Worker Data Privacy Rights

Summary#

This bill would limit how employers collect, use, and share data about workers. It bans many kinds of surveillance (for example, tracking union activity, off‑duty locations, political views, or immigration status). The bill also requires employers to tell workers what data they collect, give workers access to and correction of their data, and creates a new unit at the Department of Labor to enforce the rules.

• Main change: Prohibits employer collection or use of employee data for certain purposes (union activity monitoring, unrelated political/religious information, immigration status, off‑duty monitoring, and other sensitive uses) and sets strict limits on collection, retention, and transfers.
• Transparency: Employers must disclose what employee data they collect, how and when they collect it, who can access it, where it is stored, and how it affects work decisions. Disclosures must be clear, accessible, and posted publicly (including a machine‑readable form).
• Access and correction: Workers can request their data, get errors corrected, and review data used in any work‑related decision. Employers must allow a review period and let workers request reconsideration.
• Transfers and sales: Employers may not sell employee data. Transfers to service providers require disclosure, encryption, and the worker’s opt‑in consent. Transfers to third parties are generally banned.
• Enforcement: The bill creates a Worker Protection and Technology Division at the Department of Labor with investigatory authority, allows state enforcement, and gives workers and labor organizations a private right of action with statutory damages and injunctive relief. Predispute arbitration and class‑action waivers would not apply to these claims.

What it means for you#

• Workers (employees and applicants):

  • You would have to be told what employee data your employer collects and how it’s used.
  • You could request and receive your data within 30 days and ask that incorrect or incomplete data be fixed.
  • If an employer uses data to make a hiring, firing, or other work decision, you would be told the categories of data used and get at least 7 days to review and request reconsideration.
  • Employers could not collect information about your off‑duty activities in many common off‑duty places (home, restrooms, lactation spaces, religious spaces).
  • You could sue an employer for violations and seek damages, injunctive relief, and attorney’s fees.

• Applicants:

  • Before you submit an application, the employer must disclose what employee data it collects and how it will be used.

• Employers (private and many public employers):

  • You must stop certain kinds of data collection and restrict how you use and keep worker data.
  • You must publish clear disclosures and maintain records, provide access and correction processes, and delete most data three years after separation (unless law requires longer retention).
  • You cannot sell employee data. Transfers to outside vendors require worker opt‑in and encryption.
  • You may face investigations by the new Division, state enforcement actions, and private lawsuits with statutory damages for violations.

• Service providers and third parties:

  • Vendors that process employee data must follow contractual requirements and may be treated as causing employer liability if they violate the rules.
  • Transfers to third parties are mostly barred.

• Government agencies and public employers:

  • Several categories of public employers are covered. The bill assigns enforcement roles for specific federal entities (e.g., Comptroller General for GAO).
  • The Department of Labor would establish a new division and produce annual reports on workplace surveillance.

Expenses#

No publicly available information.

• The bill would require creating a new Worker Protection and Technology Division at the Department of Labor. That implies costs for staffing, offices, advisory boards, and operations, but no budget estimate is included in the bill text provided.
• Employers may incur compliance costs: rewriting policies, changing or removing monitoring systems, building disclosure and access systems, securing and deleting data, and obtaining worker opt‑in flows.
• Litigation costs could increase for employers because the bill allows private lawsuits and sets statutory damages ranges for various violations.
• States and state attorneys general could spend resources to enforce the law when they bring civil actions.
• The bill requires annual reports and studies, which will require staff time and contracting for technical expertise.

Proponents' View#

• The bill appears intended to protect worker privacy and limit intrusive workplace surveillance.
• The bill appears intended to prevent employers from using data to interfere with organizing, protected concerted activity, or other labor rights.
• Supporters may argue this improves transparency by making clear what data employers collect and how it is used.
• The bill could be seen as giving workers control: access, correction rights, and the ability to challenge automated or data‑driven work decisions.
• Establishing a specialized division and advisory boards could be seen as improving the government’s technical capacity to monitor workplace surveillance and produce guidance.

Opponents' View#

• One concern is the lack of a fiscal estimate in the bill text. It is unclear how much it would cost to stand up the new Division and to carry out enforcement.
• One concern is compliance burden on employers. The rules (disclosure, opt‑in transfers, limits on collection and retention, encryption requirements) could require new systems and legal work, which may be costly, especially for small employers.
• The bill uses phrases like “strictly necessary,” “least invasive,” and “primarily used” without detailed tests in the text. It is unclear how those standards would be applied in practice and could lead to litigation over interpretation.
• The opt‑in requirement for transfers to service providers and the ban on selling employee data could limit the use of external HR, analytics, or safety vendors, raising operational questions for employers that rely on third‑party tools.
• Statutory damages and the private right of action could raise the risk of costly lawsuits. It is unclear how courts would apply the damage ranges across different kinds of violations.
• It is unclear how the bill interacts in practice with other laws and agency rules that regulate similar topics (the bill states it does not preempt other laws but leaves coordination questions).