Bank, or any
State or political subdivision thereof;
(ii) individuals employed by persons
subject to the Railway Labor Act (45 U.S.C. 151
et seq.); or
(iii) individuals employed as agricultural
laborers.
(15) Precise geolocation information.--
(A) In general.--The term ``precise geolocation
information'' means information that is derived from a
device or technology that reveals the past or present
physical location of an individual or a device that
identifies or is linked or reasonably linkable to 1 or
more individuals, with sufficient precision to identify
street level location information of the individual or
device or the location of the individual or device
within a range of 1,850 feet or less.
(B) Exclusion.--The term ``precise geolocation
information'' does not include information described in
subparagraph (A) identifiable or derived solely from
the visual content of a legally obtained image,
including the location of the device that captured such
image.
(16) Predispute arbitration agreement.--The term
``predispute arbitration agreement'' means any agreement to
arbitrate a dispute that has not yet arisen at the time of the
making of the agreement.
(17) Predispute joint-action waiver.--The term ``predispute
joint-action waiver'' means an agreement, whether or not part
of a predispute arbitration agreement, that would prohibit, or
waive the right of, one of the parties to the agreement to
participate in a joint, class, or collective action in a
judicial, arbitral, administrative, or other forum, concerning
a dispute that has not yet arisen at the time of the making of
the agreement.
(18) Secretary.--The term ``Secretary'' means the Secretary
of Labor.
(19) Sell.--The term ``sell'', with respect to data, means
the transfer of such data for monetary consideration or for a
thing of value by an employer to a third party for the purpose
of processing, maintaining, or further transferring such data.
(20) Service provider.--The term ``service provider'', with
respect to an employer, means a person that--
(A) collects, processes, conveys, or maintains data
with respect to such employer only at the direction of,
in accordance with the direction of, and pursuant to a
written contract with the employer (including any terms
of service or service agreements);
(B) does not earn revenue from such collection,
processing, conveyance, or maintenance of such data,
except from the employer by providing contracted
services to the employer with regard to such
collection, processing, conveyance, or maintenance of
such data; and
(C) does not combine or link data associated with
such employer with data associated with another
employer.
(21) Social media activity.--The term ``social media
activity'' means any activity on an individual platform-based
account.
(22) State.--The term ``State'' means each of the several
States of the United States, the District of Columbia, or any
territory or possession of the United States.
(23) State attorney general.--The term ``State attorney
general'' means--
(A) with respect to a State, the attorney general
or chief law enforcement officer of the State, or
another official or agency designated by the State to
bring civil actions on behalf of the State or the
residents of the State; and
(B) with respect to a Tribal government, the
attorney general or chief law enforcement officer of
the Tribal government, or another official or agency
designated by the Tribal government to bring civil
actions on behalf of the Tribal government or the
Indian Tribe of the Tribal government.
(24) State privacy regulator.--The term ``State privacy
regulator'' means--
(A) the chief consumer protection officer of a
State; or
(B) a State consumer protection agency with
expertise in data protection, including the California
Privacy Protection Agency.
(25) Technologist.--The term ``technologist'' means an
individual with experience in fields related to computational
technology, or the technology industry that produces
computational technology, such as advertising technology,
application development, artificial intelligence, computer
science, cybersecurity, data science, digital forensics, human-
centered design, product management, prototyping, service
design, socio-technical systems, software engineering, user
experience, or privacy rights, civil liberties, or civil rights
related to technology.
(26) Third party.--The term ``third party'', with respect
to an employer, means a person or entity--
(A) to which such employer transfers or is able to
transfer data, including any subsidiary or corporate
affiliate of such employer; and
(B) that is not--
(i) such employer;
(ii) a service provider of such employer
with respect to the data being transferred; or
(iii) a government entity.
(27) Transfer.--The term ``transfer'', with respect to
data, means releasing, sharing, leasing, disseminating,
disclosing, making available, or otherwise causing to be
communicated, such data--
(A) to a third party; or
(B) in the case of a third party that releases,
shares, leases, disseminates, discloses, makes
available, or otherwise causes to be communicated, such
data, to another person.
(28) Tribal government.--The term ``Tribal government''
means the recognized governing body of an Indian Tribe.
(29) Workplace surveillance.--The term ``workplace
surveillance'' means any employer surveillance (on- or off-
duty) with respect to a covered individual, including the
detection, monitoring, interception, collection, exploitation,
preservation, protection, transmission, or retention of data
concerning activities or communications with respect to the
covered individual, including through the use of a product or
service marketed, or that can be used, for such purposes, such
as a computer, telephone, wire, radio, camera, sensor,
electromagnetic, photoelectronic, handheld or wearable device,
or photo-optical system.
