S. 4831

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4831 Introduced in Senate (IS)]

<DOC>

119th CONGRESS
2d Session
S. 4831

To prohibit, or require disclosure of, the surveillance, monitoring, 
and collection of certain worker data by employers, and for other 
purposes.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

June 18, 2026

Mr. Markey (for himself, Mr. Schatz, Mr. Sanders, Ms. Baldwin, Ms. 
Warren, Mr. Blumenthal, Mr. Fetterman, and Mr. Booker) introduced the 
following bill; which was read twice and referred to the Committee on 
Health, Education, Labor, and Pensions

_______________________________________________________________________

A BILL

To prohibit, or require disclosure of, the surveillance, monitoring, 
and collection of certain worker data by employers, and for other 
purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Stop Spying Bosses Act''.

SEC. 2. DEFINITIONS.

For purposes of this Act:
(1) Administrator.--The term ``Administrator'' means the 
Administrator of the Worker Protection and Technology Division 
established under section 6.
(2) Aggregated data.--The term ``aggregated data'' means 
data with respect to covered individuals of an employer that 
the employer has combined or collected together in a summary or 
other form that prevents the identification of any specific 
individual.
(3) Applicant.--The term ``applicant'', with respect to an 
employer, means an individual who applies, or applied, to be 
employed by, or otherwise perform work for remuneration for, 
the employer.
(4) Automated decision system.--
(A) In general.--The term ``automated decision 
system'' means any system, software, or process 
(including such a system, software, or process derived 
from machine learning, statistics, or other data 
processing or artificial intelligence techniques) 
that--
(i) uses computation to produce a 
prediction, score, ranking, recommendation, 
decision, evaluation, metric, conclusion, 
inference, or profile; and
(ii) is not passive computing 
infrastructure.
(B) Passive computing infrastructure.--For purposes 
of this paragraph, the term ``passive computing 
infrastructure'' means any intermediary technology that 
does not influence or determine the outcome of a 
decision, make or aid in a decision (including through 
evaluations, metrics, or scoring), inform policy 
implementation, or collect data or observations, 
including web hosting, domain registration, networking, 
caching, data storage, or cybersecurity.
(5) Biometric information.--
(A) In general.--The term ``biometric information'' 
means any information generated from the technological 
processing of an individual's unique biological, 
physical, or physiological characteristics that is 
linked or reasonably linkable to an individual, 
including--
(i) fingerprints;
(ii) voice prints;
(iii) iris or retina scans;
(iv) facial or hand mapping, geometry, or 
templates; or
(v) gait or personally identifying physical 
movements.
(B) Exclusion.--The term ``biometric information'' 
does not include--
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) information generated from a digital 
or physical photograph, or an audio or video 
recording, that cannot be used to identify an 
individual.
(6) Collect.--The term ``collect'' means, with respect to 
employee data, to buy, rent, gather, obtain, receive, access, 
or otherwise acquire employee data by any means.
(7) Covered individual.--The term ``covered individual'', 
with respect to an employer, means an individual--
(A) who is employed by, or otherwise performing 
work for remuneration for the employer, including such 
an individual who is--
(i) any individual performing work for 
remuneration for an employer described in 
clauses (i)(I) and (ii) of paragraph (9)(A);
(ii) any individual performing work for 
remuneration for an entity described in clauses 
(i)(II) and (ii) of paragraph (9)(A);
(iii) any individual performing work for 
remuneration for an employing office described 
in clauses (i)(III) and (ii) of paragraph 
(9)(A);
(iv) any individual performing work for 
remuneration for an employing office described 
in clauses (i)(IV) and (ii) of paragraph 
(9)(A); or
(v) any individual performing work for 
remuneration for an employing agency described 
in clauses (i)(V) and (ii) of paragraph (9)(A) 
who is not covered under clause (iv); or
(B) who is an applicant to the employer.
(8) Employ.--The term ``employ'' has the meaning given such 
term in section 3 of the Fair Labor Standards Act of 1938 (29 
U.S.C. 203).
(9) Employer.--
(A) In general.--The term ``employer'' means any 
person who is--
(i)(I) a covered employer who is not 
described in any other subclause of this 
clause;
(II) an entity employing a State employee 
described in section 304(a) of the Government 
Employee Rights Act of 1991 (42 U.S.C. 2000e-
16c(a));
(III) an employing office, as defined in 
section 101 of the Congressional Accountability 
Act of 1995 (2 U.S.C. 1301);
(IV) an employing office, as defined in 
section 411(c) of title 3, United States Code; 
or
(V) an employing agency covered under 
subchapter V of chapter 63 of title 5, United 
States Code; and
(ii) engaged in commerce (including 
government), or an industry or activity 
affecting commerce (including government).
(B) Covered employer.--In subparagraph (A), the 
term ``covered employer''--
(i) means any person engaged in commerce or 
in any industry or activity affecting commerce 
who employs or otherwise engages for the 
performance of work for remuneration, 11 or 
more covered individuals;
(ii) includes--
(I) any person who acts, directly 
or indirectly, in the interest of a 
covered employer in relation to any 
individual performing work for 
remuneration for such covered employer;
(II) any successor in interest of a 
covered employer;
(III) any public agency; and
(IV) the Government Accountability 
Office and the Library of Congress; and
(iii) does not include any labor 
organization (other than when acting as an 
employer) or anyone acting in the capacity of 
officer or agent of such labor organization.
(C) Public agency.--For purposes of this paragraph, 
a public agency shall be considered to be a person 
engaged in commerce or in an industry or activity 
affecting commerce.
(D) Definitions.--For purposes of this paragraph, 
the terms ``commerce'', ``person'', and ``public 
agency'' have the meanings given the terms in section 3 
of the Fair Labor Standards Act of 1938 (29 U.S.C. 
203).
(10) Employee data.--The term ``employee data'', with 
respect to a covered individual, means any information that 
identifies, relates to, describes, is reasonably capable of 
being associated with, or could reasonably be linked, directly 
or indirectly, with the covered individual, regardless of how 
the information is collected, inferred, or obtained, 
including--
(A) personally identifiable information with 
respect to the covered individual, including any name, 
contact information, government-issued identification 
number, financial information, criminal background, 
location information, photographs, biometric 
information, or employment history associated with the 
covered individual; and
(B) any information related to the workplace 
activities with respect to the covered individual, 
including--
(i) human resources information, including 
the contents of a personnel file or performance 
evaluation;
(ii) work process information, such as 
productivity and efficiency information and 
information on breaks;
(iii) information that captures workplace 
communications and interactions, including 
emails, texts, internal message boards, and 
customer interaction and ratings;
(iv) device usage and information, 
including calls placed or precise geolocation 
information;
(v) audio-video information and other 
information collected from sensors, including 
movement tracking, images, videos, and thermal-
