Short title

This Act may be cited as the

Stop Spying Bosses Act

Definitions

For purposes of this Act: (1)

Administrator

The term Administrator means the Administrator of the Privacy and Technology Division established under section 5. (2)

Aggregated data

The term aggregated data means data with respect to covered individuals of an employer that the employer has combined or collected together in a summary or other form that prevents the identification of any specific individual. (3)

Applicant

The term applicant, with respect to an employer, means an individual who applies, or applied, to be employed by, or otherwise perform work for remuneration for, the employer. (4)

Automated decision system

(A)

In general

The term automated decision system means a system, software, or process that— (i)uses computation, in whole or in part, to determine outcomes, make or aid decisions (including through evaluations, metrics, or scoring), inform policy implementation, collect data or observations, or otherwise interact with individuals or communities, including such a system, software, or process derived from machine learning, statistics, or other data processing or artificial intelligence techniques; and (ii)is not passive computing infrastructure. (B)

Passive computing infrastructure

For purposes of this paragraph, the term passive computing infrastructure means any intermediary technology that does not influence or determine the outcome of a decision, make or aid in a decision (including through evaluations, metrics, or scoring), inform policy implementation, or collect data or observations, including web hosting, domain registration, networking, caching, data storage, or cybersecurity. (5)

Automated decision system output

The term automated decision system output means any information, assumptions, predictions, scoring, recommendations, decisions, evaluations, metrics, or conclusions generated by an automated decision system. (6)

Biometric information

(A)

In general

The term biometric information means any information generated from the technological processing of an individual’s unique biological, physical, or physiological characteristics that is linked or reasonably linkable to an individual, including— (i)fingerprints; (ii)voice prints; (iii)iris or retina scans; (iv)facial or hand mapping, geometry, or templates; or (v)gait or personally identifying physical movements. (B)

Exclusion

The term biometric information does not include— (i)a digital or physical photograph; (ii)an audio or video recording; or (iii)information generated from a digital or physical photograph, or an audio or video recording, that cannot be used to identify an individual. (7)

Covered individual

The term covered individual, with respect to an employer, means an individual— (A)who is employed by, or otherwise performing work for remuneration for, the employer, including such an individual who is— (i)any individual performing work for remuneration for an employer described in clauses (i)(I) and (ii) of paragraph (10)(A); (ii)any individual performing work for remuneration for an entity described in paragraph (10)(A)(i)(II); (iii)any individual performing work for remuneration for an employing office described in paragraph (10)(A)(i)(III); (iv)any individual performing work for remuneration for an employing office described in paragraph (10)(A)(i)(IV); or (v)any individual performing work for remuneration for an employing agency described in paragraph (10)(A)(i)(V); or (B)who is an applicant to the employer. (8)

Data

The term data, with respect to a covered individual, means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with the covered individual, regardless of how the information is collected, inferred, or obtained, including— (A)personally identifiable information with respect to the covered individual, including any name, contact information, government-issued identification number, financial information, criminal background, location information, photographs, biometric information, or employment history associated with the covered individual; (B)any information related to the workplace activities with respect to the covered individual, including— (i)human resources information, including the contents of a personnel file or performance evaluation; (ii)work process information, such as productivity and efficiency information and information on breaks; (iii)information that captures workplace communications and interactions, including emails, texts, internal message boards, and customer interaction and ratings; (iv)device usage and information, including calls placed or precise geolocation information; (v)audio-video information and other information collected from sensors, including movement tracking, images, videos, and thermal-sensor information; (vi)biometric information; (vii)information from a personality test taken by a covered individual, including such a test given electronically at the beginning of or during a work shift; (viii)inputs for an automated decision system or any automated decision system output; and (ix)information that is collected or generated to mitigate the spread of infectious diseases, including COVID–19, or to comply with any public health measure; and (C)online information with respect to the covered individual that is collected while the covered individual is on- or off-duty, including any internet protocol address associated with the covered individual, the social media activity of the covered individual, any advertisement-related tracking identifier associated with the covered individual, the internet browsing history of the covered individual, or other digital sources or unique identifiers associated with the covered individual. (9)

Employ

The term employ has the meaning given such term in section 3 of the Fair Labor Standards Act of 1938 (29 U.S.C. 203). (10)

Employer

(A)

In general

The term employer means any person who is— (i) (I)a covered employer who is not described in any other subclause of this clause; (II)an entity employing a State employee described in section 304(a) of the Government Employee Rights Act of 1991 (42 U.S.C. 2000e–16c(a)); (III)an employing office, as defined in section 101 of the Congressional Accountability Act of 1995 (2 U.S.C. 1301); (IV)an employing office, as defined in section 411(c) of title 3, United States Code; or (V)an employing agency covered under subchapter V of chapter 63 of title 5, United States Code; and (ii)engaged in commerce (including government), or an industry or activity affecting commerce (including government). (B)

