[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 262 Introduced in Senate (IS)]

<DOC>






118th CONGRESS
  1st Session
                                 S. 262

 To prohibit, or require disclosure of, the surveillance, monitoring, 
   and collection of certain worker data by employers, and for other 
                               purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                            February 2, 2023

Mr. Casey (for himself, Mr. Booker, Mr. Schatz, Mr. Fetterman, and Ms. 
    Warren) introduced the following bill; which was read twice and 
  referred to the Committee on Health, Education, Labor, and Pensions

_______________________________________________________________________

                                 A BILL


 
 To prohibit, or require disclosure of, the surveillance, monitoring, 
   and collection of certain worker data by employers, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Stop Spying Bosses Act''.

SEC. 2. DEFINITIONS.

    For purposes of this Act:
            (1) Administrator.--The term ``Administrator'' means the 
        Administrator of the Privacy and Technology Division 
        established under section 5.
            (2) Aggregated data.--The term ``aggregated data'' means 
        data with respect to covered individuals of an employer that 
        the employer has combined or collected together in a summary or 
        other form that prevents the identification of any specific 
        individual.
            (3) Applicant.--The term ``applicant'', with respect to an 
        employer, means an individual who applies, or applied, to be 
        employed by, or otherwise perform work for remuneration for, 
        the employer.
            (4) Automated decision system.--
                    (A) In general.--The term ``automated decision 
                system'' means a system, software, or process that--
                            (i) uses computation, in whole or in part, 
                        to determine outcomes, make or aid decisions 
                        (including through evaluations, metrics, or 
                        scoring), inform policy implementation, collect 
                        data or observations, or otherwise interact 
                        with individuals or communities, including such 
                        a system, software, or process derived from 
                        machine learning, statistics, or other data 
                        processing or artificial intelligence 
                        techniques; and
                            (ii) is not passive computing 
                        infrastructure.
                    (B) Passive computing infrastructure.--For purposes 
                of this paragraph, the term ``passive computing 
                infrastructure'' means any intermediary technology that 
                does not influence or determine the outcome of a 
                decision, make or aid in a decision (including through 
                evaluations, metrics, or scoring), inform policy 
                implementation, or collect data or observations, 
                including web hosting, domain registration, networking, 
                caching, data storage, or cybersecurity.
            (5) Automated decision system output.--The term ``automated 
        decision system output'' means any information, assumptions, 
        predictions, scoring, recommendations, decisions, evaluations, 
        metrics, or conclusions generated by an automated decision 
        system.
            (6) Biometric information.--
                    (A) In general.--The term ``biometric information'' 
                means any information generated from the technological 
                processing of an individual's unique biological, 
                physical, or physiological characteristics that is 
                linked or reasonably linkable to an individual, 
                including--
                            (i) fingerprints;
                            (ii) voice prints;
                            (iii) iris or retina scans;
                            (iv) facial or hand mapping, geometry, or 
                        templates; or
                            (v) gait or personally identifying physical 
                        movements.
                    (B) Exclusion.--The term ``biometric information'' 
                does not include--
                            (i) a digital or physical photograph;
                            (ii) an audio or video recording; or
                            (iii) information generated from a digital 
                        or physical photograph, or an audio or video 
                        recording, that cannot be used to identify an 
                        individual.
            (7) Covered individual.--The term ``covered individual'', 
        with respect to an employer, means an individual--
                    (A) who is employed by, or otherwise performing 
                work for remuneration for, the employer, including such 
                an individual who is--
                            (i) any individual performing work for 
                        remuneration for an employer described in 
                        clauses (i)(I) and (ii) of paragraph (10)(A);
                            (ii) any individual performing work for 
                        remuneration for an entity described in 
                        paragraph (10)(A)(i)(II);
                            (iii) any individual performing work for 
                        remuneration for an employing office described 
                        in paragraph (10)(A)(i)(III);
                            (iv) any individual performing work for 
                        remuneration for an employing office described 
                        in paragraph (10)(A)(i)(IV); or
                            (v) any individual performing work for 
                        remuneration for an employing agency described 
                        in paragraph (10)(A)(i)(V); or
                    (B) who is an applicant to the employer.
            (8) Data.--The term ``data'', with respect to a covered 
        individual, means any information that identifies, relates to, 
        describes, is reasonably capable of being associated with, or 
        could reasonably be linked, directly or indirectly, with the 
        covered individual, regardless of how the information is 
        collected, inferred, or obtained, including--
                    (A) personally identifiable information with 
                respect to the covered individual, including any name, 
                contact information, government-issued identification 
                number, financial information, criminal background, 
                location information, photographs, biometric 
                information, or employment history associated with the 
                covered individual;
                    (B) any information related to the workplace 
                activities with respect to the covered individual, 
                including--
                            (i) human resources information, including 
                        the contents of a personnel file or performance 
                        evaluation;
                            (ii) work process information, such as 
                        productivity and efficiency information and 
                        information on breaks;
                            (iii) information that captures workplace 
                        communications and interactions, including 
                        emails, texts, internal message boards, and 
                        customer interaction and ratings;
                            (iv) device usage and information, 
                        including calls placed or precise geolocation 
                        information;
                            (v) audio-video information and other 
                        information collected from sensors, including 
                        movement tracking, images, videos, and thermal-
                        sensor information;
                            (vi) biometric information;
                            (vii) information from a personality test 
                        taken by a covered individual, including such a 
                        test given electronically at the beginning of 
                        or during a work shift;
                            (viii) inputs for an automated decision 
                        system or any automated decision system output; 
                        and
                            (ix) information that is collected or 
                        generated to mitigate the spread of infectious 
                        diseases, including COVID-19, or to comply with 
                        any public health measure; and
                    (C) online information with respect to the covered 
                individual that is collected while the covered 
                individual is on- or off-duty, including any internet 
                protocol address associated with the covered 
                individual, the social media activity of the covered 
                individual, any advertisement-related tracking 
                identifier associated with the covered individual, the 
                internet browsing history of the covered individual, or 
                other digital sources or unique identifiers associated 
                with the covered individual.
            (9) Employ.--The term ``employ'' has the meaning given such 
        term in section 3 of the Fair Labor Standards Act of 1938 (29 
        U.S.C. 203).
            (10) Employer.--
                    (A) In general.--The term ``employer'' means any 
                person who is--
                            (i)(I) a covered employer who is not 
                        described in any other subclause of this 
                        clause;
                            (II) an entity employing a State employee 
                        described in section 304(a) of the Government 
                        Employee Rights Act of 1991 (42 U.S.C. 2000e-
                        16c(a));
                            (III) an employing office, as defined in 
                        section 101 of the Congressional Accountability 
                        Act of 1995 (2 U.S.C. 1301);
                            (IV) an employing office, as defined in 
                        section 411(c) of title 3, United States Code; 
                        or
                            (V) an employing agency covered under 
                        subchapter V of chapter 63 of title 5, United 
                        States Code; and
                            (ii) engaged in commerce (including 
                        government), or an industry or activity 
                        affecting commerce (including government).
                    (B) Covered employer.--In subparagraph (A), the 
                term ``covered employer''--
                            (i) means any person engaged in commerce or 
                        in any industry or activity affecting commerce 
                        who employs, or otherwise engages for the 
                        performance of work for remuneration, 11 or 
                        more covered individuals;
                            (ii) includes--
                                    (I) any person who acts, directly 