SEC. 3. DISCLOSURE OF CERTAIN WORKPLACE SURVEILLANCE.
(a) In General.--An employer shall disclose, in accordance with
subsections (b) and (c), to each covered individual described in
subsection (b)(1) and publish in a manner that is conspicuous, freely
accessible, and readily available for viewing by any such covered
individual of the employer (including on the internet in a manner that
is freely accessible and machine readable (in a form prescribed by the
Secretary))--
(1) any workplace surveillance on the covered individual by
the employer, including--
(A) what data are being collected;
(B) how the data are being collected;
(C) where and when the data are being collected;
(D) the frequency of the collection;
(E) where the storage of the data is located;
(F) the business purposes for which the data are
being used; and
(G) as applicable, the identity of any third party
or service provider--
(i) used for such workplace surveillance;
(ii) to which data from such workplace
surveillance is transferred; and
(iii) from which data of the covered
individual is or may be purchased or acquired;
and
(2) how such workplace surveillance affects employment-
related decisions by the employer, including with regard to the
assessment of the performance and productivity of the covered
individual.
(b) Timing of Disclosure.--
(1) Initial disclosure.--An employer shall provide the
disclosure required under subsection (a)--
(A) in the case of--
(i) a covered individual for whom an
employment-related decision with regard to the
hiring of the covered individual was made on or
after the effective date of this section, to
the covered individual not later than 30 days
after the date on which the employer makes such
employment-related decision; or
(ii) a covered individual who is employed
by, or otherwise performing work for
remuneration for, the employer on such
effective date or a covered individual for whom
an employment-related decision with regard to
the hiring of the covered individual was made
on or after the date that is 5 years prior to
the effective date of this section but before
such effective date, to the covered individual
not later than 60 days after such effective
date; and
(B) to each applicant of the employer prior to
accepting an application by the applicant to be
employed by, or otherwise perform work for remuneration
for, the employer.
(2) Subsequent disclosures.--Not later than 7 days after
any information provided by an employer to a covered individual
through a disclosure required under subsection (a) changes or
after any new information required to be provided in such a
disclosure becomes available, the employer shall provide the
covered individual with an updated disclosure in accordance
with such subsection.
(c) Procedures for Disclosure.--An employer shall provide the
disclosure required under subsection (a) in a manner required by the
Administrator that is--
(1) accessible;
(2) in plain language and in the primary language of the
covered individual provided the disclosure;
(3) in writing and available electronically;
(4) accountable;
(5) tailored to the purpose of the disclosure;
(6) tailored to the covered individual; and
(7) tailored to the level of risk.
(d) Covered Individual Acknowledgment.--An employer shall obtain
written or electronic acknowledgment from each covered individual
provided a disclosure under subsection (a) of the receipt of the
disclosure by the covered individual.
(e) Worker Data Request and Correction.--An employer shall enable a
covered individual, upon request by the covered individual or as
provided in section 4(c), to--
(1) not later than 7 days after such request, obtain any
data collected by the employer on the covered individual
through workplace surveillance; and
(2) in accordance with procedures established by the
Administrator, have any such data that is incomplete or
erroneous updated or corrected at any time.
(f) Effective Date.--This section shall take effect on the date
that is 60 days after the date of enactment of this Act.
SEC. 4. PROHIBITION OF CERTAIN WORKPLACE SURVEILLANCE.
(a) In General.--An employer or, as applicable, a third party or
service provider that the employer uses for workplace surveillance may
not--
(1) use workplace surveillance to--
(A) identify any covered individual who forms,
joins, assists, or seeks to form, join, or assist, a
labor organization;
(B) monitor the activities of any covered
individual concerning or related to a labor
organization or with respect to engaging in protected
concerted activity;
(C) except as otherwise provided in law, ascertain
any political opinion or activity, religious view, or
other identity marker of the covered individual, that
is unrelated to the performance of the job duties of
the covered individual for the employer;
(D) except as otherwise provided in law, collect
information on or identify the health status, any
health condition, or disability status of a covered
individual, that is unrelated to the performance of the
job duties of the covered individual for the employer;
(E) except as otherwise required by law ascertain
the immigration status of a covered individual; or
(F) monitor the activities of any covered
individual concerning or related to reporting the
employer or such a third party or service provider for
a violation of any other law, including monitoring for
purposes of identifying a covered individual who has
reported or intends to report the employer or such a
third party or service provider;
(2) use an automated decision system to predict behavior of
a covered individual that is unrelated to the work of the
covered individual for the employer;
(3) use workplace surveillance to monitor a covered
individual while the covered individual is off-duty or in a
sensitive area, such as a restroom or locker room, location
provided for the covered individual to express breast milk, or
location provided for the covered individual to pray or
participate in a religious activity;
(4) use workplace surveillance on a covered individual in
any manner that threatens the mental or physical health of the
covered individual;
(5) use data collected through workplace surveillance on a
covered individual for a purpose that is not disclosed in
accordance with section 3(a)(1)(F); or
(6) sell or license data collected on a covered individual
to any person (including a third party or service provider of
the employer) or, except as otherwise provided in law,
government entity.