Covered employer

In subparagraph (A), the term covered employer— (i)means any person engaged in commerce or in any industry or activity affecting commerce who employs, or otherwise engages for the performance of work for remuneration, 11 or more covered individuals; (ii)includes— (I)any person who acts, directly or indirectly, in the interest of a covered employer in relation to any individual performing work for remuneration for such covered employer; (II)any successor in interest of a covered employer; (III)any public agency; and (IV)the Government Accountability Office and the Library of Congress; and (iii)does not include any labor organization (other than when acting as an employer) or anyone acting in the capacity of officer or agent of such labor organization. (C)

Public agency

For purposes of this paragraph, a public agency shall be considered to be a person engaged in commerce or in an industry or activity affecting commerce. (D)

Definitions

For purposes of this paragraph, the terms commerce, person, and public agency have the meanings given the terms in section 3 of the Fair Labor Standards Act of 1938 (29 U.S.C. 203). (11)

Employment-related decision

The term employment-related decision includes a decision by an employer with regard to— (A)hiring a covered individual (including any decision with regard to interviewing or reviewing an applicant); (B)firing, taking a disciplinary action against, demoting, or reassigning duties of a covered individual; or (C)any other term, condition, or privilege of employment or work of the covered individual, such as relating to pay, scheduling, or hours worked or promoting a covered individual. (12)

Government entity

The term government entity means— (A)a Federal agency (as such term is defined in section 3371 of title 5, United States Code); (B)a State or political subdivision thereof; (C)any agency, authority, or instrumentality of a State or political subdivision thereof; or (D)a Tribal government or political subdivision thereof. (13)

Indian Tribe

The term Indian Tribe means any Indian or Alaska Native tribe, band, nation, pueblo, village, community, component band, or component reservation individually identified (including parenthetically) in the list published most recently as of the date of enactment of this Act pursuant to section 104 of the Federally Recognized Indian Tribe List Act of 1994 (25 U.S.C. 5131). (14)

Labor organization

The term labor organization has the meaning given the term in section 2(5) of the National Labor Relations Act (29 U.S.C. 152(5)), except that such term shall also include— (A)any organization composed of labor organizations, such as a labor union federation or a State or municipal labor body; and (B)any organization which would be included in the definition for such term under such section 2(5) but for the fact that the organization represents— (i)individuals employed by the United States, any wholly owned Government corporation, any Federal Reserve Bank, or any State or political subdivision thereof; (ii)individuals employed by persons subject to the Railway Labor Act (45 U.S.C. 151 et seq.); or (iii)individuals employed as agricultural laborers. (15)

Precise geolocation information

(A)

In general

The term precise geolocation information means information that is derived from a device or technology that reveals the past or present physical location of an individual or a device that identifies or is linked or reasonably linkable to 1 or more individuals, with sufficient precision to identify street level location information of the individual or device or the location of the individual or device within a range of 1,850 feet or less. (B)

Exclusion

The term precise geolocation information does not include information described in subparagraph (A) identifiable or derived solely from the visual content of a legally obtained image, including the location of the device that captured such image. (16)

Predispute arbitration agreement

The term predispute arbitration agreement means any agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement. (17)

Predispute joint-action waiver

The term predispute joint-action waiver means an agreement, whether or not part of a predispute arbitration agreement, that would prohibit, or waive the right of, one of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other forum, concerning a dispute that has not yet arisen at the time of the making of the agreement. (18)

Secretary

The term Secretary means the Secretary of Labor. (19)

Sell

The term sell, with respect to data, means the transfer of such data for monetary consideration or for a thing of value by an employer to a third party for the purpose of processing, maintaining, or further transferring such data. (20)

Service provider

The term service provider, with respect to an employer, means a person that— (A)collects, processes, conveys, or maintains data with respect to such employer only at the direction of, in accordance with the direction of, and pursuant to a written contract with the employer (including any terms of service or service agreements); (B)does not earn revenue from such collection, processing, conveyance, or maintenance of such data, except from the employer by providing contracted services to the employer with regard to such collection, processing, conveyance, or maintenance of such data; and (C)does not combine or link data associated with such employer with data associated with another employer. (21)

Social media activity

The term social media activity means any activity on an individual platform-based account. (22)

State

The term State means each of the several States of the United States, the District of Columbia, or any territory or possession of the United States. (23)

State attorney general

The term State attorney general means— (A)with respect to a State, the attorney general or chief law enforcement officer of the State, or another official or agency designated by the State to bring civil actions on behalf of the State or the residents of the State; and (B)with respect to a Tribal government, the attorney general or chief law enforcement officer of the Tribal government, or another official or agency designated by the Tribal government to bring civil actions on behalf of the Tribal government or the Indian Tribe of the Tribal government. (24)

State privacy regulator

The term State privacy regulator means— (A)the chief consumer protection officer of a State; or (B)a State consumer protection agency with expertise in data protection, including the California Privacy Protection Agency. (25)