                                or indirectly, in the interest of a 
                                covered employer in relation to any 
                                individual performing work for 
                                remuneration for such covered employer;
                                    (II) any successor in interest of a 
                                covered employer;
                                    (III) any public agency; and
                                    (IV) the Government Accountability 
                                Office and the Library of Congress; and
                            (iii) does not include any labor 
                        organization (other than when acting as an 
                        employer) or anyone acting in the capacity of 
                        officer or agent of such labor organization.
                    (C) Public agency.--For purposes of this paragraph, 
                a public agency shall be considered to be a person 
                engaged in commerce or in an industry or activity 
                affecting commerce.
                    (D) Definitions.--For purposes of this paragraph, 
                the terms ``commerce'', ``person'', and ``public 
                agency'' have the meanings given the terms in section 3 
                of the Fair Labor Standards Act of 1938 (29 U.S.C. 
                203).
            (11) Employment-related decision.--The term ``employment-
        related decision'' includes a decision by an employer with 
        regard to--
                    (A) hiring a covered individual (including any 
                decision with regard to interviewing or reviewing an 
                applicant);
                    (B) firing, taking a disciplinary action against, 
                demoting, or reassigning duties of a covered 
                individual; or
                    (C) any other term, condition, or privilege of 
                employment or work of the covered individual, such as 
                relating to pay, scheduling, or hours worked or 
                promoting a covered individual.
            (12) Government entity.--The term ``government entity'' 
        means--
                    (A) a Federal agency (as such term is defined in 
                section 3371 of title 5, United States Code);
                    (B) a State or political subdivision thereof;
                    (C) any agency, authority, or instrumentality of a 
                State or political subdivision thereof; or
                    (D) a Tribal government or political subdivision 
                thereof.
            (13) Indian tribe.--The term ``Indian Tribe'' means any 
        Indian or Alaska Native tribe, band, nation, pueblo, village, 
        community, component band, or component reservation 
        individually identified (including parenthetically) in the list 
        published most recently as of the date of enactment of this Act 
        pursuant to section 104 of the Federally Recognized Indian 
        Tribe List Act of 1994 (25 U.S.C. 5131).
            (14) Labor organization.--The term ``labor organization'' 
        has the meaning given the term in section 2(5) of the National 
        Labor Relations Act (29 U.S.C. 152(5)), except that such term 
        shall also include--
                    (A) any organization composed of labor 
                organizations, such as a labor union federation or a 
                State or municipal labor body; and
                    (B) any organization which would be included in the 
                definition for such term under such section 2(5) but 
                for the fact that the organization represents--
                            (i) individuals employed by the United 
                        States, any wholly owned Government 
                        corporation, any Federal Reserve Bank, or any 
                        State or political subdivision thereof;
                            (ii) individuals employed by persons 
                        subject to the Railway Labor Act (45 U.S.C. 151 
                        et seq.); or
                            (iii) individuals employed as agricultural 
                        laborers.
            (15) Precise geolocation information.--
                    (A) In general.--The term ``precise geolocation 
                information'' means information that is derived from a 
                device or technology that reveals the past or present 
                physical location of an individual or a device that 
                identifies or is linked or reasonably linkable to 1 or 
                more individuals, with sufficient precision to identify 
                street level location information of the individual or 
                device or the location of the individual or device 
                within a range of 1,850 feet or less.
                    (B) Exclusion.--The term ``precise geolocation 
                information'' does not include information described in 
                subparagraph (A) identifiable or derived solely from 
                the visual content of a legally obtained image, 
                including the location of the device that captured such 
                image.
            (16) Predispute arbitration agreement.--The term 
        ``predispute arbitration agreement'' means any agreement to 
        arbitrate a dispute that has not yet arisen at the time of the 
        making of the agreement.
            (17) Predispute joint-action waiver.--The term ``predispute 
        joint-action waiver'' means an agreement, whether or not part 
        of a predispute arbitration agreement, that would prohibit, or 
        waive the right of, one of the parties to the agreement to 
        participate in a joint, class, or collective action in a 
        judicial, arbitral, administrative, or other forum, concerning 
        a dispute that has not yet arisen at the time of the making of 
        the agreement.
            (18) Secretary.--The term ``Secretary'' means the Secretary 
        of Labor.
            (19) Sell.--The term ``sell'', with respect to data, means 
        the transfer of such data for monetary consideration or for a 
        thing of value by an employer to a third party for the purpose 
        of processing, maintaining, or further transferring such data.
            (20) Service provider.--The term ``service provider'', with 
        respect to an employer, means a person that--
                    (A) collects, processes, conveys, or maintains data 
                with respect to such employer only at the direction of, 
                in accordance with the direction of, and pursuant to a 
                written contract with the employer (including any terms 
                of service or service agreements);
                    (B) does not earn revenue from such collection, 
                processing, conveyance, or maintenance of such data, 
                except from the employer by providing contracted 
                services to the employer with regard to such 
                collection, processing, conveyance, or maintenance of 
                such data; and
                    (C) does not combine or link data associated with 
                such employer with data associated with another 
                employer.
            (21) Social media activity.--The term ``social media 
        activity'' means any activity on an individual platform-based 
        account.
            (22) State.--The term ``State'' means each of the several 
        States of the United States, the District of Columbia, or any 
        territory or possession of the United States.
            (23) State attorney general.--The term ``State attorney 
        general'' means--
                    (A) with respect to a State, the attorney general 
                or chief law enforcement officer of the State, or 
                another official or agency designated by the State to 
                bring civil actions on behalf of the State or the 
                residents of the State; and
                    (B) with respect to a Tribal government, the 
                attorney general or chief law enforcement officer of 
                the Tribal government, or another official or agency 
                designated by the Tribal government to bring civil 
                actions on behalf of the Tribal government or the 
                Indian Tribe of the Tribal government.
            (24) State privacy regulator.--The term ``State privacy 
        regulator'' means--
                    (A) the chief consumer protection officer of a 
                State; or
                    (B) a State consumer protection agency with 
                expertise in data protection, including the California 
                Privacy Protection Agency.
            (25) Technologist.--The term ``technologist'' means an 
        individual with experience in fields related to computational 
        technology, or the technology industry that produces 
        computational technology, such as advertising technology, 
        application development, artificial intelligence, computer 
        science, cybersecurity, data science, digital forensics, human-
        centered design, product management, prototyping, service 
        design, socio-technical systems, software engineering, user 
        experience, or privacy rights, civil liberties, or civil rights 
        related to technology.
            (26) Third party.--The term ``third party'', with respect 
        to an employer, means a person or entity--
                    (A) to which such employer transfers or is able to 
                transfer data, including any subsidiary or corporate 
                affiliate of such employer; and
                    (B) that is not--
                            (i) such employer;
                            (ii) a service provider of such employer 
                        with respect to the data being transferred; or
                            (iii) a government entity.
            (27) Transfer.--The term ``transfer'', with respect to 
        data, means releasing, sharing, leasing, disseminating, 
        disclosing, making available, or otherwise causing to be 
        communicated, such data--
                    (A) to a third party; or
                    (B) in the case of a third party that releases, 
                shares, leases, disseminates, discloses, makes 
                available, or otherwise causes to be communicated, such 
                data, to another person.
            (28) Tribal government.--The term ``Tribal government'' 
        means the recognized governing body of an Indian Tribe.
            (29) Workplace surveillance.--The term ``workplace 
        surveillance'' means any employer surveillance (on- or off-
        duty) with respect to a covered individual, including the 
        detection, monitoring, interception, collection, exploitation, 
        preservation, protection, transmission, or retention of data 
        concerning activities or communications with respect to the 
        covered individual, including through the use of a product or 
        service marketed, or that can be used, for such purposes, such 
        as a computer, telephone, wire, radio, camera, sensor, 
        electromagnetic, photoelectronic, handheld or wearable device, 
        or photo-optical system.