sensor information;
(vi) biometric information;
(vii) information from a personality test 
taken by a covered individual, including such a 
test given electronically at the beginning of 
or during a work shift;
(viii) inputs for an automated decision 
system or any automated decision system output;
(ix) information that is collected or 
generated to mitigate the spread of infectious 
diseases, including COVID-19, or to comply with 
any public health measure; and
(x) online information, including a covered 
individual's internet protocol address, private 
social media activity, or other digital sources 
or unique identifiers associated with a covered 
individual.
(11) Government entity.--The term ``government entity'' 
means--
(A) a Federal agency (as such term is defined in 
section 3371 of title 5, United States Code);
(B) a State or political subdivision thereof;
(C) any agency, authority, or instrumentality of a 
State or political subdivision thereof; or
(D) a Tribal government or political subdivision 
thereof.
(12) Indian tribe.--The term ``Indian Tribe'' means any 
Indian or Alaska Native tribe, band, nation, pueblo, village, 
community, component band, or component reservation 
individually identified (including parenthetically) in the list 
published most recently as of the date of enactment of this Act 
pursuant to section 104 of the Federally Recognized Indian 
Tribe List Act of 1994 (25 U.S.C. 5131).
(13) Labor organization.--The term ``labor organization'' 
has the meaning given the term in section 2(5) of the National 
Labor Relations Act (29 U.S.C. 152(5)), except that such term 
shall also include--
(A) any organization composed of labor 
organizations, such as a labor union federation or a 
State or municipal labor body; and
(B) any organization which would be included in the 
definition for such term under such section 2(5) but 
for the fact that the organization represents--
(i) individuals employed by the United 
States, any wholly owned Government 
corporation, any Federal Reserve Bank, or any 
State or political subdivision thereof;
(ii) individuals employed by persons 
subject to the Railway Labor Act (45 U.S.C. 151 
et seq.); or
(iii) individuals employed as agricultural 
laborers.
(14) Periodic assessment of worker performance.--The term 
``periodic assessment of worker performance'' means assessing 
worker performance over the course of units of time equal to or 
greater than one calendar day.
(15) Precise geolocation information.--
(A) In general.--The term ``precise geolocation 
information'' means information that is derived from a 
device or technology that reveals the past or present 
physical location of an individual or a device that 
identifies or is linked or reasonably linkable to 1 or 
more individuals, with sufficient precision to identify 
street level location information of the individual or 
device or the location of the individual or device 
within a range of 1,850 feet or less.
(B) Exclusion.--The term ``precise geolocation 
information'' does not include information described in 
subparagraph (A) identifiable or derived solely from 
the visual content of a legally obtained image, 
including the location of the device that captured such 
image.
(16) Predispute arbitration agreement.--The term 
``predispute arbitration agreement'' means any agreement to 
arbitrate a dispute that has not yet arisen at the time of the 
making of the agreement.
(17) Predispute joint-action waiver.--The term ``predispute 
joint-action waiver'' means an agreement, whether or not part 
of a predispute arbitration agreement, that would prohibit, or 
waive the right of, one of the parties to the agreement to 
participate in a joint, class, or collective action in a 
judicial, arbitral, administrative, or other forum, concerning 
a dispute that has not yet arisen at the time of the making of 
the agreement.
(18) Secretary.--The term ``Secretary'' means the Secretary 
of Labor.
(19) Sell.--The term ``sell'', with respect to employee 
data, means the transfer of such employee data for monetary 
consideration or for a thing of value.
(20) Service provider.--The term ``service provider'', with 
respect to an employer, means a person that--
(A) collects, processes, conveys, or maintains 
employee data with respect to such employer only at the 
direction of, in accordance with the direction of, and 
pursuant to a written contract with the employer 
(including any terms of service or service agreements);
(B) does not earn revenue from such collection, 
processing, conveyance, or maintenance of such employee 
data, except from the employer by providing contracted 
services to the employer with regard to such 
collection, processing, conveyance, or maintenance of 
such employee data; and
(C) does not combine or link data associated with 
such employer with data associated with another 
employer.
(21) State.--The term ``State'' means each of the several 
States of the United States, the District of Columbia, or any 
territory or possession of the United States.
(22) State attorney general.--The term ``State attorney 
general'' means--
(A) with respect to a State, the attorney general 
or chief law enforcement officer of the State, or 
another official or agency designated by the State to 
bring civil actions on behalf of the State or the 
residents of the State; and
(B) with respect to a Tribal government, the 
attorney general or chief law enforcement officer of 
the Tribal government, or another official or agency 
designated by the Tribal government to bring civil 
actions on behalf of the Tribal government or the 
Indian Tribe of the Tribal government.
(23) State privacy regulator.--The term ``State privacy 
regulator'' means--
(A) the chief consumer protection officer of a 
State; or
(B) a State consumer protection agency with 
expertise in data protection, including the California 
Privacy Protection Agency.
(24) Technologist.--The term ``technologist'' means an 
individual with experience in fields related to computational 
technology, or the technology industry that produces 
computational technology, such as advertising technology, 
application development, artificial intelligence, computer 
science, cybersecurity, data science, digital forensics, human-
centered design, product management, prototyping, service 
design, socio-technical systems, software engineering, user 
experience, or privacy rights, civil liberties, or civil rights 
related to technology.
(25) Third party.--The term ``third party'', with respect 
to an employer, means a person or entity that is not--
(A) such employer;
(B) a service provider of such employer with 
respect to the employee data being transferred; or
(C) a government entity.
(26) Transfer.--The term ``transfer'', with respect to 
employee data, means releasing, sharing, leasing, 
disseminating, disclosing, making available, or otherwise 
causing to be communicated such employee data.
(27) Tribal government.--The term ``Tribal government'' 
means the recognized governing body of an Indian Tribe.
(28) Work-related decision.--The term ``work-related 
decision'' includes a decision by an employer with regard to--
(A) hiring or engaging a covered individual 
(including any decision with regard to recruiting, 
screening, interviewing, reviewing, or selecting an 
applicant);
(B) firing, retaining, taking a disciplinary action 
against, demoting, deactivating, or reassigning duties 
of a covered individual; or
(C) any other term, condition, or privilege of 
employment or other work of the covered individual, 
such as relating to wages, wage setting, work hours, 
scheduling, attendance requirements, workload, 
performance standards, assignment of work, access to 
work and training opportunities, productivity 
requirements, promotion, workplace health and safety, 
health care or long-term care coverage, or other 
benefits.