Technologist

The term technologist means an individual with experience in fields related to computational technology, or the technology industry that produces computational technology, such as advertising technology, application development, artificial intelligence, computer science, cybersecurity, data science, digital forensics, human-centered design, product management, prototyping, service design, socio-technical systems, software engineering, user experience, or privacy rights, civil liberties, or civil rights related to technology. (26)

Third party

The term third party, with respect to an employer, means a person or entity— (A)to which such employer transfers or is able to transfer data, including any subsidiary or corporate affiliate of such employer; and (B)that is not— (i)such employer; (ii)a service provider of such employer with respect to the data being transferred; or (iii)a government entity. (27)

Transfer

The term transfer, with respect to data, means releasing, sharing, leasing, disseminating, disclosing, making available, or otherwise causing to be communicated, such data— (A)to a third party; or (B)in the case of a third party that releases, shares, leases, disseminates, discloses, makes available, or otherwise causes to be communicated, such data, to another person. (28)

Tribal government

The term Tribal government means the recognized governing body of an Indian Tribe. (29)

Workplace surveillance

The term workplace surveillance means any employer surveillance (on- or off-duty) with respect to a covered individual, including the detection, monitoring, interception, collection, exploitation, preservation, protection, transmission, or retention of data concerning activities or communications with respect to the covered individual, including through the use of a product or service marketed, or that can be used, for such purposes, such as a computer, telephone, wire, radio, camera, sensor, electromagnetic, photoelectronic, handheld or wearable device, or photo-optical system.

Disclosure of certain workplace surveillance

(a)

In general

An employer shall disclose, in accordance with subsections (b) and (c), to each covered individual described in subsection (b)(1) and publish in a manner that is conspicuous, freely accessible, and readily available for viewing by any such covered individual of the employer (including on the internet in a manner that is freely accessible and machine readable (in a form prescribed by the Secretary))— (1)any workplace surveillance on the covered individual by the employer, including— (A)what data are being collected; (B)how the data are being collected; (C)where and when the data are being collected; (D)the frequency of the collection; (E)where the storage of the data is located; (F)the business purposes for which the data are being used; and (G)as applicable, the identity of any third party or service provider— (i)used for such workplace surveillance; (ii)to which data from such workplace surveillance is transferred; and (iii)from which data of the covered individual is or may be purchased or acquired; and (2)how such workplace surveillance affects employment-related decisions by the employer, including with regard to the assessment of the performance and productivity of the covered individual. (b)

Timing of disclosure

(1)

Initial disclosure

An employer shall provide the disclosure required under subsection (a)— (A)in the case of— (i)a covered individual for whom an employment-related decision with regard to the hiring of the covered individual was made on or after the effective date of this section, to the covered individual not later than 30 days after the date on which the employer makes such employment-related decision; or (ii)a covered individual who is employed by, or otherwise performing work for remuneration for, the employer on such effective date or a covered individual for whom an employment-related decision with regard to the hiring of the covered individual was made on or after the date that is 5 years prior to the effective date of this section but before such effective date, to the covered individual not later than 60 days after such effective date; and (B)to each applicant of the employer prior to accepting an application by the applicant to be employed by, or otherwise perform work for remuneration for, the employer. (2)

Subsequent disclosures

Not later than 7 days after any information provided by an employer to a covered individual through a disclosure required under subsection (a) changes or after any new information required to be provided in such a disclosure becomes available, the employer shall provide the covered individual with an updated disclosure in accordance with such subsection. (c)

Procedures for disclosure

An employer shall provide the disclosure required under subsection (a) in a manner required by the Administrator that is— (1)accessible; (2)in plain language and in the primary language of the covered individual provided the disclosure; (3)in writing and available electronically; (4)accountable; (5)tailored to the purpose of the disclosure; (6)tailored to the covered individual; and (7)tailored to the level of risk. (d)

Covered individual acknowledgment

An employer shall obtain written or electronic acknowledgment from each covered individual provided a disclosure under subsection (a) of the receipt of the disclosure by the covered individual. (e)

Worker data request and correction

An employer shall enable a covered individual, upon request by the covered individual or as provided in section 4(c), to— (1)not later than 7 days after such request, obtain any data collected by the employer on the covered individual through workplace surveillance; and (2)in accordance with procedures established by the Administrator, have any such data that is incomplete or erroneous updated or corrected at any time. (f)

Effective date

This section shall take effect on the date that is 60 days after the date of enactment of this Act.