(b) Transfer of Personally Identifiable Data.--
(1) Employer.--An employer may not transfer data on a
covered individual collected using workplace surveillance to a
third party unless, for each instance of a transfer--
(A) the employer--
(i) discloses the transfer to the covered
individual; and
(ii) provides cybersecurity protections and
encryption for the data; and
(B) the covered individual does not opt out of the
instance of the transfer.
(2) Third party.--A third party that an employer uses for
workplace surveillance may not transfer data on a covered
individual, including any such data that was transferred to the
third party by the employer in accordance with paragraph (1).
(c) Employment-Related Decisions.--An employer that makes an
employment-related decision with regard to a covered individual using
data from workplace surveillance shall--
(1) not later than 7 days after making such an employment-
related decision, disclose to the covered individual that such
employment-related decision was made using data from workplace
surveillance; and
(2) not later than 7 days after such disclosure, enable the
covered individual to--
(A) review such data and related aggregated data
for other similarly situated covered individuals of the
employer; and
(B) in accordance with the procedures described in
section 3(e)(2), have any data described in paragraph
(1) that is incomplete or erroneous updated or
corrected.
(d) Minimization.--
(1) Collection.--An employer may not collect data on a
covered individual that is not reasonably related to operations
of the employer.
(2) Employee access.--An employer shall restrict access to
data on a covered individual by another covered individual of
the employer based on the specific and reasonable business
rationale of the employer that is proportionate to the need for
such access.
(e) Employer Contracts With Any Third Party or Service Provider
That the Employer Uses for Workplace Surveillance.--An employer that
uses a third party or service provider for workplace surveillance shall
include in any contract between the employer and such third party or
service provider entered into after the effective date of this section
an agreement to comply with the requirements of this section.
(f) Effective Date.--This section shall take effect on the date
that is 60 days after the date of enactment of this Act.
SEC. 5. ESTABLISHMENT OF PRIVACY AND TECHNOLOGY DIVISION.
(a) In General.--There is established in the Department of Labor
the Privacy and Technology Division.
(b) Administrator of the Privacy and Technology Division.--The
President shall appoint an Administrator of the Privacy and Technology
Division to head the Privacy and Technology Division.
(c) Employees and Advisory Boards of the Division.--
(1) In general.--The Administrator--
(A) may select, appoint, and employ, without regard
to the provisions of sections 3309 through 3318 of
title 5, United States Code, individuals, including
technologists, directly to positions in the competitive
service, as defined in section 2102 of such title, to
carry out the duties of the Administrator under this
Act; and
(B) may fix the compensation of the individuals
described in subparagraph (A) without regard to chapter
51 and subchapter III of chapter 53 of title 5, United
States Code, relating to classification of positions
and General Schedule pay rates, except that the rate of
pay for such individuals may not exceed the rate
payable for level V of the Executive Schedule under
section 5316 of that title.
(2) Advisory boards.--
(A) Establishment.--The Administrator shall
establish the following advisory boards to advise and
consult with in the exercise of the functions of the
Administrator under this Act and to provide information
on emerging practices relating to the treatment of data
by employers:
(i) The User Advisory Board, which shall be
composed of experts in consumer protection,
privacy, civil rights, disability law, labor
organizations, and ethics.
(ii) The Research Advisory Board, which
shall be composed of individuals with academic
and research expertise in privacy,
cybersecurity, computer science, innovation,
design, ethics, economics, law, disability law,
labor organizations and public policy and
representatives of labor organizations.
(iii) The Product Advisory Board, which
shall be composed of technologists, computer
scientists, designers, product managers,
attorneys, representatives of labor
organizations, workplace technology experts,
and other representatives of employers and
employees.