SEC. 3. DISCLOSURE OF CERTAIN WORKPLACE SURVEILLANCE.

    (a) In General.--An employer shall disclose, in accordance with 
subsections (b) and (c), to each covered individual described in 
subsection (b)(1) and publish in a manner that is conspicuous, freely 
accessible, and readily available for viewing by any such covered 
individual of the employer (including on the internet in a manner that 
is freely accessible and machine readable (in a form prescribed by the 
Secretary))--
            (1) any workplace surveillance on the covered individual by 
        the employer, including--
                    (A) what data are being collected;
                    (B) how the data are being collected;
                    (C) where and when the data are being collected;
                    (D) the frequency of the collection;
                    (E) where the storage of the data is located;
                    (F) the business purposes for which the data are 
                being used; and
                    (G) as applicable, the identity of any third party 
                or service provider--
                            (i) used for such workplace surveillance;
                            (ii) to which data from such workplace 
                        surveillance is transferred; and
                            (iii) from which data of the covered 
                        individual is or may be purchased or acquired; 
                        and
            (2) how such workplace surveillance affects employment-
        related decisions by the employer, including with regard to the 
        assessment of the performance and productivity of the covered 
        individual.
    (b) Timing of Disclosure.--
            (1) Initial disclosure.--An employer shall provide the 
        disclosure required under subsection (a)--
                    (A) in the case of--
                            (i) a covered individual for whom an 
                        employment-related decision with regard to the 
                        hiring of the covered individual was made on or 
                        after the effective date of this section, to 
                        the covered individual not later than 30 days 
                        after the date on which the employer makes such 
                        employment-related decision; or
                            (ii) a covered individual who is employed 
                        by, or otherwise performing work for 
                        remuneration for, the employer on such 
                        effective date or a covered individual for whom 
                        an employment-related decision with regard to 
                        the hiring of the covered individual was made 
                        on or after the date that is 5 years prior to 
                        the effective date of this section but before 
                        such effective date, to the covered individual 
                        not later than 60 days after such effective 
                        date; and
                    (B) to each applicant of the employer prior to 
                accepting an application by the applicant to be 
                employed by, or otherwise perform work for remuneration 
                for, the employer.
            (2) Subsequent disclosures.--Not later than 7 days after 
        any information provided by an employer to a covered individual 
        through a disclosure required under subsection (a) changes or 
        after any new information required to be provided in such a 
        disclosure becomes available, the employer shall provide the 
        covered individual with an updated disclosure in accordance 
        with such subsection.
    (c) Procedures for Disclosure.--An employer shall provide the 
disclosure required under subsection (a) in a manner required by the 
Administrator that is--
            (1) accessible;
            (2) in plain language and in the primary language of the 
        covered individual provided the disclosure;
            (3) in writing and available electronically;
            (4) accountable;
            (5) tailored to the purpose of the disclosure;
            (6) tailored to the covered individual; and
            (7) tailored to the level of risk.
    (d) Covered Individual Acknowledgment.--An employer shall obtain 
written or electronic acknowledgment from each covered individual 
provided a disclosure under subsection (a) of the receipt of the 
disclosure by the covered individual.
    (e) Worker Data Request and Correction.--An employer shall enable a 
covered individual, upon request by the covered individual or as 
provided in section 4(c), to--
            (1) not later than 7 days after such request, obtain any 
        data collected by the employer on the covered individual 
        through workplace surveillance; and
            (2) in accordance with procedures established by the 
        Administrator, have any such data that is incomplete or 
        erroneous updated or corrected at any time.
    (f) Effective Date.--This section shall take effect on the date 
that is 60 days after the date of enactment of this Act.

SEC. 4. PROHIBITION OF CERTAIN WORKPLACE SURVEILLANCE.