Prohibition of certain workplace surveillance

(a)

In general

An employer or, as applicable, a third party or service provider that the employer uses for workplace surveillance may not— (1)use workplace surveillance to— (A)identify any covered individual who forms, joins, assists, or seeks to form, join, or assist, a labor organization; (B)monitor the activities of any covered individual concerning or related to a labor organization or with respect to engaging in protected concerted activity; (C)except as otherwise provided in law, ascertain any political opinion or activity, religious view, or other identity marker of the covered individual, that is unrelated to the performance of the job duties of the covered individual for the employer; (D)except as otherwise provided in law, collect information on or identify the health status, any health condition, or disability status of a covered individual, that is unrelated to the performance of the job duties of the covered individual for the employer; (E)except as otherwise required by law ascertain the immigration status of a covered individual; or (F)monitor the activities of any covered individual concerning or related to reporting the employer or such a third party or service provider for a violation of any other law, including monitoring for purposes of identifying a covered individual who has reported or intends to report the employer or such a third party or service provider; (2)use an automated decision system to predict behavior of a covered individual that is unrelated to the work of the covered individual for the employer; (3)use workplace surveillance to monitor a covered individual while the covered individual is off-duty or in a sensitive area, such as a restroom or locker room, location provided for the covered individual to express breast milk, or location provided for the covered individual to pray or participate in a religious activity; (4)use workplace surveillance on a covered individual in any manner that threatens the mental or physical health of the covered individual; (5)use data collected through workplace surveillance on a covered individual for a purpose that is not disclosed in accordance with section 3(a)(1)(F); or (6)sell or license data collected on a covered individual to any person (including a third party or service provider of the employer) or, except as otherwise provided in law, government entity. (b)

Transfer of personally identifiable data

(1)

Employer

An employer may not transfer data on a covered individual collected using workplace surveillance to a third party unless, for each instance of a transfer— (A)the employer— (i)discloses the transfer to the covered individual; and (ii)provides cybersecurity protections and encryption for the data; and (B)the covered individual does not opt out of the instance of the transfer. (2)

Third party

A third party that an employer uses for workplace surveillance may not transfer data on a covered individual, including any such data that was transferred to the third party by the employer in accordance with paragraph (1). (c)

Employment-Related decisions

An employer that makes an employment-related decision with regard to a covered individual using data from workplace surveillance shall— (1)not later than 7 days after making such an employment-related decision, disclose to the covered individual that such employment-related decision was made using data from workplace surveillance; and (2)not later than 7 days after such disclosure, enable the covered individual to— (A)review such data and related aggregated data for other similarly situated covered individuals of the employer; and (B)in accordance with the procedures described in section 3(e)(2), have any data described in paragraph (1) that is incomplete or erroneous updated or corrected. (d)

Minimization

(1)

Collection

An employer may not collect data on a covered individual that is not reasonably related to operations of the employer. (2)

Employee access

An employer shall restrict access to data on a covered individual by another covered individual of the employer based on the specific and reasonable business rationale of the employer that is proportionate to the need for such access. (e)

Employer contracts with any third party or service provider that the employer uses for workplace surveillance

An employer that uses a third party or service provider for workplace surveillance shall include in any contract between the employer and such third party or service provider entered into after the effective date of this section an agreement to comply with the requirements of this section. (f)

Effective date

This section shall take effect on the date that is 60 days after the date of enactment of this Act.

Establishment of privacy and technology division

(a)

In general

There is established in the Department of Labor the Privacy and Technology Division. (b)

Administrator of the privacy and technology division

The President shall appoint an Administrator of the Privacy and Technology Division to head the Privacy and Technology Division. (c)

Employees and advisory boards of the Division

(1)

In general

The Administrator— (A)may select, appoint, and employ, without regard to the provisions of sections 3309 through 3318 of title 5, United States Code, individuals, including technologists, directly to positions in the competitive service, as defined in section 2102 of such title, to carry out the duties of the Administrator under this Act; and (B)may fix the compensation of the individuals described in subparagraph (A) without regard to chapter 51 and subchapter III of chapter 53 of title 5, United States Code, relating to classification of positions and General Schedule pay rates, except that the rate of pay for such individuals may not exceed the rate payable for level V of the Executive Schedule under section 5316 of that title. (2)

Advisory boards

(A)

Establishment

The Administrator shall establish the following advisory boards to advise and consult with in the exercise of the functions of the Administrator under this Act and to provide information on emerging practices relating to the treatment of data by employers: (i)The User Advisory Board, which shall be composed of experts in consumer protection, privacy, civil rights, disability law, labor organizations, and ethics. (ii)The Research Advisory Board, which shall be composed of individuals with academic and research expertise in privacy, cybersecurity, computer science, innovation, design, ethics, economics, law, disability law, labor organizations and public policy and representatives of labor organizations. (iii)The Product Advisory Board, which shall be composed of technologists, computer scientists, designers, product managers, attorneys, representatives of labor organizations, workplace technology experts, and other representatives of employers and employees. (iv)The Labor Advisory Board, which shall be composed of representatives of labor organizations and representatives of workers. (B)

Appointments

The Administrator shall appoint members to the advisory boards established under subparagraph (A) without regard to party affiliation. (C)

Meetings

Each advisory board established under subparagraph (A) shall meet— (i)at the call of the Administrator; and (ii)not less than 2 times annually. (D)

Compensation and travel expenses

A member of an advisory board established under subparagraph (A) who is not an officer or employee of the Federal Government shall— (i)be entitled to receive compensation at a rate fixed by the Administrator while attending meetings of the advisory board, including travel time; and (ii)receive travel expenses, including per diem in lieu of subsistence, in accordance with applicable provisions under subchapter I of chapter 57 of title 5, United States Code. (E)