(iv) The Labor Advisory Board, which shall
be composed of representatives of labor
organizations and representatives of workers.
(B) Appointments.--The Administrator shall appoint
members to the advisory boards established under
subparagraph (A) without regard to party affiliation.
(C) Meetings.--Each advisory board established
under subparagraph (A) shall meet--
(i) at the call of the Administrator; and
(ii) not less than 2 times annually.
(D) Compensation and travel expenses.--A member of
an advisory board established under subparagraph (A)
who is not an officer or employee of the Federal
Government shall--
(i) be entitled to receive compensation at
a rate fixed by the Administrator while
attending meetings of the advisory board,
including travel time; and
(ii) receive travel expenses, including per
diem in lieu of subsistence, in accordance with
applicable provisions under subchapter I of
chapter 57 of title 5, United States Code.
(E) Exemption from the federal advisory committee
act.--Each advisory board established under
subparagraph (A) shall be exempt from chapter 10 of
title 5, United States Code (commonly known as the
``Federal Advisory Committee Act'').
(3) Use of voluntary services.--The Administrator may, as
may from time to time be needed, use any voluntary or
uncompensated services.
(4) Attorneys.--Attorneys appointed under this subsection
may appear for and represent the Administrator in any
litigation.
(d) Offices.--
(1) In general.--The principal office of the Privacy and
Technology Division shall be in the District of Columbia.
(2) Regional, local, and other offices.--The Administrator
may establish regional, local, or other offices, including an
office in the city of San Francisco, California, or the San
Francisco Bay area in California.
(e) Orders and Guidance.--
(1) In general.--The Secretary, acting through the
Administrator and the Administrator of the Wage and Hour
Division, may issue orders and guidance, as may be necessary or
appropriate to enable the Secretary to carry out the purposes
and objectives of this Act, and to prevent evasions thereof.
(2) Consultation.--In issuing orders and guidance
authorized under this subsection, the Secretary, acting through
the Administrator and the Administrator of the Wage and Hour
Division, may consult with Federal agencies that have
jurisdiction over Federal privacy laws or expertise in privacy,
including the Federal Trade Commission, and Federal agencies
that have jurisdiction over labor and employment issues,
including the Equal Employment Opportunity Commission, the
National Labor Relations Board, the National Mediation Board,
and the Merit Systems Protection Board.
SEC. 6. REGULATIONS.
(a) In General.--
(1) Authority.--
(A) In general.--Except as provided in paragraph
(2), the Secretary, acting through the Administrator in
consultation with the Administrator of the Wage and
Hour Division, may prescribe such regulations as may be
necessary to carry out this Act with respect to covered
individuals described in section 2(7)(A) (other than
covered individuals described in clauses (iii) through
(v) of such section) and other individuals affected by
employers described in subclause (I) or (II) of section
2(10)(A)(i), including individuals who are covered
individuals described in section 2(7)(B) with respect
to such employers.
(B) Consultation.--In prescribing any regulations
authorized under this paragraph, the Secretary, acting
through the Administrator, may consult with Federal
agencies that have jurisdiction over Federal privacy
laws or expertise in privacy, including the Federal
Trade Commission, and Federal agencies that have
jurisdiction over labor and employment issues,
including the Equal Employment Opportunity Commission
and the National Labor Relations Board.
(2) Government accountability office; library of
congress.--The Comptroller General of the United States and the
Librarian of Congress shall prescribe any regulations described
in paragraph (1)(A) with respect to covered individuals of the
Government Accountability Office and the Library of Congress,
respectively, and other individuals affected by the Comptroller
General of the United States and the Librarian of Congress,
respectively.
(b) Employees Covered by Congressional Accountability Act of
1995.--
(1) Authority.--Not later than 45 days after the Secretary
prescribes any regulation under subsection (a)(1)(A), the Board
of Directors of the Office of Compliance shall prescribe (in
accordance with section 304 of the Congressional Accountability
Act of 1995 (2 U.S.C. 1384)) such regulations as may be
necessary to carry out this Act with respect to covered
individuals described in section 2(7)(A)(iii) and other
individuals affected by employers described in section
2(10)(A)(i)(III), including individuals who are covered
individuals described in section 2(7)(B) with respect to such
employers.
(2) Agency regulations.--The regulations prescribed under
paragraph (1) shall be the same as substantive regulations
promulgated by the Secretary under subsection (a)(1)(A) except
insofar as the Board may determine, for good cause shown and
stated together with the regulations prescribed under paragraph
(1), that a modification of such regulations would be more
effective for the implementation of the rights and protections
involved under this section.