SEC. 3. EMPLOYEE DATA MINIMIZATION.

(a) Employee Data Collection and Usage Prohibitions.--
(1) In general.--Except as otherwise required by law, an 
employer or, as applicable, a service provider of the employer 
may not collect or use employee data--
(A) to identify any covered individual to determine 
if they have or intend to form, join, assist, or seek 
to form, join, or assist, a labor organization;
(B) to monitor the activities of any covered 
individual concerning or related to a labor 
organization or with respect to engaging in protected 
concerted activity;
(C) to ascertain any political opinion or activity, 
religious view, or other identity marker of the covered 
individual, that is unrelated to the performance of the 
job duties of the covered individual for the employer;
(D) to identify the health status, any health 
condition, or disability status of a covered individual 
that is unrelated to the performance of the job duties 
of the covered individual for the employer;
(E) to ascertain the immigration status of a 
covered individual;
(F) to monitor the activities of any covered 
individual concerning or related to reporting the 
employer, or a third party or service provider of the 
employer, for a violation of any other law, including 
monitoring for purposes of identifying a covered 
individual who has reported or intends to report the 
employer or such a third party or service provider;
(G) to predict any behavior, emotion, or belief of 
a covered individual that is unrelated to the work of 
the covered individual for the employer; or
(H) to threaten the mental or physical health of 
the covered individual.
(2) Off duty employee data collection.--An employer or, as 
applicable, a service provider of the employer may not collect 
employee data regarding a covered individual while the covered 
individual is off-duty, including when the covered individual 
is off-duty in--
(A) a break room or in a sensitive area, such as a 
restroom or locker room;
(B) a location provided for the covered individual 
to express breast milk;
(C) a location provided for the covered individual 
to pray or participate in a religious activity; or
(D) the home of the covered individual or an 
alternative location where work is performed that is 
not the worksite of the employer.
(b) Permissible Employee Data Collection.--An employer or, as 
applicable, a service provider of the employer may collect employee 
data with respect to a covered individual only if--
(1) the collection of employee data is not otherwise 
prohibited by subsection (a);
(2) the employee data is primarily used--
(A) to allow the covered individual to accomplish 
an essential job function;
(B) to ensure the quality of goods and services;
(C) to conduct a periodic assessment of worker 
performance;
(D) to ensure compliance with employment, labor, or 
other relevant laws;
(E) to protect the health, safety, or security of a 
covered individual or the security of a facility or 
computer network of the employer; or
(F) to administer wages or benefits to a covered 
individual;
(3) the employee data is collected and used solely for a 
purpose disclosed by the employer in accordance with section 
4(a)(1)(G);
(4) the collection of employee data is strictly necessary 
to accomplish such a purpose, exclusively used to accomplish 
the purpose, and is the least invasive means to the covered 
individual that could be used to accomplish the purpose;
(5) the collection of employee data is limited to the 
fewest covered individuals needed for such collection;
(6) the least amount of employee data is collected;
(7) employee data is collected no more frequently than is 
necessary to accomplish the purpose; and
(8) the employee data is only retained by the employer or, 
as applicable, the service provider for only as long as it is 
reasonably necessary for the purpose and, except as otherwise 
required to be retained by law, is deleted by the employer on 
the date that is 3 years after the date of--
(A) the separation of the covered individual from 
employment by or engagement for work with the employer; 
or
(B) in the case of a covered individual who is an 
applicant that was not employed by or otherwise engaged 
for work for remuneration by the employer, the 
discontinuation of the application process of the 
covered individual.
(c) Transfer of Employee Data.--
(1) Prohibition on selling.--An employer or, as applicable, 
a service provider of the employer may not sell or license 
employee data on a covered individual to any person (including 
a service provider of the employer).
(2) Transfer restrictions to a service provider.--Except as 
otherwise required by law, an employer or, as applicable, a 
service provider of the employer may not transfer employee data 
on a covered individual to any service provider of the employer 
unless, for each instance of a transfer--
(A) the employer or the service provider making the 
transfer--
(i) discloses the transfer to the covered 
individual; and
(ii) provides cybersecurity protections and 
encryption for the employee data; and
(B) the covered individual opts in to the instance 
of the transfer.
(3) Transfer prohibition to a third party.--An employer or, 
as applicable, a service provider of the employer may not 
transfer employee data on a covered individual to a third 
party, except as otherwise required by law.
(d) Employer Contracts With Service Providers That Collect Employee 
Data.--A service provider of an employer that collects or uses employee 
data regarding covered individuals of the employer shall include in any 
contract between the employer and service provider entered into after 
the effective date of this section an agreement to comply with the 
requirements of this section.
(e) Effective Date.--This section shall take effect on the date 
that is 60 days after the date of enactment of this Act.