    (a) In General.--An employer or, as applicable, a third party or 
service provider that the employer uses for workplace surveillance may 
not--
            (1) use workplace surveillance to--
                    (A) identify any covered individual who forms, 
                joins, assists, or seeks to form, join, or assist, a 
                labor organization;
                    (B) monitor the activities of any covered 
                individual concerning or related to a labor 
                organization or with respect to engaging in protected 
                concerted activity;
                    (C) except as otherwise provided in law, ascertain 
                any political opinion or activity, religious view, or 
                other identity marker of the covered individual, that 
                is unrelated to the performance of the job duties of 
                the covered individual for the employer;
                    (D) except as otherwise provided in law, collect 
                information on or identify the health status, any 
                health condition, or disability status of a covered 
                individual, that is unrelated to the performance of the 
                job duties of the covered individual for the employer;
                    (E) except as otherwise required by law ascertain 
                the immigration status of a covered individual; or
                    (F) monitor the activities of any covered 
                individual concerning or related to reporting the 
                employer or such a third party or service provider for 
                a violation of any other law, including monitoring for 
                purposes of identifying a covered individual who has 
                reported or intends to report the employer or such a 
                third party or service provider;
            (2) use an automated decision system to predict behavior of 
        a covered individual that is unrelated to the work of the 
        covered individual for the employer;
            (3) use workplace surveillance to monitor a covered 
        individual while the covered individual is off-duty or in a 
        sensitive area, such as a restroom or locker room, location 
        provided for the covered individual to express breast milk, or 
        location provided for the covered individual to pray or 
        participate in a religious activity;
            (4) use workplace surveillance on a covered individual in 
        any manner that threatens the mental or physical health of the 
        covered individual;
            (5) use data collected through workplace surveillance on a 
        covered individual for a purpose that is not disclosed in 
        accordance with section 3(a)(1)(F); or
            (6) sell or license data collected on a covered individual 
        to any person (including a third party or service provider of 
        the employer) or, except as otherwise provided in law, 
        government entity.
    (b) Transfer of Personally Identifiable Data.--
            (1) Employer.--An employer may not transfer data on a 
        covered individual collected using workplace surveillance to a 
        third party unless, for each instance of a transfer--
                    (A) the employer--
                            (i) discloses the transfer to the covered 
                        individual; and
                            (ii) provides cybersecurity protections and 
                        encryption for the data; and
                    (B) the covered individual does not opt out of the 
                instance of the transfer.
            (2) Third party.--A third party that an employer uses for 
        workplace surveillance may not transfer data on a covered 
        individual, including any such data that was transferred to the 
        third party by the employer in accordance with paragraph (1).
    (c) Employment-Related Decisions.--An employer that makes an 
employment-related decision with regard to a covered individual using 
data from workplace surveillance shall--
            (1) not later than 7 days after making such an employment-
        related decision, disclose to the covered individual that such 
        employment-related decision was made using data from workplace 
        surveillance; and
            (2) not later than 7 days after such disclosure, enable the 
        covered individual to--
                    (A) review such data and related aggregated data 
                for other similarly situated covered individuals of the 
                employer; and
                    (B) in accordance with the procedures described in 
                section 3(e)(2), have any data described in paragraph 
                (1) that is incomplete or erroneous updated or 
                corrected.
    (d) Minimization.--
            (1) Collection.--An employer may not collect data on a 
        covered individual that is not reasonably related to operations 
        of the employer.
            (2) Employee access.--An employer shall restrict access to 
        data on a covered individual by another covered individual of 
        the employer based on the specific and reasonable business 
        rationale of the employer that is proportionate to the need for 
        such access.
    (e) Employer Contracts With Any Third Party or Service Provider 
That the Employer Uses for Workplace Surveillance.--An employer that 
uses a third party or service provider for workplace surveillance shall 
include in any contract between the employer and such third party or 
service provider entered into after the effective date of this section 
an agreement to comply with the requirements of this section.
    (f) Effective Date.--This section shall take effect on the date 
that is 60 days after the date of enactment of this Act.

SEC. 5. ESTABLISHMENT OF PRIVACY AND TECHNOLOGY DIVISION.