Exemption from the Federal Advisory Committee Act

Each advisory board established under subparagraph (A) shall be exempt from chapter 10 of title 5, United States Code (commonly known as the Federal Advisory Committee Act). (3)

Use of voluntary services

The Administrator may, as may from time to time be needed, use any voluntary or uncompensated services. (4)

Attorneys

Attorneys appointed under this subsection may appear for and represent the Administrator in any litigation. (d)

Offices

(1)

In general

The principal office of the Privacy and Technology Division shall be in the District of Columbia. (2)

Regional, local, and other offices

The Administrator may establish regional, local, or other offices, including an office in the city of San Francisco, California, or the San Francisco Bay area in California. (e)

Orders and guidance

(1)

In general

The Secretary, acting through the Administrator and the Administrator of the Wage and Hour Division, may issue orders and guidance, as may be necessary or appropriate to enable the Secretary to carry out the purposes and objectives of this Act, and to prevent evasions thereof. (2)

Consultation

In issuing orders and guidance authorized under this subsection, the Secretary, acting through the Administrator and the Administrator of the Wage and Hour Division, may consult with Federal agencies that have jurisdiction over Federal privacy laws or expertise in privacy, including the Federal Trade Commission, and Federal agencies that have jurisdiction over labor and employment issues, including the Equal Employment Opportunity Commission, the National Labor Relations Board, the National Mediation Board, and the Merit Systems Protection Board.

Regulations

(a)

In general

(1)

Authority

(A)

In general

Except as provided in paragraph (2), the Secretary, acting through the Administrator in consultation with the Administrator of the Wage and Hour Division, may prescribe such regulations as may be necessary to carry out this Act with respect to covered individuals described in section 2(7)(A) (other than covered individuals described in clauses (iii) through (v) of such section) and other individuals affected by employers described in subclause (I) or (II) of section 2(10)(A)(i), including individuals who are covered individuals described in section 2(7)(B) with respect to such employers. (B)

Consultation

In prescribing any regulations authorized under this paragraph, the Secretary, acting through the Administrator, may consult with Federal agencies that have jurisdiction over Federal privacy laws or expertise in privacy, including the Federal Trade Commission, and Federal agencies that have jurisdiction over labor and employment issues, including the Equal Employment Opportunity Commission and the National Labor Relations Board. (2)

Government accountability office; library of congress

The Comptroller General of the United States and the Librarian of Congress shall prescribe any regulations described in paragraph (1)(A) with respect to covered individuals of the Government Accountability Office and the Library of Congress, respectively, and other individuals affected by the Comptroller General of the United States and the Librarian of Congress, respectively. (b)

Employees covered by congressional accountability act of 1995

(1)

Authority

Not later than 45 days after the Secretary prescribes any regulation under subsection (a)(1)(A), the Board of Directors of the Office of Compliance shall prescribe (in accordance with section 304 of the Congressional Accountability Act of 1995 (2 U.S.C. 1384)) such regulations as may be necessary to carry out this Act with respect to covered individuals described in section 2(7)(A)(iii) and other individuals affected by employers described in section 2(10)(A)(i)(III), including individuals who are covered individuals described in section 2(7)(B) with respect to such employers. (2)

Agency regulations

The regulations prescribed under paragraph (1) shall be the same as substantive regulations promulgated by the Secretary under subsection (a)(1)(A) except insofar as the Board may determine, for good cause shown and stated together with the regulations prescribed under paragraph (1), that a modification of such regulations would be more effective for the implementation of the rights and protections involved under this section. (c)

Employees covered by chapter 5 of title 3, united states code

(1)

Authority

Not later than 45 days after the Secretary prescribes any regulation under subsection (a)(1)(A), the President (or the designee of the President) shall prescribe such regulations as may be necessary to carry out this Act with respect to covered individuals described in section 2(7)(A)(iv) and other individuals affected by employers described in section 2(10)(A)(i)(IV), including individuals who are covered individuals described in section 2(7)(B) with respect to such employers. (2)

Agency regulations

The regulations prescribed under paragraph (1) shall be the same as substantive regulations promulgated by the Secretary under subsection (a)(1)(A) except insofar as the President (or designee) may determine, for good cause shown and stated together with the regulations prescribed under paragraph (1), that a modification of such regulations would be more effective for the implementation of the rights and protections involved under this section. (d)

Employees covered by chapter 63 of title 5, united states code

(1)

Authority

Not later than 45 days after the Secretary prescribes any regulation under subsection (a)(1)(A), the Director of the Office of Personnel Management shall prescribe such regulations as may be necessary to carry out this Act with respect to covered individuals described in section 2(7)(A)(v) and other individuals affected by employers described in section 2(10)(A)(i)(V), including individuals who are covered individuals described in section 2(7)(B) with respect to such employers. (2)

Agency regulations

The regulations prescribed under paragraph (1) shall be the same as substantive regulations promulgated by the Secretary under subsection (a)(1)(A) except insofar as the Director may determine, for good cause shown and stated together with the regulations prescribed under paragraph (1), that a modification of such regulations would be more effective for the implementation of the rights and protections involved under this section.