SEC. 4. DISCLOSURE OF EMPLOYEE DATA COLLECTED.

(a) In General.--An employer shall disclose, in accordance with 
subsections (b) and (c), to each covered individual and publish in a 
manner that is conspicuous, freely accessible, and readily available 
for viewing by any such covered individual of the employer (including 
on the internet in a manner that is freely accessible and machine 
readable (in a form prescribed by the Secretary))--
(1) any employee data collected on the covered individual 
by the employer, including--
(A) what employee data are being collected;
(B) how the employee data are being collected;
(C) where and when the employee data are being 
collected;
(D) the frequency of the employee data collection;
(E) where the employee data is stored;
(F) who has access to the employee data;
(G) the purposes for which the employee data are 
being collected and used; and
(H) as applicable, the identity of any third party 
or service provider--
(i) used for such employee data collection;
(ii) to which employee data is transferred; 
and
(iii) from which employee data of the 
covered individual is or may be purchased or 
acquired; and
(2) how such employee data affects work-related decisions 
by the employer, including with regard to the assessment of the 
performance and productivity of the covered individual.
(b) Timing of Disclosure.--
(1) Initial disclosure.--An employer shall provide the 
disclosure required under subsection (a) as follows:
(A) Covered individuals other than applicants.--
With respect to covered individuals other than 
applicants, in the case of--
(i) such a covered individual hired by the 
employer on or after the effective date of this 
section, to the covered individual upon hiring 
the covered individual; or
(ii) such a covered individual who is 
employed by, or otherwise performing work for 
remuneration for, the employer on such 
effective date but was hired before such 
effective date, to the covered individual not 
later than 30 days after such effective date.
(B) Applicants.--With respect to a covered 
individual who is an applicant on or after the 
effective date of this section, to such an applicant 
before the employer accepts an application by the 
applicant to be employed by, or otherwise perform work 
for remuneration for, the employer.
(2) Updated disclosures.--With respect to a covered 
individual who received a disclosure under paragraph (1)(A) by 
an employer or a covered individual who received a disclosure 
under paragraph (1)(B) by an employer and is still in the 
applicant process, the employer shall provide an updated 
disclosure to the covered individual--
(A) not less than 7 days before implementing 
changes to practices disclosed in the disclosure; or
(B) immediately upon any new information required 
to be provided in such a disclosure becoming available.
(c) Procedures for Disclosure.--An employer shall provide the 
disclosure required under subsection (a) in a manner required by the 
Administrator that is--
(1) accessible to people with disabilities;
(2) in plain language and in the primary language of the 
covered individual provided the disclosure;
(3) in writing and available electronically;
(4) tailored to the purpose of the disclosure;
(5) tailored to the job functions of the covered 
individual; and
(6) tailored to the level of risk.
(d) Effective Date.--This section shall take effect on the date 
that is 60 days after the date of enactment of this Act.

SEC. 5. EMPLOYEE DATA ACCESS AND ACCURACY.

(a) Employee Data Access and Correction.--
(1) In general.--An employer shall enable a covered 
individual (in a manner that verifies and protects the identity 
of the covered individual), upon request by the covered 
individual or as provided in subsection (b), to--
(A) not later than 30 days after such request or as 
provided in such subsection, obtain any employee data 
collected by the employer on the covered individual; 
and
(B) in accordance with procedures established by 
the Administrator, have any such employee data that is 
incomplete or erroneous updated or corrected at any 
time.
(2) Rule of interpretation.--The failure of a covered 
individual to make a request under paragraph (1) shall not be 
interpreted to provide a defense for the employer of the 
covered individual with respect to any allegation of a 
violation of any requirement under this Act by the employer.
(b) Work-Related Decisions.--An employer that makes a work-related 
decision with regard to a covered individual using employee data--
(1) shall, upon alerting the covered individual about such 
work-related decision, disclose to the covered individual the 
categories of employee data used to make the work-related 
decision; and
(2) shall, for not less than 7 days after such disclosure, 
enable the covered individual to--
(A) review such employee data of the covered 
individual and related aggregated data for other 
similarly situated covered individuals of the employer;
(B) in accordance with the procedures described in 
subsection (a)(1)(B), have any employee data described 
in paragraph (1) that is incomplete or erroneous 
updated or corrected; and
(C) request that the employer reconsider the work-
related decision based on the updated or corrected 
employee data.
(c) Effective Date.--This section shall take effect on the date 
that is 60 days after the date of enactment of this Act.

SEC. 6. ESTABLISHMENT OF WORKER PROTECTION AND TECHNOLOGY DIVISION.