    (a) In General.--There is established in the Department of Labor 
the Privacy and Technology Division.
    (b) Administrator of the Privacy and Technology Division.--The 
President shall appoint an Administrator of the Privacy and Technology 
Division to head the Privacy and Technology Division.
    (c) Employees and Advisory Boards of the Division.--
            (1) In general.--The Administrator--
                    (A) may select, appoint, and employ, without regard 
                to the provisions of sections 3309 through 3318 of 
                title 5, United States Code, individuals, including 
                technologists, directly to positions in the competitive 
                service, as defined in section 2102 of such title, to 
                carry out the duties of the Administrator under this 
                Act; and
                    (B) may fix the compensation of the individuals 
                described in subparagraph (A) without regard to chapter 
                51 and subchapter III of chapter 53 of title 5, United 
                States Code, relating to classification of positions 
                and General Schedule pay rates, except that the rate of 
                pay for such individuals may not exceed the rate 
                payable for level V of the Executive Schedule under 
                section 5316 of that title.
            (2) Advisory boards.--
                    (A) Establishment.--The Administrator shall 
                establish the following advisory boards to advise and 
                consult with in the exercise of the functions of the 
                Administrator under this Act and to provide information 
                on emerging practices relating to the treatment of data 
                by employers:
                            (i) The User Advisory Board, which shall be 
                        composed of experts in consumer protection, 
                        privacy, civil rights, disability law, labor 
                        organizations, and ethics.
                            (ii) The Research Advisory Board, which 
                        shall be composed of individuals with academic 
                        and research expertise in privacy, 
                        cybersecurity, computer science, innovation, 
                        design, ethics, economics, law, disability law, 
                        labor organizations and public policy and 
                        representatives of labor organizations.
                            (iii) The Product Advisory Board, which 
                        shall be composed of technologists, computer 
                        scientists, designers, product managers, 
                        attorneys, representatives of labor 
                        organizations, workplace technology experts, 
                        and other representatives of employers and 
                        employees.
                            (iv) The Labor Advisory Board, which shall 
                        be composed of representatives of labor 
                        organizations and representatives of workers.
                    (B) Appointments.--The Administrator shall appoint 
                members to the advisory boards established under 
                subparagraph (A) without regard to party affiliation.
                    (C) Meetings.--Each advisory board established 
                under subparagraph (A) shall meet--
                            (i) at the call of the Administrator; and
                            (ii) not less than 2 times annually.
                    (D) Compensation and travel expenses.--A member of 
                an advisory board established under subparagraph (A) 
                who is not an officer or employee of the Federal 
                Government shall--
                            (i) be entitled to receive compensation at 
                        a rate fixed by the Administrator while 
                        attending meetings of the advisory board, 
                        including travel time; and
                            (ii) receive travel expenses, including per 
                        diem in lieu of subsistence, in accordance with 
                        applicable provisions under subchapter I of 
                        chapter 57 of title 5, United States Code.
                    (E) Exemption from the federal advisory committee 
                act.--Each advisory board established under 
                subparagraph (A) shall be exempt from chapter 10 of 
                title 5, United States Code (commonly known as the 
                ``Federal Advisory Committee Act'').
            (3) Use of voluntary services.--The Administrator may, as 
        may from time to time be needed, use any voluntary or 
        uncompensated services.
            (4) Attorneys.--Attorneys appointed under this subsection 
        may appear for and represent the Administrator in any 
        litigation.
    (d) Offices.--
            (1) In general.--The principal office of the Privacy and 
        Technology Division shall be in the District of Columbia.
            (2) Regional, local, and other offices.--The Administrator 
        may establish regional, local, or other offices, including an 
        office in the city of San Francisco, California, or the San 
        Francisco Bay area in California.
    (e) Orders and Guidance.--
            (1) In general.--The Secretary, acting through the 
        Administrator and the Administrator of the Wage and Hour 
        Division, may issue orders and guidance, as may be necessary or 
        appropriate to enable the Secretary to carry out the purposes 
        and objectives of this Act, and to prevent evasions thereof.
            (2) Consultation.--In issuing orders and guidance 
        authorized under this subsection, the Secretary, acting through 
        the Administrator and the Administrator of the Wage and Hour 
        Division, may consult with Federal agencies that have 
        jurisdiction over Federal privacy laws or expertise in privacy, 
        including the Federal Trade Commission, and Federal agencies 
        that have jurisdiction over labor and employment issues, 
        including the Equal Employment Opportunity Commission, the 
        National Labor Relations Board, the National Mediation Board, 
        and the Merit Systems Protection Board.

SEC. 6. REGULATIONS.

    (a) In General.--
            (1) Authority.--
                    (A) In general.--Except as provided in paragraph 
                (2), the Secretary, acting through the Administrator in 
                consultation with the Administrator of the Wage and 
                Hour Division, may prescribe such regulations as may be 
                necessary to carry out this Act with respect to covered 
                individuals described in section 2(7)(A) (other than 
                covered individuals described in clauses (iii) through 
                (v) of such section) and other individuals affected by 
                employers described in subclause (I) or (II) of section 
                2(10)(A)(i), including individuals who are covered 
                individuals described in section 2(7)(B) with respect 
                to such employers.
                    (B) Consultation.--In prescribing any regulations 
                authorized under this paragraph, the Secretary, acting 
                through the Administrator, may consult with Federal 
                agencies that have jurisdiction over Federal privacy 
                laws or expertise in privacy, including the Federal 
                Trade Commission, and Federal agencies that have 
                jurisdiction over labor and employment issues, 
                including the Equal Employment Opportunity Commission 
                and the National Labor Relations Board.
            (2) Government accountability office; library of 
        congress.--The Comptroller General of the United States and the 
        Librarian of Congress shall prescribe any regulations described 
        in paragraph (1)(A) with respect to covered individuals of the 
        Government Accountability Office and the Library of Congress, 
        respectively, and other individuals affected by the Comptroller 
        General of the United States and the Librarian of Congress, 
        respectively.
    (b) Employees Covered by Congressional Accountability Act of 
1995.--
            (1) Authority.--Not later than 45 days after the Secretary 
        prescribes any regulation under subsection (a)(1)(A), the Board 
        of Directors of the Office of Compliance shall prescribe (in 
        accordance with section 304 of the Congressional Accountability 
        Act of 1995 (2 U.S.C. 1384)) such regulations as may be 
        necessary to carry out this Act with respect to covered 
        individuals described in section 2(7)(A)(iii) and other 
        individuals affected by employers described in section 
        2(10)(A)(i)(III), including individuals who are covered 
        individuals described in section 2(7)(B) with respect to such 
        employers.
            (2) Agency regulations.--The regulations prescribed under 
        paragraph (1) shall be the same as substantive regulations 
        promulgated by the Secretary under subsection (a)(1)(A) except 
        insofar as the Board may determine, for good cause shown and 
        stated together with the regulations prescribed under paragraph 
        (1), that a modification of such regulations would be more 
        effective for the implementation of the rights and protections 
        involved under this section.
    (c) Employees Covered by Chapter 5 of Title 3, United States 
Code.--
            (1) Authority.--Not later than 45 days after the Secretary 
        prescribes any regulation under subsection (a)(1)(A), the 
        President (or the designee of the President) shall prescribe 
        such regulations as may be necessary to carry out this Act with 
        respect to covered individuals described in section 2(7)(A)(iv) 
        and other individuals affected by employers described in 
        section 2(10)(A)(i)(IV), including individuals who are covered 
        individuals described in section 2(7)(B) with respect to such 
        employers.
            (2) Agency regulations.--The regulations prescribed under 
        paragraph (1) shall be the same as substantive regulations 
        promulgated by the Secretary under subsection (a)(1)(A) except 
        insofar as the President (or designee) may determine, for good 
        cause shown and stated together with the regulations prescribed 
        under paragraph (1), that a modification of such regulations 
        would be more effective for the implementation of the rights 
        and protections involved under this section.
    (d) Employees Covered by Chapter 63 of Title 5, United States 
Code.--
            (1) Authority.--Not later than 45 days after the Secretary 
        prescribes any regulation under subsection (a)(1)(A), the 
        Director of the Office of Personnel Management shall prescribe 
        such regulations as may be necessary to carry out this Act with 
        respect to covered individuals described in section 2(7)(A)(v) 
        and other individuals affected by employers described in 
        section 2(10)(A)(i)(V), including individuals who are covered 
        individuals described in section 2(7)(B) with respect to such 
        employers.
            (2) Agency regulations.--The regulations prescribed under 
        paragraph (1) shall be the same as substantive regulations 
        promulgated by the Secretary under subsection (a)(1)(A) except 
        insofar as the Director may determine, for good cause shown and 
        stated together with the regulations prescribed under paragraph 
        (1), that a modification of such regulations would be more 
        effective for the implementation of the rights and protections 
        involved under this section.