Whistleblower protections

No employer shall discriminate or retaliate (including through intimidation, threats, coercion, or harassment) against any covered individual of the employer— (1)for exercising, or attempting to exercise, any right provided under this Act; or (2)because the covered individual (or another individual acting at the request of the covered individual) has— (A)filed a written or oral complaint to the employer or a Federal, State, or local government entity of a violation of section 3 or 4; (B)sought assistance or intervention with respect to a worker privacy-related concern from the employer, a Federal, State, or local government, or a worker representative; (C)instituted, caused to be instituted, or otherwise participated in any inquiry or proceeding under or related to this Act; (D)given, or is about to give, any information in connection with any inquiry or proceeding relating to any right provided under this Act; or (E)testified, or is about to testify, in any inquiry or proceeding relating to any right provided under this Act.

Enforcement

(a)

In general

(1)

Definition

For purposes of this subsection: (A)

Covered individual

The term covered individual means a covered individual— (i)described in section 2(7)(A) (other than covered individuals described in clauses (iii) through (v) of such section); or (ii)described in section 2(7)(B) with respect to an employer. (B)

Employer

The term employer means an employer described in subclause (I) or (II) of section 2(10)(A)(i). (2)

Enforcement by the privacy and technology division

(A)

Investigation

(i)

In general

To ensure compliance with the provisions of this Act, or any regulation or order issued under this Act, the Secretary, acting through the Administrator— (I)shall have the investigative authority provided under section 11(a) of the Fair Labor Standards Act of 1938 (29 U.S.C. 211(a)), with respect to employers, covered individuals, and third parties and service providers with respect to employers; and (II)may require, by general or special orders, an employer or third party or service provider with respect to the employer, to file with the Secretary, in such form as the Secretary may prescribe, annual or special reports or answers in writing to specific questions, furnishing to the Secretary such information or records as the Secretary may require as to the organization, business, conduct, practices, management, and relation to other corporations, partnerships, and individuals, of the employer. (ii)

Reports and answers

An employer or third party or service provider with respect to the employer shall file the reports and answers (including information and records) required under clause (i)(II) in such manner, including under oath or otherwise, and within such reasonable time period as the Secretary may require. (iii)

Joint investigations

The Secretary, acting through the Administrator, may conduct investigations and make requests for information, as authorized under this Act, on a joint basis with another Federal agency, a State attorney general, or a State agency. (iv)

Obligation to keep, preserve, and make available records

An employer or third party or service provider with respect to the employer shall make, keep, preserve, and make available to the Secretary records pertaining to compliance with this Act in accordance with section 11(c) of the Fair Labor Standards Act of 1938 (29 U.S.C. 211(c)) and in accordance with any regulation or order issued by the Secretary. (B)

Enforcement

With respect to employers, covered individuals, and third parties and service providers with respect to employers, the Secretary, acting through the Administrator, shall receive, investigate, and attempt to resolve complaints of violations of section 3, 4, or 7 in the same manner that the Secretary receives, investigates, and attempts to resolve complaints of violations of sections 6 and 7 of the Fair Labor Standards Act of 1938 (29 U.S.C. 206 and 207). (C)

Priority

For purposes of subparagraphs (A) and (B), the Secretary shall prioritize industries with high rates of workplace surveillance and at high risk of workplace-surveillance-related health impacts. (D)

Referral for criminal proceedings

If the Secretary, in the course of the performance of any act or duty under this Act, obtains evidence that any employer has engaged in conduct that may constitute a violation of Federal criminal law, the Secretary shall refer the matter to the Attorney General for prosecution under any applicable law. Nothing in this paragraph shall affect any other authority of the Secretary to disclose information. (E)

Litigation

The Solicitor of Labor may appear for and represent the Secretary on any litigation brought under this subsection. (3)

Private right of action

(A)

In general

(i)

Covered individual

Notwithstanding any action by the Secretary under paragraph (2)(B), any covered individual adversely affected by an alleged violation of section 3, 4, or 7, may commence a civil action against any person that violates such section in any Federal court of competent jurisdiction. (ii)

Labor organization

Notwithstanding any action by the Secretary under paragraph (2)(B), any labor organization adversely affected by an alleged violation of 4 or 7 may commence a civil action against any person that violates such section in any Federal court of competent jurisdiction. (B)

Relief

(i)

In general

In a civil action brought under subparagraph (A) in which the covered individual or labor organization prevails, the court may award the covered individual or labor organization— (I)damages of— (aa)an amount equal to the sum of any actual damages sustained by the covered individual; or (bb)not more than treble damages; (II)statutory damages described in clause (iv); (III)injunctive relief; and (IV)equitable relief. (ii)