(c) Employees Covered by Chapter 5 of Title 3, United States
Code.--
(1) Authority.--Not later than 45 days after the Secretary
prescribes any regulation under subsection (a)(1)(A), the
President (or the designee of the President) shall prescribe
such regulations as may be necessary to carry out this Act with
respect to covered individuals described in section 2(7)(A)(iv)
and other individuals affected by employers described in
section 2(10)(A)(i)(IV), including individuals who are covered
individuals described in section 2(7)(B) with respect to such
employers.
(2) Agency regulations.--The regulations prescribed under
paragraph (1) shall be the same as substantive regulations
promulgated by the Secretary under subsection (a)(1)(A) except
insofar as the President (or designee) may determine, for good
cause shown and stated together with the regulations prescribed
under paragraph (1), that a modification of such regulations
would be more effective for the implementation of the rights
and protections involved under this section.
(d) Employees Covered by Chapter 63 of Title 5, United States
Code.--
(1) Authority.--Not later than 45 days after the Secretary
prescribes any regulation under subsection (a)(1)(A), the
Director of the Office of Personnel Management shall prescribe
such regulations as may be necessary to carry out this Act with
respect to covered individuals described in section 2(7)(A)(v)
and other individuals affected by employers described in
section 2(10)(A)(i)(V), including individuals who are covered
individuals described in section 2(7)(B) with respect to such
employers.
(2) Agency regulations.--The regulations prescribed under
paragraph (1) shall be the same as substantive regulations
promulgated by the Secretary under subsection (a)(1)(A) except
insofar as the Director may determine, for good cause shown and
stated together with the regulations prescribed under paragraph
(1), that a modification of such regulations would be more
effective for the implementation of the rights and protections
involved under this section.
SEC. 7. WHISTLEBLOWER PROTECTIONS.
No employer shall discriminate or retaliate (including through
intimidation, threats, coercion, or harassment) against any covered
individual of the employer--
(1) for exercising, or attempting to exercise, any right
provided under this Act; or
(2) because the covered individual (or another individual
acting at the request of the covered individual) has--
(A) filed a written or oral complaint to the
employer or a Federal, State, or local government
entity of a violation of section 3 or 4;
(B) sought assistance or intervention with respect
to a worker privacy-related concern from the employer,
a Federal, State, or local government, or a worker
representative;
(C) instituted, caused to be instituted, or
otherwise participated in any inquiry or proceeding
under or related to this Act;
(D) given, or is about to give, any information in
connection with any inquiry or proceeding relating to
any right provided under this Act; or
(E) testified, or is about to testify, in any
inquiry or proceeding relating to any right provided
under this Act.
SEC. 8. ENFORCEMENT.
(a) In General.--
(1) Definition.--For purposes of this subsection:
(A) Covered individual.--The term ``covered
individual'' means a covered individual--
(i) described in section 2(7)(A) (other
than covered individuals described in clauses
(iii) through (v) of such section); or
(ii) described in section 2(7)(B) with
respect to an employer.
(B) Employer.--The term ``employer'' means an
employer described in subclause (I) or (II) of section
2(10)(A)(i).
(2) Enforcement by the privacy and technology division.--
(A) Investigation.--
(i) In general.--To ensure compliance with
the provisions of this Act, or any regulation
or order issued under this Act, the Secretary,
acting through the Administrator--
(I) shall have the investigative
authority provided under section 11(a)
of the Fair Labor Standards Act of 1938
(29 U.S.C. 211(a)), with respect to
employers, covered individuals, and
third parties and service providers
with respect to employers; and
(II) may require, by general or
special orders, an employer or third
party or service provider with respect
to the employer, to file with the
Secretary, in such form as the
Secretary may prescribe, annual or
special reports or answers in writing
to specific questions, furnishing to
the Secretary such information or
records as the Secretary may require as
to the organization, business, conduct,
practices, management, and relation to
other corporations, partnerships, and
individuals, of the employer.
(ii) Reports and answers.--An employer or
third party or service provider with respect to
the employer shall file the reports and answers
(including information and records) required
under clause (i)(II) in such manner, including
under oath or otherwise, and within such
reasonable time period as the Secretary may
require.
(iii) Joint investigations.--The Secretary,
acting through the Administrator, may conduct
investigations and make requests for
information, as authorized under this Act, on a
joint basis with another Federal agency, a
State attorney general, or a State agency.