SEC. 7. WHISTLEBLOWER PROTECTIONS.

    No employer shall discriminate or retaliate (including through 
intimidation, threats, coercion, or harassment) against any covered 
individual of the employer--
            (1) for exercising, or attempting to exercise, any right 
        provided under this Act; or
            (2) because the covered individual (or another individual 
        acting at the request of the covered individual) has--
                    (A) filed a written or oral complaint to the 
                employer or a Federal, State, or local government 
                entity of a violation of section 3 or 4;
                    (B) sought assistance or intervention with respect 
                to a worker privacy-related concern from the employer, 
                a Federal, State, or local government, or a worker 
                representative;
                    (C) instituted, caused to be instituted, or 
                otherwise participated in any inquiry or proceeding 
                under or related to this Act;
                    (D) given, or is about to give, any information in 
                connection with any inquiry or proceeding relating to 
                any right provided under this Act; or
                    (E) testified, or is about to testify, in any 
                inquiry or proceeding relating to any right provided 
                under this Act.

SEC. 8. ENFORCEMENT.

    (a) In General.--
            (1) Definition.--For purposes of this subsection:
                    (A) Covered individual.--The term ``covered 
                individual'' means a covered individual--
                            (i) described in section 2(7)(A) (other 
                        than covered individuals described in clauses 
                        (iii) through (v) of such section); or
                            (ii) described in section 2(7)(B) with 
                        respect to an employer.
                    (B) Employer.--The term ``employer'' means an 
                employer described in subclause (I) or (II) of section 
                2(10)(A)(i).
            (2) Enforcement by the privacy and technology division.--
                    (A) Investigation.--
                            (i) In general.--To ensure compliance with 
                        the provisions of this Act, or any regulation 
                        or order issued under this Act, the Secretary, 
                        acting through the Administrator--
                                    (I) shall have the investigative 
                                authority provided under section 11(a) 
                                of the Fair Labor Standards Act of 1938 
                                (29 U.S.C. 211(a)), with respect to 
                                employers, covered individuals, and 
                                third parties and service providers 
                                with respect to employers; and
                                    (II) may require, by general or 
                                special orders, an employer or third 
                                party or service provider with respect 
                                to the employer, to file with the 
                                Secretary, in such form as the 
                                Secretary may prescribe, annual or 
                                special reports or answers in writing 
                                to specific questions, furnishing to 
                                the Secretary such information or 
                                records as the Secretary may require as 
                                to the organization, business, conduct, 
                                practices, management, and relation to 
                                other corporations, partnerships, and 
                                individuals, of the employer.
                            (ii) Reports and answers.--An employer or 
                        third party or service provider with respect to 
                        the employer shall file the reports and answers 
                        (including information and records) required 
                        under clause (i)(II) in such manner, including 
                        under oath or otherwise, and within such 
                        reasonable time period as the Secretary may 
                        require.
                            (iii) Joint investigations.--The Secretary, 
                        acting through the Administrator, may conduct 
                        investigations and make requests for 
                        information, as authorized under this Act, on a 
                        joint basis with another Federal agency, a 
                        State attorney general, or a State agency.
                            (iv) Obligation to keep, preserve, and make 
                        available records.--An employer or third party 
                        or service provider with respect to the 
                        employer shall make, keep, preserve, and make 
                        available to the Secretary records pertaining 
                        to compliance with this Act in accordance with 
                        section 11(c) of the Fair Labor Standards Act 
                        of 1938 (29 U.S.C. 211(c)) and in accordance 
                        with any regulation or order issued by the 
                        Secretary.
                    (B) Enforcement.--With respect to employers, 
                covered individuals, and third parties and service 
                providers with respect to employers, the Secretary, 
                acting through the Administrator, shall receive, 
                investigate, and attempt to resolve complaints of 
                violations of section 3, 4, or 7 in the same manner 
                that the Secretary receives, investigates, and attempts 
                to resolve complaints of violations of sections 6 and 7 
                of the Fair Labor Standards Act of 1938 (29 U.S.C. 206 
                and 207).
                    (C) Priority.--For purposes of subparagraphs (A) 
                and (B), the Secretary shall prioritize industries with 
                high rates of workplace surveillance and at high risk 
                of workplace-surveillance-related health impacts.
                    (D) Referral for criminal proceedings.--If the 
                Secretary, in the course of the performance of any act 
                or duty under this Act, obtains evidence that any 
                employer has engaged in conduct that may constitute a 
                violation of Federal criminal law, the Secretary shall 
                refer the matter to the Attorney General for 
                prosecution under any applicable law. Nothing in this 
                paragraph shall affect any other authority of the 
                Secretary to disclose information.
                    (E) Litigation.--The Solicitor of Labor may appear 
                for and represent the Secretary on any litigation 
                brought under this subsection.
            (3) Private right of action.--
                    (A) In general.--
                            (i) Covered individual.--Notwithstanding 
                        any action by the Secretary under paragraph 
                        (2)(B), any covered individual adversely 
                        affected by an alleged violation of section 3, 
                        4, or 7, may commence a civil action against 
                        any person that violates such section in any 
                        Federal court of competent jurisdiction.
                            (ii) Labor organization.--Notwithstanding 
                        any action by the Secretary under paragraph 
                        (2)(B), any labor organization adversely 
                        affected by an alleged violation of 4 or 7 may 
                        commence a civil action against any person that 
                        violates such section in any Federal court of 
                        competent jurisdiction.
                    (B) Relief.--
                            (i) In general.--In a civil action brought 
                        under subparagraph (A) in which the covered 
                        individual or labor organization prevails, the 
                        court may award the covered individual or labor 
                        organization--
                                    (I) damages of--
                                            (aa) an amount equal to the 
                                        sum of any actual damages 
                                        sustained by the covered 
                                        individual; or
                                            (bb) not more than treble 
                                        damages;
                                    (II) statutory damages described in 
                                clause (iv);
                                    (III) injunctive relief; and
                                    (IV) equitable relief.
                            (ii) Attorney's fees.--In a civil action 
                        brought under subparagraph (A) in which the 
                        covered individual or labor organization 
                        prevails, the court shall award the covered 
                        individual or labor organization reasonable 
                        attorney's fees and litigation costs.
                            (iii) Temporary relief for 
                        whistleblowers.--In a civil action brought 
                        under subparagraph (A) regarding a violation of 
                        section 7, the court may award the covered 
                        individual or labor organization temporary 
                        relief while the case is pending, including 
                        reinstatement.
                            (iv) Statutory damages.--The court may, in 
                        accordance with clause (v), award statutory 
                        damages under clause (i)(II) against a person 
                        in the following amounts:
                                    (I) Failure to comply with 
                                disclosure requirements.--For a 
                                violation of section 3, the court may 
                                award--
                                            (aa) for the first such 
                                        violation, damages of an amount 
                                        not more than $500 for each 
                                        covered individual impacted; 
                                        and
                                            (bb) for any subsequent 
                                        violation, damages for each 
                                        covered individual impacted in 
                                        an amount of not more than $500 
                                        more than the amount of the 
                                        damages awarded per covered 
                                        individual for the violation 
                                        immediately preceding such 
                                        subsequent violation.
                                    (II) Using surveillance data for 
                                prohibited activities.--For each 
                                violation of section 4, the court may 
                                award--
                                            (aa) damages of an amount 
                                        not less than $5,000 and not 
                                        more than $20,000; or
                                            (bb) for any willful or 
                                        repeated violation, damages of 
                                        an amount not less than $10,000 
                                        and not more than $40,000.
                                    (III) Retaliation on 
                                whistleblowers.--For each violation of 
                                section 7, the court may award--
                                            (aa) damages of an amount 
                                        not less than $5,000 and not 
                                        more than $50,000; or
                                            (bb) for any willful or 
                                        repeated violation, damages of 
                                        an amount not less than $10,000 
                                        and not more than $100,000.
                            (v) Considerations for statutory damages.--
                        In determining the amount of statutory damages 