(a) In General.--There is established in the Department of Labor 
the Worker Protection and Technology Division.
(b) Administrator of the Worker Protection and Technology 
Division.--The President shall appoint an Administrator of the Worker 
Protection and Technology Division to head the Privacy and Technology 
Division.
(c) Employees and Advisory Boards of the Division.--
(1) In general.--The Administrator--
(A) may select, appoint, and employ, without regard 
to the provisions of sections 3309 through 3318 of 
title 5, United States Code, individuals, including 
technologists, directly to positions in the competitive 
service, as defined in section 2102 of such title, to 
carry out the duties of the Administrator under this 
Act; and
(B) may fix the compensation of the individuals 
described in subparagraph (A) without regard to chapter 
51 and subchapter III of chapter 53 of title 5, United 
States Code, relating to classification of positions 
and General Schedule pay rates, except that the rate of 
pay for such individuals may not exceed the rate 
payable for level V of the Executive Schedule under 
section 5316 of that title.
(2) Advisory boards.--
(A) Establishment.--The Administrator shall 
establish advisory boards to advise and consult with in 
the exercise of the functions of the Administrator 
under this Act and to provide information on emerging 
practices relating to the treatment of employee data by 
employers that are the following:
(i) The User Advisory Board, which shall be 
composed of experts in consumer protection, 
privacy, civil rights, disability law, labor 
organizations, and ethics.
(ii) The Research Advisory Board, which 
shall be composed of individuals with academic 
and research expertise in privacy, 
cybersecurity, computer science, innovation, 
design, ethics, economics, law, disability law, 
labor organizations and public policy and 
representatives of labor organizations.
(iii) The Product Advisory Board, which 
shall be composed of technologists, computer 
scientists, designers, product managers, 
attorneys, representatives of labor 
organizations, workplace technology experts, 
and other representatives of employers and 
employees.
(iv) The Labor Advisory Board, which shall 
be composed of representatives of labor 
organizations and representatives of workers.
(B) Appointments.--The Administrator shall appoint 
members to the advisory boards established under 
subparagraph (A) without regard to party affiliation.
(C) Meetings.--Each advisory board established 
under subparagraph (A) shall meet--
(i) at the call of the Administrator; and
(ii) not less than 2 times annually.
(D) Compensation and travel expenses.--A member of 
an advisory board established under subparagraph (A) 
who is not an officer or employee of the Federal 
Government shall--
(i) be entitled to receive compensation at 
a rate fixed by the Administrator while 
attending meetings of the advisory board, 
including travel time; and
(ii) receive travel expenses, including per 
diem in lieu of subsistence, in accordance with 
applicable provisions under subchapter I of 
chapter 57 of title 5, United States Code.
(E) Exemption from the federal advisory committee 
act.--Each advisory board established under 
subparagraph (A) shall be exempt from chapter 10 of 
title 5, United States Code (commonly known as the 
``Federal Advisory Committee Act'').
(3) Use of voluntary services.--The Administrator may, as 
may from time to time be needed, use any voluntary or 
uncompensated services.
(4) Attorneys.--Attorneys appointed under this subsection 
may appear for and represent the Administrator in any 
litigation.
(d) Offices.--
(1) In general.--The principal office of the Worker 
Protection and Technology Division shall be in the District of 
Columbia.
(2) Regional, local, and other offices.--The Administrator 
may establish regional, local, or other offices, including an 
office in the city of San Francisco, California, or the San 
Francisco Bay area in California.
(e) Orders and Guidance.--
(1) In general.--The Secretary, acting through the 
Administrator and the Administrator of the Wage and Hour 
Division, may issue orders and guidance, as may be necessary or 
appropriate to enable the Secretary to carry out the purposes 
and objectives of this Act, and to prevent evasions thereof.
(2) Consultation.--In issuing orders and guidance 
authorized under this subsection, the Secretary, acting through 
the Administrator and the Administrator of the Wage and Hour 
Division, may consult with Federal agencies that have 
jurisdiction over Federal privacy laws or expertise in privacy, 
including the Federal Trade Commission, and Federal agencies 
that have jurisdiction over labor and employment issues, 
including the Equal Employment Opportunity Commission, the 
National Labor Relations Board, the National Mediation Board, 
and the Merit Systems Protection Board.

SEC. 7. REGULATIONS.

(a) In General.--
(1) Authority.--
(A) In general.--Except as provided in paragraph 
(2), the Secretary, acting through the Administrator in 
consultation with the Administrator of the Wage and 
Hour Division, may prescribe such regulations as may be 
necessary to carry out this Act with respect to covered 
individuals described in section 2(7)(A) (other than 
covered individuals described in clauses (iii) through 
(v) of such section) and other individuals affected by 
employers described in subclause (I) or (II) of section 
2(9)(A)(i), including individuals who are covered 
individuals described in section 2(7)(B) with respect 
to such employers.
(B) Consultation.--In prescribing any regulations 
authorized under this paragraph, the Secretary, acting 
through the Administrator, may consult with Federal 
agencies that have jurisdiction over Federal privacy 
laws or expertise in privacy, including the Federal 
Trade Commission, and Federal agencies that have 
jurisdiction over labor and employment issues, 
including the Equal Employment Opportunity Commission 
and the National Labor Relations Board.
(2) Government accountability office; library of 
congress.--The Comptroller General of the United States and the 
Librarian of Congress shall prescribe any regulations described 
in paragraph (1)(A) with respect to covered individuals of the 
Government Accountability Office and the Library of Congress, 
respectively, and other individuals affected by the Comptroller 
General of the United States and the Librarian of Congress, 
respectively.
(b) Employees Covered by Congressional Accountability Act of 
1995.--
(1) Authority.--Not later than 45 days after the Secretary 
prescribes any regulation under subsection (a)(1)(A), the Board 
of Directors of the Office of Compliance shall prescribe (in 
accordance with section 304 of the Congressional Accountability 
Act of 1995 (2 U.S.C. 1384)) such regulations as may be 
necessary to carry out this Act with respect to covered 
individuals described in section 2(7)(A)(iii) and other 
individuals affected by employers described in section 
2(9)(A)(i)(III), including individuals who are covered 
individuals described in section 2(7)(B) with respect to such 
employers.
(2) Agency regulations.--The regulations prescribed under 
paragraph (1) shall be the same as substantive regulations 
promulgated by the Secretary under subsection (a)(1)(A) except 
insofar as the Board may determine, for good cause shown and 
stated together with the regulations prescribed under paragraph 
(1), that a modification of such regulations would be more 
effective for the implementation of the rights and protections 
involved under this section.
(c) Employees Covered by Chapter 5 of Title 3, United States 
Code.--
(1) Authority.--Not later than 45 days after the Secretary 
prescribes any regulation under subsection (a)(1)(A), the 
President (or the designee of the President) shall prescribe 
such regulations as may be necessary to carry out this Act with 
respect to covered individuals described in section 2(7)(A)(iv) 
and other individuals affected by employers described in 
section 2(9)(A)(i)(IV), including individuals who are covered 
individuals described in section 2(7)(B) with respect to such 
employers.
(2) Agency regulations.--The regulations prescribed under 
paragraph (1) shall be the same as substantive regulations 
promulgated by the Secretary under subsection (a)(1)(A) except 
insofar as the President (or designee) may determine, for good 
cause shown and stated together with the regulations prescribed 
under paragraph (1), that a modification of such regulations 
would be more effective for the implementation of the rights 
and protections involved under this section.
(d) Employees Covered by Chapter 63 of Title 5, United States 
Code.--
(1) Authority.--Not later than 45 days after the Secretary 
prescribes any regulation under subsection (a)(1)(A), the 
Director of the Office of Personnel Management shall prescribe 
such regulations as may be necessary to carry out this Act with 
respect to covered individuals described in section 2(7)(A)(v) 
and other individuals affected by employers described in 
section 2(9)(A)(i)(V), including individuals who are covered 
individuals described in section 2(7)(B) with respect to such 
employers.
(2) Agency regulations.--The regulations prescribed under 
paragraph (1) shall be the same as substantive regulations 
promulgated by the Secretary under subsection (a)(1)(A) except 
insofar as the Director may determine, for good cause shown and 
stated together with the regulations prescribed under paragraph 
(1), that a modification of such regulations would be more 
effective for the implementation of the rights and protections 
involved under this section.