(iv) Obligation to keep, preserve, and make
available records.--An employer or third party
or service provider with respect to the
employer shall make, keep, preserve, and make
available to the Secretary records pertaining
to compliance with this Act in accordance with
section 11(c) of the Fair Labor Standards Act
of 1938 (29 U.S.C. 211(c)) and in accordance
with any regulation or order issued by the
Secretary.
(B) Enforcement.--With respect to employers,
covered individuals, and third parties and service
providers with respect to employers, the Secretary,
acting through the Administrator, shall receive,
investigate, and attempt to resolve complaints of
violations of section 3, 4, or 7 in the same manner
that the Secretary receives, investigates, and attempts
to resolve complaints of violations of sections 6 and 7
of the Fair Labor Standards Act of 1938 (29 U.S.C. 206
and 207).
(C) Priority.--For purposes of subparagraphs (A)
and (B), the Secretary shall prioritize industries with
high rates of workplace surveillance and at high risk
of workplace-surveillance-related health impacts.
(D) Referral for criminal proceedings.--If the
Secretary, in the course of the performance of any act
or duty under this Act, obtains evidence that any
employer has engaged in conduct that may constitute a
violation of Federal criminal law, the Secretary shall
refer the matter to the Attorney General for
prosecution under any applicable law. Nothing in this
paragraph shall affect any other authority of the
Secretary to disclose information.
(E) Litigation.--The Solicitor of Labor may appear
for and represent the Secretary on any litigation
brought under this subsection.
(3) Private right of action.--
(A) In general.--
(i) Covered individual.--Notwithstanding
any action by the Secretary under paragraph
(2)(B), any covered individual adversely
affected by an alleged violation of section 3,
4, or 7, may commence a civil action against
any person that violates such section in any
Federal court of competent jurisdiction.
(ii) Labor organization.--Notwithstanding
any action by the Secretary under paragraph
(2)(B), any labor organization adversely
affected by an alleged violation of 4 or 7 may
commence a civil action against any person that
violates such section in any Federal court of
competent jurisdiction.
(B) Relief.--
(i) In general.--In a civil action brought
under subparagraph (A) in which the covered
individual or labor organization prevails, the
court may award the covered individual or labor
organization--
(I) damages of--
(aa) an amount equal to the
sum of any actual damages
sustained by the covered
individual; or
(bb) not more than treble
damages;
(II) statutory damages described in
clause (iv);
(III) injunctive relief; and
(IV) equitable relief.
(ii) Attorney's fees.--In a civil action
brought under subparagraph (A) in which the
covered individual or labor organization
prevails, the court shall award the covered
individual or labor organization reasonable
attorney's fees and litigation costs.
(iii) Temporary relief for
whistleblowers.--In a civil action brought
under subparagraph (A) regarding a violation of
section 7, the court may award the covered
individual or labor organization temporary
relief while the case is pending, including
reinstatement.
(iv) Statutory damages.--The court may, in
accordance with clause (v), award statutory
damages under clause (i)(II) against a person
in the following amounts:
(I) Failure to comply with
disclosure requirements.--For a
violation of section 3, the court may
award--
(aa) for the first such
violation, damages of an amount
not more than $500 for each
covered individual impacted;
and
(bb) for any subsequent
violation, damages for each
covered individual impacted in
an amount of not more than $500
more than the amount of the
damages awarded per covered
individual for the violation
immediately preceding such
subsequent violation.
(II) Using surveillance data for
prohibited activities.--For each
violation of section 4, the court may
award--
(aa) damages of an amount
not less than $5,000 and not
more than $20,000; or
(bb) for any willful or
repeated violation, damages of
an amount not less than $10,000
and not more than $40,000.
(III) Retaliation on
whistleblowers.--For each violation of
section 7, the court may award--
(aa) damages of an amount
not less than $5,000 and not
more than $50,000; or
(bb) for any willful or
repeated violation, damages of
an amount not less than $10,000
and not more than $100,000.
(v) Considerations for statutory damages.--
In determining the amount of statutory damages
assessed under clause (iv), the court shall
consider any relevant circumstances presented
by the parties to the action, including--
(I) the nature and seriousness of
the violation;
(II) the number of violations;
(III) the persistence of the
misconduct;
(IV) the length of time over which
the misconduct occurred;
(V) the willfulness of the
misconduct of person; and
(VI) the assets, liabilities, and
net worth of the person.