                        assessed under clause (iv), the court shall 
                        consider any relevant circumstances presented 
                        by the parties to the action, including--
                                    (I) the nature and seriousness of 
                                the violation;
                                    (II) the number of violations;
                                    (III) the persistence of the 
                                misconduct;
                                    (IV) the length of time over which 
                                the misconduct occurred;
                                    (V) the willfulness of the 
                                misconduct of person; and
                                    (VI) the assets, liabilities, and 
                                net worth of the person.
                    (C) Rights of the secretary and a state attorney 
                general.--Prior to an covered individual or labor 
                organization bringing a civil action under subparagraph 
                (A), such covered individual or labor organization 
                shall, in writing, notify the Secretary and any 
                relevant State attorney general of the intent to 
                commence such civil action. Upon receiving such notice, 
                the Secretary and State attorney general shall each, 
                not later than 60 days after receiving such notice--
                            (i) determine whether to intervene in such 
                        action and, upon intervening--
                                    (I) be heard on all matters arising 
                                in such action; and
                                    (II) file petitions for appeal of a 
                                decision in such action; and
                            (ii) notify such covered individual or 
                        labor organization.
                    (D) Remedies for state employees.--
                            (i) Waiver of sovereign immunity.--A 
                        State's receipt or use of Federal financial 
                        assistance for any program or activity of a 
                        State shall constitute a waiver of sovereign 
                        immunity, under the 11th Amendment to the 
                        Constitution of the United States or otherwise, 
                        to a suit brought by a covered individual of 
                        that program or activity, or a labor 
                        organization representing such a covered 
                        individual, under this paragraph for equitable, 
                        legal, or other relief authorized under this 
                        paragraph.
                            (ii) Official capacity.--An official of a 
                        State may be sued in the official capacity of 
                        the official by any covered individual or such 
                        a labor organization who has complied with the 
                        procedures under this paragraph, for injunctive 
                        relief that is authorized under this paragraph. 
                        In such a suit the court may award to the 
                        prevailing party those costs authorized by 
                        section 722 of the Revised Statutes (42 U.S.C. 
                        1988).
                            (iii) Applicability.--With respect to a 
                        particular program or activity, clause (i) 
                        applies to conduct that occurs--
                                    (I) after the date of enactment of 
                                this Act; and
                                    (II) on or after the day on which a 
                                State first receives or uses Federal 
                                financial assistance for that program 
                                or activity.
                            (iv) Definition of program or activity.--In 
                        this subparagraph, the term ``program or 
                        activity'' has the meaning given the term in 
                        section 606 of the Civil Rights Act of 1964 (42 
                        U.S.C. 2000d-4a).
                    (E) Remedies for tribal government employees.--
                            (i) Waiver of sovereign immunity.--A Tribal 
                        government's receipt or use of Federal 
                        financial assistance for any program or 
                        activity of the Tribal government shall 
                        constitute a waiver of sovereign immunity to a 
                        suit brought by a covered individual of that 
                        program or activity, or a labor organization 
                        representing such a covered individual, under 
                        this paragraph for equitable, legal, or other 
                        relief authorized under this paragraph.
                            (ii) Official capacity.--An official of a 
                        Tribal government may be sued in the official 
                        capacity of the official by any covered 
                        individual or such a labor organization who has 
                        complied with the procedures under this 
                        paragraph for injunctive relief that is 
                        authorized under this paragraph. In such a suit 
                        the court may award to the prevailing party 
                        those costs authorized by section 722 of the 
                        Revised Statutes (42 U.S.C. 1988).
                            (iii) Applicability.--With respect to a 
                        particular program or activity, clause (i) 
                        applies to conduct that occurs--
                                    (I) after the date of enactment of 
                                this Act; and
                                    (II) on or after the day on which a 
                                Tribal government first receives or 
                                uses Federal financial assistance for 
                                that program or activity.
                            (iv) Definition of program or activity.--In 
                        this subparagraph, the term ``program or 
                        activity'' has the meaning given the term in 
                        section 606 of the Civil Rights Act of 1964 (42 
                        U.S.C. 2000d-4a).
            (4) Enforcement by the government accountability office and 
        library of congress.--Notwithstanding any other provision of 
        this subsection, in the case of the Government Accountability 
        Office and the Library of Congress, the authority of the 
        Secretary under this subsection shall be exercised respectively 
        by the Comptroller General of the United States and the 
        Librarian of Congress, respectively.
    (b) Employees Covered by Congressional Accountability Act of 
1995.--The powers, remedies, and procedures provided in the 
Congressional Accountability Act of 1995 (2 U.S.C. 1301 et seq.) to the 
Board (as defined in section 101 of that Act (2 U.S.C. 1301)), or any 
person, alleging a violation of section 202(a)(1) of that Act (2 U.S.C. 
1312(a)(1)) shall be the powers, remedies, and procedures this Act 
provides to that Board, or any person, with regard to an allegation of 
a violation of section 3, 4, or 7 against a covered individual 
described in section 2(7)(A)(iii) or described in section 2(7)(B) with 
respect to an employer described in section 2(10)(A)(i)(III).
    (c) Employees Covered by Chapter 5 of Title 3, United States 
Code.--The powers, remedies, and procedures provided in chapter 5 of 
title 3, United States Code, to the President, the Merit Systems 
Protection Board, or any person, alleging a violation of section 
412(a)(1) of that title, shall be the powers, remedies, and procedures 
this Act provides to the President, that Board, or any person, 
respectively, with regard to an allegation of a violation of section 3, 
4, or 7 against a covered individual described in section 2(7)(A)(iv) 
or described in section 2(7)(B) with respect to an employer described 
in section 2(10)(A)(i)(IV).
    (d) Employees Covered by Chapter 63 of Title 5, United States 
Code.--The powers, remedies, and procedures provided in title 5, United 
States Code, to an employing agency, provided in chapter 12 of that 
title to the Merit Systems Protection Board, or provided in that title 
to any person, alleging a violation of chapter 63 of that title, shall 
be the powers, remedies, and procedures this Act provides to that 
agency, that Board, or any person, respectively, with regard to an 
allegation of a violation of section 3, 4, or 7 against a covered 
individual described in section 2(7)(A)(v) or described in section 
2(7)(B) with respect to an employer described in section 
2(10)(A)(i)(V).
    (e) Enforcement by States.--
            (1) In general.--In any case in which a State attorney 
        general or a State privacy regulator has reason to believe that 
        an interest of the residents of a State has been or is 
        adversely affected by any person who violates any provision of 
        section 3, 4, or 7, including a regulation or order prescribed 
        under this Act, the State attorney general or State privacy 
        regulator, as parens patriae, may bring a civil action on 
        behalf of the residents of the State in an appropriate State 
        court or an appropriate district court of the United States 
        to--
                    (A) enjoin further violation of such provision by 
                the person;
                    (B) compel compliance with such provision;
                    (C) obtain damages, civil penalties, restitution, 
                or other compensation on behalf of the residents of the 
                State; or
                    (D) obtain reasonable attorney's fees and other 
                litigation costs reasonably incurred.
            (2) Rights of agency.--Before initiating a civil action 
        under paragraph (1), the State attorney general or State 
        privacy regulator, as the case may be, shall notify the 
        Secretary in writing of such civil action. Upon receiving such 
        notice, the Secretary may--
                    (A) intervene in such action; and
                    (B) upon intervening--
                            (i) be heard on all matters arising in such 
                        civil action; and
                            (ii) file petitions for appeal of a 
                        decision in such action.
            (3) Preemptive action by agency.--In any case in which a 
        civil action is instituted by or on behalf of the Secretary for 
        violation of this Act or a regulation promulgated under this 
        Act, a State attorney general or State privacy regulator may 
        not, during the pendency of such action, institute a civil 
        action against any defendant named in the complaint in the 
        action instituted by or on behalf of the Secretary for a 
        violation that is alleged in such complaint. In a case brought 
        by the Secretary that affects the interests of a State, the 
        State attorney general or State privacy regulator may intervene 
        as of right pursuant to the Federal Rules of Civil Procedure.
            (4) Preservation of state powers.--Except as provided in 
        paragraph (3), no provision of this subsection shall be 
        construed as altering, limiting, or affecting the authority of 
        a State attorney general or State privacy regulator to--
                    (A) bring an action or other regulatory proceeding 
                arising solely under the laws in effect in that State; 
                or
                    (B) exercise the powers conferred on the State 
                attorney general or State privacy regulator by the laws 
                of the State, including the ability to conduct 
                investigations, administer oaths or affirmations, or 
                compel the attendance of witnesses or the production of 
                documentary or other evidence.
    (f) Liability of an Employer for a Violation by a Third Party or 
Service Provider That the Employer Uses for Workplace Surveillance.--A 
violation of section 4 by a third party or service provider that the 
employer uses for workplace surveillance shall be considered a 
violation of such section by the employer if the employer knew or 
should have known about such violation.
    (g) Arbitration and Class Action.--Notwithstanding any other 
provision of law, no predispute arbitration agreement or predispute 
joint-action waiver shall be valid or enforceable with respect to any 
alleged violation of section 3, 4, or 7.