SEC. 8. WHISTLEBLOWER PROTECTIONS.

(a) In General.--An employer may not discriminate or retaliate 
(including through intimidation, threats, coercion, or harassment) 
against any covered individual of the employer--
(1) for exercising, or attempting to exercise, any right 
provided under this Act; or
(2) because the covered individual (or another individual 
acting at the request of the covered individual) has--
(A) made a written or oral complaint to the 
employer or a Federal, State, or local government 
entity of a violation of section 3, 4, or 5;
(B) sought assistance or intervention with respect 
to a worker privacy-related concern from the employer, 
a Federal, State, or local government, or a worker 
representative;
(C) instituted, caused to be instituted, or 
otherwise participated in any inquiry or proceeding 
under or related to this Act;
(D) given, or is about to give, any information in 
connection with any inquiry or proceeding relating to 
any right provided under this Act; or
(E) testified, or is about to testify, in any 
inquiry or proceeding relating to any right provided 
under this Act.
(b) Notice.--Each employer shall provide notice of the protections 
under subsection (a) to all covered individuals of the employer in a 
manner that is accessible and in plain language.

SEC. 9. ENFORCEMENT.

(a) In General.--
(1) Definition.--For purposes of this subsection:
(A) Covered individual.--The term ``covered 
individual'' means a covered individual--
(i) described in section 2(7)(A) (other 
than covered individuals described in clauses 
(iii) through (v) of such section); or
(ii) described in section 2(7)(B) with 
respect to an employer.
(B) Employer.--The term ``employer'' means an 
employer described in subclause (I) or (II) of section 
2(9)(A)(i).
(2) Enforcement by the worker protection and technology 
division.--
(A) Investigation.--
(i) In general.--To ensure compliance with 
the provisions of this Act, or any regulation 
or order issued under this Act, the Secretary, 
acting through the Administrator--
(I) shall have the investigative 
authority provided under section 11(a) 
of the Fair Labor Standards Act of 1938 
(29 U.S.C. 211(a)), with respect to 
employers, covered individuals, and 
third parties and service providers 
with respect to employers; and
(II) may require, by general or 
special orders, an employer or third 
party or service provider with respect 
to the employer, to file with the 
Secretary, in such form as the 
Secretary may prescribe, annual or 
special reports or answers in writing 
to specific questions, furnishing to 
the Secretary such information or 
records as the Secretary may require as 
to the organization, business, conduct, 
practices, management, and relation to 
other corporations, partnerships, and 
individuals, of the employer.
(ii) Reports and answers.--An employer or 
third party or service provider with respect to 
the employer shall file the reports and answers 
(including information and records) required 
under clause (i)(II) in such manner, including 
under oath or otherwise, and within such 
reasonable time period as the Secretary may 
require.
(iii) Joint investigations.--The Secretary, 
acting through the Administrator, may conduct 
investigations and make requests for 
information, as authorized under this Act, on a 
joint basis with another Federal agency, a 
State attorney general, or a State agency.
(iv) Obligation to keep, preserve, and make 
available records.--An employer or third party 
or service provider with respect to the 
employer shall make, keep, preserve, and make 
available to the Secretary records pertaining 
to compliance with this Act in accordance with 
section 11(c) of the Fair Labor Standards Act 
of 1938 (29 U.S.C. 211(c)) and in accordance 
with any regulation or order issued by the 
Secretary.
(B) Enforcement.--With respect to employers, 
covered individuals, and third parties and service 
providers with respect to employers, the Secretary, 
acting through the Administrator, shall receive, 
investigate, and attempt to resolve complaints of 
violations of section 3, 4, 5, or 8 in the same manner 
that the Secretary receives, investigates, and attempts 
to resolve complaints of violations of sections 6 and 7 
of the Fair Labor Standards Act of 1938 (29 U.S.C. 206 
and 207).
(C) Priority.--For purposes of subparagraphs (A) 
and (B), the Secretary shall prioritize industries with 
high rates of employee data collection and at high risk 
of workplace-surveillance-related health impacts.
(D) Referral for criminal proceedings.--If the 
Secretary, in the course of the performance of any act 
or duty under this Act, obtains evidence that any 
employer has engaged in conduct that may constitute a 
violation of Federal criminal law, the Secretary shall 
refer the matter to the Attorney General for 
prosecution under any applicable law. Nothing in this 
paragraph shall affect any other authority of the 
Secretary to disclose information.
(E) Litigation.--The Solicitor of Labor may appear 
for and represent the Secretary on any litigation 
brought under this subsection.
(3) Private right of action.--
(A) In general.--
(i) Covered individual.--Notwithstanding 
any action by the Secretary under paragraph 
(2)(B), any covered individual adversely 
affected by an alleged violation of section 3, 
4, 5, or 8, may commence a civil action against 
any person that violates such section in any 
Federal court of competent jurisdiction.
(ii) Labor organization.--Notwithstanding 
any action by the Secretary under paragraph 
(2)(B), any labor organization adversely 
affected by an alleged violation of 5 or 8 may 
commence a civil action against any person that 
violates such section in any Federal court of 
competent jurisdiction.
(B) Relief.--
(i) In general.--In a civil action brought 
under subparagraph (A) in which the covered 
individual or labor organization prevails, the 
court shall award the covered individual or 
labor organization--
(I) damages of not less than an 
amount equal to twice the sum of any 
actual damages sustained by the covered 
individual;
(II) statutory damages described in 
clause (iv);
(III) injunctive relief; and
(IV) equitable relief.
(ii) Attorney's fees.--In a civil action 
brought under subparagraph (A) in which the 
covered individual or labor organization 
prevails, the court shall award the covered 
individual or labor organization reasonable 
attorney's fees and litigation costs.
(iii) Temporary relief for 
whistleblowers.--In a civil action brought 
under subparagraph (A) regarding a violation of 
section 8, the court may award the covered 
individual or labor organization temporary 
relief while the case is pending, including 
reinstatement.
(iv) Statutory damages.--The court may, in 
accordance with clause (v), award statutory 
damages under clause (i)(II) against a person 
in the following amounts:
(I) Failure to comply with 
disclosure requirements.--For a 
violation of section 4 and section 
8(b), the court may award--
(aa) for the first such 
violation, damages of an amount 
not more than $500 for each 
covered individual impacted; 
and
(bb) for any subsequent 
violation, damages for each 
covered individual impacted in 
an amount of not more than $500 
more than the amount of the 
damages awarded per covered 
individual for the violation 
immediately preceding such 
subsequent violation.
(II) Violation of employee data 
minimization requirements or employee 
data accessibility requirements.--For 
each violation of section 3 or 5, the 
court may award--
(aa) damages of an amount 
not less than $5,000 and not 
more than $20,000; or
(bb) for any willful or 
repeated violation, damages of 
an amount not less than $10,000 
and not more than $40,000.
(III) Retaliation on 
whistleblowers.--For each violation of 
section 8(a), the court may award--
(aa) damages of an amount 
not less than $5,000 and not 
more than $50,000; or
(bb) for any willful or 
repeated violation, damages of 
an amount not less than $10,000 
and not more than $100,000.
(v) Considerations for statutory damages.--
In determining the amount of statutory damages 
assessed under clause (iv), the court shall 
consider any relevant circumstances presented 
by the parties to the action, including--
(I) the nature and seriousness of 
the violation;
(II) the number of violations;
(III) the persistence of the 
misconduct;
(IV) the length of time over which 
the misconduct occurred;
(V) the willfulness of the 
misconduct of person; and