(C) Rights of the secretary and a state attorney
general.--Prior to an covered individual or labor
organization bringing a civil action under subparagraph
(A), such covered individual or labor organization
shall, in writing, notify the Secretary and any
relevant State attorney general of the intent to
commence such civil action. Upon receiving such notice,
the Secretary and State attorney general shall each,
not later than 60 days after receiving such notice--
(i) determine whether to intervene in such
action and, upon intervening--
(I) be heard on all matters arising
in such action; and
(II) file petitions for appeal of a
decision in such action; and
(ii) notify such covered individual or
labor organization.
(D) Remedies for state employees.--
(i) Waiver of sovereign immunity.--A
State's receipt or use of Federal financial
assistance for any program or activity of a
State shall constitute a waiver of sovereign
immunity, under the 11th Amendment to the
Constitution of the United States or otherwise,
to a suit brought by a covered individual of
that program or activity, or a labor
organization representing such a covered
individual, under this paragraph for equitable,
legal, or other relief authorized under this
paragraph.
(ii) Official capacity.--An official of a
State may be sued in the official capacity of
the official by any covered individual or such
a labor organization who has complied with the
procedures under this paragraph, for injunctive
relief that is authorized under this paragraph.
In such a suit the court may award to the
prevailing party those costs authorized by
section 722 of the Revised Statutes (42 U.S.C.
1988).
(iii) Applicability.--With respect to a
particular program or activity, clause (i)
applies to conduct that occurs--
(I) after the date of enactment of
this Act; and
(II) on or after the day on which a
State first receives or uses Federal
financial assistance for that program
or activity.
(iv) Definition of program or activity.--In
this subparagraph, the term ``program or
activity'' has the meaning given the term in
section 606 of the Civil Rights Act of 1964 (42
U.S.C. 2000d-4a).
(E) Remedies for tribal government employees.--
(i) Waiver of sovereign immunity.--A Tribal
government's receipt or use of Federal
financial assistance for any program or
activity of the Tribal government shall
constitute a waiver of sovereign immunity to a
suit brought by a covered individual of that
program or activity, or a labor organization
representing such a covered individual, under
this paragraph for equitable, legal, or other
relief authorized under this paragraph.
(ii) Official capacity.--An official of a
Tribal government may be sued in the official
capacity of the official by any covered
individual or such a labor organization who has
complied with the procedures under this
paragraph for injunctive relief that is
authorized under this paragraph. In such a suit
the court may award to the prevailing party
those costs authorized by section 722 of the
Revised Statutes (42 U.S.C. 1988).
(iii) Applicability.--With respect to a
particular program or activity, clause (i)
applies to conduct that occurs--
(I) after the date of enactment of
this Act; and
(II) on or after the day on which a
Tribal government first receives or
uses Federal financial assistance for
that program or activity.
(iv) Definition of program or activity.--In
this subparagraph, the term ``program or
activity'' has the meaning given the term in
section 606 of the Civil Rights Act of 1964 (42
U.S.C. 2000d-4a).
(4) Enforcement by the government accountability office and
library of congress.--Notwithstanding any other provision of
this subsection, in the case of the Government Accountability
Office and the Library of Congress, the authority of the
Secretary under this subsection shall be exercised respectively
by the Comptroller General of the United States and the
Librarian of Congress, respectively.
(b) Employees Covered by Congressional Accountability Act of
1995.--The powers, remedies, and procedures provided in the
Congressional Accountability Act of 1995 (2 U.S.C. 1301 et seq.) to the
Board (as defined in section 101 of that Act (2 U.S.C. 1301)), or any
person, alleging a violation of section 202(a)(1) of that Act (2 U.S.C.
1312(a)(1)) shall be the powers, remedies, and procedures this Act
provides to that Board, or any person, with regard to an allegation of
a violation of section 3, 4, or 7 against a covered individual
described in section 2(7)(A)(iii) or described in section 2(7)(B) with
respect to an employer described in section 2(10)(A)(i)(III).
(c) Employees Covered by Chapter 5 of Title 3, United States
Code.--The powers, remedies, and procedures provided in chapter 5 of
title 3, United States Code, to the President, the Merit Systems
Protection Board, or any person, alleging a violation of section
412(a)(1) of that title, shall be the powers, remedies, and procedures
this Act provides to the President, that Board, or any person,
respectively, with regard to an allegation of a violation of section 3,
4, or 7 against a covered individual described in section 2(7)(A)(iv)
or described in section 2(7)(B) with respect to an employer described
in section 2(10)(A)(i)(IV).