Attorney's fees

In a civil action brought under subparagraph (A) in which the covered individual or labor organization prevails, the court shall award the covered individual or labor organization reasonable attorney's fees and litigation costs. (iii)

Temporary relief for whistleblowers

In a civil action brought under subparagraph (A) regarding a violation of section 7, the court may award the covered individual or labor organization temporary relief while the case is pending, including reinstatement. (iv)

Statutory damages

The court may, in accordance with clause (v), award statutory damages under clause (i)(II) against a person in the following amounts: (I)

Failure to comply with disclosure requirements

For a violation of section 3, the court may award— (aa)for the first such violation, damages of an amount not more than $500 for each covered individual impacted; and (bb)for any subsequent violation, damages for each covered individual impacted in an amount of not more than $500 more than the amount of the damages awarded per covered individual for the violation immediately preceding such subsequent violation. (II)

Using surveillance data for prohibited activities

For each violation of section 4, the court may award— (aa)damages of an amount not less than $5,000 and not more than $20,000; or (bb)for any willful or repeated violation, damages of an amount not less than $10,000 and not more than $40,000. (III)

Retaliation on whistleblowers

For each violation of section 7, the court may award— (aa)damages of an amount not less than $5,000 and not more than $50,000; or (bb)for any willful or repeated violation, damages of an amount not less than $10,000 and not more than $100,000. (v)

Considerations for statutory damages

In determining the amount of statutory damages assessed under clause (iv), the court shall consider any relevant circumstances presented by the parties to the action, including— (I)the nature and seriousness of the violation; (II)the number of violations; (III)the persistence of the misconduct; (IV)the length of time over which the misconduct occurred; (V)the willfulness of the misconduct of person; and (VI)the assets, liabilities, and net worth of the person. (C)

Rights of the Secretary and a State attorney general

Prior to an covered individual or labor organization bringing a civil action under subparagraph (A), such covered individual or labor organization shall, in writing, notify the Secretary and any relevant State attorney general of the intent to commence such civil action. Upon receiving such notice, the Secretary and State attorney general shall each, not later than 60 days after receiving such notice— (i)determine whether to intervene in such action and, upon intervening— (I)be heard on all matters arising in such action; and (II)file petitions for appeal of a decision in such action; and (ii)notify such covered individual or labor organization. (D)

Remedies for state employees

(i)

Waiver of sovereign immunity

A State’s receipt or use of Federal financial assistance for any program or activity of a State shall constitute a waiver of sovereign immunity, under the 11th Amendment to the Constitution of the United States or otherwise, to a suit brought by a covered individual of that program or activity, or a labor organization representing such a covered individual, under this paragraph for equitable, legal, or other relief authorized under this paragraph. (ii)

Official capacity

An official of a State may be sued in the official capacity of the official by any covered individual or such a labor organization who has complied with the procedures under this paragraph, for injunctive relief that is authorized under this paragraph. In such a suit the court may award to the prevailing party those costs authorized by section 722 of the Revised Statutes (42 U.S.C. 1988). (iii)

Applicability

With respect to a particular program or activity, clause (i) applies to conduct that occurs— (I)after the date of enactment of this Act; and (II)on or after the day on which a State first receives or uses Federal financial assistance for that program or activity. (iv)

Definition of program or activity

In this subparagraph, the term program or activity has the meaning given the term in section 606 of the Civil Rights Act of 1964 (42 U.S.C. 2000d–4a). (E)

Remedies for Tribal government employees

(i)

Waiver of sovereign immunity

A Tribal government's receipt or use of Federal financial assistance for any program or activity of the Tribal government shall constitute a waiver of sovereign immunity to a suit brought by a covered individual of that program or activity, or a labor organization representing such a covered individual, under this paragraph for equitable, legal, or other relief authorized under this paragraph. (ii)

Official capacity

An official of a Tribal government may be sued in the official capacity of the official by any covered individual or such a labor organization who has complied with the procedures under this paragraph for injunctive relief that is authorized under this paragraph. In such a suit the court may award to the prevailing party those costs authorized by section 722 of the Revised Statutes (42 U.S.C. 1988). (iii)

Applicability

With respect to a particular program or activity, clause (i) applies to conduct that occurs— (I)after the date of enactment of this Act; and (II)on or after the day on which a Tribal government first receives or uses Federal financial assistance for that program or activity. (iv)

Definition of program or activity

In this subparagraph, the term program or activity has the meaning given the term in section 606 of the Civil Rights Act of 1964 (42 U.S.C. 2000d–4a). (4)

Enforcement by the government accountability office and library of congress

Notwithstanding any other provision of this subsection, in the case of the Government Accountability Office and the Library of Congress, the authority of the Secretary under this subsection shall be exercised respectively by the Comptroller General of the United States and the Librarian of Congress, respectively. (b)