(VI) the assets, liabilities, and 
net worth of the person.
(C) Remedies for state employees.--
(i) Waiver of sovereign immunity.--A 
State's receipt or use of Federal financial 
assistance for any program or activity of a 
State shall constitute a waiver of sovereign 
immunity, under the 11th Amendment to the 
Constitution of the United States or otherwise, 
to a suit brought by a covered individual of 
that program or activity, or a labor 
organization representing such a covered 
individual, under this paragraph for equitable, 
legal, or other relief authorized under this 
paragraph.
(ii) Official capacity.--An official of a 
State may be sued in the official capacity of 
the official by any covered individual or such 
a labor organization who has complied with the 
procedures under this paragraph, for injunctive 
relief that is authorized under this paragraph. 
In such a suit the court may award to the 
prevailing party those costs authorized by 
section 722 of the Revised Statutes (42 U.S.C. 
1988).
(iii) Applicability.--With respect to a 
particular program or activity, clause (i) 
applies to conduct that occurs--
(I) after the date of enactment of 
this Act; and
(II) on or after the day on which a 
State first receives or uses Federal 
financial assistance for that program 
or activity.
(iv) Definition of program or activity.--In 
this subparagraph, the term ``program or 
activity'' has the meaning given the term in 
section 606 of the Civil Rights Act of 1964 (42 
U.S.C. 2000d-4a).
(D) Remedies for tribal government employees.--
(i) Waiver of sovereign immunity.--A Tribal 
government's receipt or use of Federal 
financial assistance for any program or 
activity of the Tribal government shall 
constitute a waiver of sovereign immunity to a 
suit brought by a covered individual of that 
program or activity, or a labor organization 
representing such a covered individual, under 
this paragraph for equitable, legal, or other 
relief authorized under this paragraph.
(ii) Official capacity.--An official of a 
Tribal government may be sued in the official 
capacity of the official by any covered 
individual or such a labor organization who has 
complied with the procedures under this 
paragraph for injunctive relief that is 
authorized under this paragraph. In such a suit 
the court may award to the prevailing party 
those costs authorized by section 722 of the 
Revised Statutes (42 U.S.C. 1988).
(iii) Applicability.--With respect to a 
particular program or activity, clause (i) 
applies to conduct that occurs--
(I) after the date of enactment of 
this Act; and
(II) on or after the day on which a 
Tribal government first receives or 
uses Federal financial assistance for 
that program or activity.
(iv) Definition of program or activity.--In 
this subparagraph, the term ``program or 
activity'' has the meaning given the term in 
section 606 of the Civil Rights Act of 1964 (42 
U.S.C. 2000d-4a).
(4) Enforcement by the government accountability office and 
library of congress.--Notwithstanding any other provision of 
this subsection, in the case of the Government Accountability 
Office and the Library of Congress, the authority of the 
Secretary under this subsection shall be exercised respectively 
by the Comptroller General of the United States and the 
Librarian of Congress, respectively.
(b) Employees Covered by Congressional Accountability Act of 
1995.--The powers, remedies, and procedures provided in the 
Congressional Accountability Act of 1995 (2 U.S.C. 1301 et seq.) to the 
Board (as defined in section 101 of that Act (2 U.S.C. 1301)), or any 
person, alleging a violation of section 202(a)(1) of that Act (2 U.S.C. 
1312(a)(1)) shall be the powers, remedies, and procedures this Act 
provides to that Board, or any person, with regard to an allegation of 
a violation of section 3, 4, 5, or 8 against a covered individual 
described in section 2(7)(A)(iii) or described in section 2(7)(B) with 
respect to an employer described in section 2(9)(A)(i)(III).
(c) Employees Covered by Chapter 5 of Title 3, United States 
Code.--The powers, remedies, and procedures provided in chapter 5 of 
title 3, United States Code, to the President, the Merit Systems 
Protection Board, or any person, alleging a violation of section 
412(a)(1) of that title, shall be the powers, remedies, and procedures 
this Act provides to the President, that Board, or any person, 
respectively, with regard to an allegation of a violation of section 3, 
4, 5, or 8 against a covered individual described in section 
2(7)(A)(iv) or described in section 2(7)(B) with respect to an employer 
described in section 2(9)(A)(i)(IV).
(d) Employees Covered by Chapter 63 of Title 5, United States 
Code.--The powers, remedies, and procedures provided in title 5, United 
States Code, to an employing agency, provided in chapter 12 of that 
title to the Merit Systems Protection Board, or provided in that title 
to any person, alleging a violation of chapter 63 of that title, shall 
be the powers, remedies, and procedures this Act provides to that 
agency, that Board, or any person, respectively, with regard to an 
allegation of a violation of section 3, 4, 5, or 8 against a covered 
individual described in section 2(7)(A)(v) or described in section 
2(7)(B) with respect to an employer described in section 2(9)(A)(i)(V).
(e) Enforcement by States.--
(1) In general.--In any case in which a State attorney 
general or a State privacy regulator has reason to believe that 
an interest of the residents of a State has been or is 
adversely affected by any person who violates any provision of 
section 3, 4, 5, or 8, including a regulation or order 
prescribed under this Act, the State attorney general or State 
privacy regulator, as parens patriae, may bring a civil action 
on behalf of the residents of the State in an appropriate State 
court or an appropriate district court of the United States 
to--
(A) enjoin further violation of such provision by 
the person;
(B) compel compliance with such provision;
(C) obtain damages, civil penalties, restitution, 
or other compensation on behalf of the residents of the 
State; or
(D) obtain reasonable attorney's fees and other 
litigation costs reasonably incurred.
(2) Rights of agency.--Before initiating a civil action 
under paragraph (1), the State attorney general or State 
privacy regulator, as the case may be, shall notify the 
Secretary in writing of such civil action. Upon receiving such 
notice, the Secretary may--
(A) intervene in such action; and
(B) upon intervening--
(i) be heard on all matters arising in such 
civil action; and
(ii) file petitions for appeal of a 
decision in such action.
(3) Preemptive action by agency.--In any case in which a 
civil action is instituted by or on behalf of the Secretary for 
violation of this Act or a regulation promulgated under this 
Act, a State attorney general or State privacy regulator may 
not, during the pendency of such action, institute a civil 
action against any defendant named in the complaint in the 
action instituted by or on behalf of the Secretary for a 
violation that is alleged in such complaint. In a case brought 
by the Secretary that affects the interests of a State, the 
State attorney general or State privacy regulator may intervene 
as of right pursuant to the Federal Rules of Civil Procedure.
(4) Preservation of state powers.--Except as provided in 
paragraph (3), no provision of this subsection shall be 
construed as altering, limiting, or affecting the authority of 
a State attorney general or State privacy regulator to--
(A) bring an action or other regulatory proceeding 
arising solely under the laws in effect in that State; 
or
(B) exercise the powers conferred on the State 
attorney general or State privacy regulator by the laws 
of the State, including the ability to conduct 
investigations, administer oaths or affirmations, or 
compel the attendance of witnesses or the production of 
documentary or other evidence.
(f) Liability of an Employer for a Violation by a Service Provider 
That Collect Employee Data.--A violation of section 3 by a service 
provider that collects employee data shall be considered a violation of 
such section by the employer if the employer knew or should have known 
about such violation.
(g) Arbitration and Class Action.--Notwithstanding any other 
provision of law, no predispute arbitration agreement or predispute 
joint-action waiver shall be valid or enforceable with respect to any 
alleged violation of section 3, 4, 5, or 8.