SEC. 9. REPORT TO CONGRESS ON WORKPLACE SURVEILLANCE.

     The Secretary, acting through the Administrator, shall--
            (1) using technologists and subject matter experts, conduct 
        a study on workplace surveillance on covered individuals by 
        employers, including such workplace surveillance through 
        technological means; and
            (2) not later than 1 year after the date of enactment of 
        this Act, and annually thereafter, submit to Congress, and make 
        publicly available, a report on the findings of the study under 
        paragraph (1), including any recommendations for the President 
        and Congress targeted at reducing harms related to workplace 
        surveillance on covered individuals.

SEC. 10. COORDINATION.

    In carrying out this Act, the Secretary, acting through the 
Administrator, shall coordinate with any appropriate Federal agency or 
State regulator to promote consistent regulatory treatment of workplace 
surveillance.

SEC. 11. RELATION TO OTHER LAWS.

    Except as explicitly provided otherwise, nothing in this Act shall 
be construed to preempt, modify, limit, or supersede--
            (1) any provision of Federal or State law; or
            (2) the authority of the Federal Trade Commission, Equal 
        Employment Opportunity Commission, National Labor Relations 
        Board, or any other Federal agency.

SEC. 12. SEVERABILITY.

    If any provision of this Act or the application of such provision 
to any person or circumstance is held to be unconstitutional, the 
remainder of this Act and the application of the provisions of such to 
all other persons or circumstances shall not be affected thereby.
                                 <all>