(d) Employees Covered by Chapter 63 of Title 5, United States
Code.--The powers, remedies, and procedures provided in title 5, United
States Code, to an employing agency, provided in chapter 12 of that
title to the Merit Systems Protection Board, or provided in that title
to any person, alleging a violation of chapter 63 of that title, shall
be the powers, remedies, and procedures this Act provides to that
agency, that Board, or any person, respectively, with regard to an
allegation of a violation of section 3, 4, or 7 against a covered
individual described in section 2(7)(A)(v) or described in section
2(7)(B) with respect to an employer described in section
2(10)(A)(i)(V).
(e) Enforcement by States.--
(1) In general.--In any case in which a State attorney
general or a State privacy regulator has reason to believe that
an interest of the residents of a State has been or is
adversely affected by any person who violates any provision of
section 3, 4, or 7, including a regulation or order prescribed
under this Act, the State attorney general or State privacy
regulator, as parens patriae, may bring a civil action on
behalf of the residents of the State in an appropriate State
court or an appropriate district court of the United States
to--
(A) enjoin further violation of such provision by
the person;
(B) compel compliance with such provision;
(C) obtain damages, civil penalties, restitution,
or other compensation on behalf of the residents of the
State; or
(D) obtain reasonable attorney's fees and other
litigation costs reasonably incurred.
(2) Rights of agency.--Before initiating a civil action
under paragraph (1), the State attorney general or State
privacy regulator, as the case may be, shall notify the
Secretary in writing of such civil action. Upon receiving such
notice, the Secretary may--
(A) intervene in such action; and
(B) upon intervening--
(i) be heard on all matters arising in such
civil action; and
(ii) file petitions for appeal of a
decision in such action.
(3) Preemptive action by agency.--In any case in which a
civil action is instituted by or on behalf of the Secretary for
violation of this Act or a regulation promulgated under this
Act, a State attorney general or State privacy regulator may
not, during the pendency of such action, institute a civil
action against any defendant named in the complaint in the
action instituted by or on behalf of the Secretary for a
violation that is alleged in such complaint. In a case brought
by the Secretary that affects the interests of a State, the
State attorney general or State privacy regulator may intervene
as of right pursuant to the Federal Rules of Civil Procedure.
(4) Preservation of state powers.--Except as provided in
paragraph (3), no provision of this subsection shall be
construed as altering, limiting, or affecting the authority of
a State attorney general or State privacy regulator to--
(A) bring an action or other regulatory proceeding
arising solely under the laws in effect in that State;
or
(B) exercise the powers conferred on the State
attorney general or State privacy regulator by the laws
of the State, including the ability to conduct
investigations, administer oaths or affirmations, or
compel the attendance of witnesses or the production of
documentary or other evidence.
(f) Liability of an Employer for a Violation by a Third Party or
Service Provider That the Employer Uses for Workplace Surveillance.--A
violation of section 4 by a third party or service provider that the
employer uses for workplace surveillance shall be considered a
violation of such section by the employer if the employer knew or
should have known about such violation.
(g) Arbitration and Class Action.--Notwithstanding any other
provision of law, no predispute arbitration agreement or predispute
joint-action waiver shall be valid or enforceable with respect to any
alleged violation of section 3, 4, or 7.
SEC. 9. REPORT TO CONGRESS ON WORKPLACE SURVEILLANCE.
The Secretary, acting through the Administrator, shall--
(1) using technologists and subject matter experts, conduct
a study on workplace surveillance on covered individuals by
employers, including such workplace surveillance through
technological means; and
(2) not later than 1 year after the date of enactment of
this Act, and annually thereafter, submit to Congress, and make
publicly available, a report on the findings of the study under
paragraph (1), including any recommendations for the President
and Congress targeted at reducing harms related to workplace
surveillance on covered individuals.
SEC. 10. COORDINATION.
In carrying out this Act, the Secretary, acting through the
Administrator, shall coordinate with any appropriate Federal agency or
State regulator to promote consistent regulatory treatment of workplace
surveillance.
SEC. 11. RELATION TO OTHER LAWS.
Except as explicitly provided otherwise, nothing in this Act shall
be construed to preempt, modify, limit, or supersede--
(1) any provision of Federal or State law; or
(2) the authority of the Federal Trade Commission, Equal
Employment Opportunity Commission, National Labor Relations
Board, or any other Federal agency.
SEC. 12. SEVERABILITY.
If any provision of this Act or the application of such provision
to any person or circumstance is held to be unconstitutional, the
remainder of this Act and the application of the provisions of such to
all other persons or circumstances shall not be affected thereby.
<all>
Introduced in Senate
Read twice and referred to the Committee on Health, Education, Labor, and Pensions.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line