SEC. 10. REPORT TO CONGRESS ON WORKPLACE SURVEILLANCE.

The Secretary, acting through the Administrator, shall--
(1) using technologists and subject matter experts, conduct 
a study on workplace surveillance and the collection of 
employee data about covered individuals by employers, including 
such workplace surveillance through technological means; and
(2) not later than 1 year after the date of enactment of 
this Act, and annually thereafter, submit to Congress, and make 
publicly available, a report on the findings of the study under 
paragraph (1), including any recommendations for the President 
and Congress targeted at reducing harms related to workplace 
surveillance and the collection of employee data about covered 
individuals.

SEC. 11. COORDINATION.

In carrying out this Act, the Secretary, acting through the 
Administrator, shall coordinate with any appropriate Federal agency or 
State regulator to promote consistent regulatory treatment of employee 
data.

SEC. 12. RELATION TO OTHER LAWS.

Except as explicitly provided otherwise, nothing in this Act shall 
be construed to preempt, modify, limit, or supersede--
(1) any provision of Federal or State law; or
(2) the authority of the Federal Trade Commission, Equal 
Employment Opportunity Commission, National Labor Relations 
Board, or any other Federal agency.

SEC. 13. SEVERABILITY.

If any provision of this Act or the application of such provision 
to any person or circumstance is held to be unconstitutional, the 
remainder of this Act and the application of the provisions of such to 
all other persons or circumstances shall not be affected thereby.
<all>