Employees covered by congressional accountability act of 1995

The powers, remedies, and procedures provided in the Congressional Accountability Act of 1995 (2 U.S.C. 1301 et seq.) to the Board (as defined in section 101 of that Act (2 U.S.C. 1301)), or any person, alleging a violation of section 202(a)(1) of that Act (2 U.S.C. 1312(a)(1)) shall be the powers, remedies, and procedures this Act provides to that Board, or any person, with regard to an allegation of a violation of section 3, 4, or 7 against a covered individual described in section 2(7)(A)(iii) or described in section 2(7)(B) with respect to an employer described in section 2(10)(A)(i)(III). (c)

Employees covered by chapter 5 of title 3, united states code

The powers, remedies, and procedures provided in chapter 5 of title 3, United States Code, to the President, the Merit Systems Protection Board, or any person, alleging a violation of section 412(a)(1) of that title, shall be the powers, remedies, and procedures this Act provides to the President, that Board, or any person, respectively, with regard to an allegation of a violation of section 3, 4, or 7 against a covered individual described in section 2(7)(A)(iv) or described in section 2(7)(B) with respect to an employer described in section 2(10)(A)(i)(IV). (d)

Employees covered by chapter 63 of title 5, united states code

The powers, remedies, and procedures provided in title 5, United States Code, to an employing agency, provided in chapter 12 of that title to the Merit Systems Protection Board, or provided in that title to any person, alleging a violation of chapter 63 of that title, shall be the powers, remedies, and procedures this Act provides to that agency, that Board, or any person, respectively, with regard to an allegation of a violation of section 3, 4, or 7 against a covered individual described in section 2(7)(A)(v) or described in section 2(7)(B) with respect to an employer described in section 2(10)(A)(i)(V). (e)

Enforcement by States

(1)

In general

In any case in which a State attorney general or a State privacy regulator has reason to believe that an interest of the residents of a State has been or is adversely affected by any person who violates any provision of section 3, 4, or 7, including a regulation or order prescribed under this Act, the State attorney general or State privacy regulator, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to— (A)enjoin further violation of such provision by the person; (B)compel compliance with such provision; (C)obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the State; or (D)obtain reasonable attorney's fees and other litigation costs reasonably incurred. (2)

Rights of agency

Before initiating a civil action under paragraph (1), the State attorney general or State privacy regulator, as the case may be, shall notify the Secretary in writing of such civil action. Upon receiving such notice, the Secretary may— (A)intervene in such action; and (B)upon intervening— (i)be heard on all matters arising in such civil action; and (ii)file petitions for appeal of a decision in such action. (3)

Preemptive action by agency

In any case in which a civil action is instituted by or on behalf of the Secretary for violation of this Act or a regulation promulgated under this Act, a State attorney general or State privacy regulator may not, during the pendency of such action, institute a civil action against any defendant named in the complaint in the action instituted by or on behalf of the Secretary for a violation that is alleged in such complaint. In a case brought by the Secretary that affects the interests of a State, the State attorney general or State privacy regulator may intervene as of right pursuant to the Federal Rules of Civil Procedure. (4)

Preservation of state powers

Except as provided in paragraph (3), no provision of this subsection shall be construed as altering, limiting, or affecting the authority of a State attorney general or State privacy regulator to— (A)bring an action or other regulatory proceeding arising solely under the laws in effect in that State; or (B)exercise the powers conferred on the State attorney general or State privacy regulator by the laws of the State, including the ability to conduct investigations, administer oaths or affirmations, or compel the attendance of witnesses or the production of documentary or other evidence. (f)

Liability of an employer for a violation by a third party or service provider that the employer uses for workplace surveillance

A violation of section 4 by a third party or service provider that the employer uses for workplace surveillance shall be considered a violation of such section by the employer if the employer knew or should have known about such violation. (g)

Arbitration and class action

Notwithstanding any other provision of law, no predispute arbitration agreement or predispute joint-action waiver shall be valid or enforceable with respect to any alleged violation of section 3, 4, or 7.

Report to Congress on workplace surveillance

The Secretary, acting through the Administrator, shall— (1)using technologists and subject matter experts, conduct a study on workplace surveillance on covered individuals by employers, including such workplace surveillance through technological means; and (2)not later than 1 year after the date of enactment of this Act, and annually thereafter, submit to Congress, and make publicly available, a report on the findings of the study under paragraph (1), including any recommendations for the President and Congress targeted at reducing harms related to workplace surveillance on covered individuals.

10.

Coordination

In carrying out this Act, the Secretary, acting through the Administrator, shall coordinate with any appropriate Federal agency or State regulator to promote consistent regulatory treatment of workplace surveillance.

11.

Relation to other laws

Except as explicitly provided otherwise, nothing in this Act shall be construed to preempt, modify, limit, or supersede— (1)any provision of Federal or State law; or (2)the authority of the Federal Trade Commission, Equal Employment Opportunity Commission, National Labor Relations Board, or any other Federal agency.

12.

Severability

If any provision of this Act or the application of such provision to any person or circumstance is held to be unconstitutional, the remainder of this Act and the application of the provisions of such to all other persons or circumstances shall not be affected thereby.