Stop Spying Bosses Act
- Sponsor
- Rep. Deluzio, Christopher R. [D-PA-17]
- Committees
- Committee on House Administration (primary)
- Last action
- Jun 23, 2026
Bottom line
The Stop Spying Bosses Act aims to significantly restrict employer data collection and surveillance, enhance worker privacy rights, and establish new federal oversight for workplace technology.
What it actually does
This bill establishes comprehensive regulations on employer surveillance and data collection practices concerning employees and applicants. It prohibits certain types of data collection, mandates extensive disclosures to workers, grants workers rights to access and correct their data, and creates a new Worker Protection and Technology Division within the Department of Labor to enforce these provisions. The bill also includes whistleblower protections and establishes a private right of action for violations.
Proponents argue
Proponents argue that this bill is essential to protect workers from increasingly intrusive and potentially discriminatory surveillance technologies used by employers. They contend that unchecked data collection can undermine worker organizing efforts, lead to unfair work-related decisions, and infringe on personal privacy, creating a chilling effect on employee rights and well-being. Supporters believe the bill will restore a necessary balance of power in the workplace and ensure dignity for all workers.
Opponents contend
Opponents might argue that the bill imposes overly burdensome compliance requirements on businesses, stifling innovation and increasing operational costs. They may contend that employers need to collect certain data for legitimate purposes such as productivity monitoring, quality control, security, and compliance with other laws. Critics could also raise concerns that the broad prohibitions and strict disclosure rules could hinder an employer's ability to manage their workforce effectively and protect proprietary information, potentially leading to decreased efficiency and competitiveness.
The bill is moderately complex due to extensive definitions and detailed regulatory frameworks, requiring careful reading to grasp its full implications.
Section 3(a)
Prohibited Employee Data Collection and Usage
This section prohibits employers from collecting or using employee data for specific purposes, including identifying union activity, monitoring labor organization activities, ascertaining political/religious views or unrelated identity markers, determining health/disability status unrelated to job duties, or predicting behavior/emotions unrelated to work. It also bans collecting data while an individual is off-duty, such as in break rooms, restrooms, or their home, and prohibits data collection that threatens mental or physical health.
Supporters argue
Proponents argue that these prohibitions are crucial to prevent employers from using technology to suppress union organizing, discriminate based on protected characteristics, or monitor employees in ways that are invasive and harmful to their well-being and privacy. They contend that off-duty surveillance is a severe overreach that must be explicitly forbidden to protect personal space.
Critics contend
Opponents may argue that some of these prohibitions are too broad and could prevent employers from collecting data necessary for legitimate business operations, such as ensuring security, preventing fraud, or monitoring compliance with company policies. They might also contend that defining 'unrelated to job duties' could be ambiguous and lead to legal challenges, while off-duty prohibitions could be difficult to enforce for remote workers.
Tradeoffs
This provision balances worker privacy and protection against potential employer needs for operational oversight, security, and performance management. It creates a tension between the desire for a comprehensive ban on intrusive surveillance and the practical realities of managing a workforce in a data-driven environment.
Section 3(b)
Permissible Employee Data Collection Standards
This subsection outlines strict conditions under which employers may collect employee data. Data collection must not be otherwise prohibited, must be primarily used for specific legitimate purposes (e.g., essential job functions, quality assurance, periodic performance assessment, legal compliance, health/safety, wage administration), and must be strictly necessary, the least invasive means, limited to the fewest individuals, and collected no more frequently than necessary. Data retention is limited to three years after an individual's separation or application discontinuation.
Section 3(c)
Employee Data Transfer Restrictions
This section prohibits employers and service providers from selling or licensing employee data to any person. It also restricts the transfer of employee data to service providers, requiring disclosure to the covered individual, cybersecurity protections, encryption, and an explicit opt-in from the covered individual for each instance of transfer. Transfer to third parties is generally prohibited, except as required by law.
Section 4
Disclosure of Employee Data Collection and Usage
Employers are required to disclose to each covered individual, and publicly publish, detailed information about all employee data collected. This includes what data is collected, how, where, when, and its frequency, storage location, who has access, and the specific purposes for its collection and use. Employers must also disclose how this data affects work-related decisions, including performance and productivity assessments. Disclosures must be accessible, in plain language, in the individual's primary language, and updated promptly.
Section 5
Employee Data Access and Accuracy Rights
This section grants covered individuals the right to obtain any employee data collected on them by their employer within 30 days of a request. It also allows individuals to have incomplete or erroneous data updated or corrected at any time. When a work-related decision is made using employee data, the employer must disclose the categories of data used and allow the individual at least 7 days to review their data, compare it to aggregated data of similarly situated individuals, request corrections, and ask for reconsideration of the decision based on updated data.
Section 6
Establishment of Worker Protection and Technology Division
This section establishes a new Worker Protection and Technology Division within the Department of Labor, to be headed by an Administrator appointed by the President. The Administrator is authorized to hire staff, including technologists, and establish four advisory boards: a User Advisory Board (consumer protection, privacy, labor), a Research Advisory Board (academic, research expertise), a Product Advisory Board (technologists, industry experts), and a Labor Advisory Board (labor organizations, workers). These boards will advise on emerging practices and functions under the Act.
Section 8
Whistleblower Protections
This section prohibits employers from discriminating or retaliating against any covered individual for exercising their rights under this Act, or for making a complaint, seeking assistance, participating in an inquiry, or providing information related to a violation of the Act. Employers must also provide notice of these protections to all covered individuals in an accessible and plain language manner.
Section 9
Enforcement Mechanisms and Remedies
This section grants the Secretary of Labor, through the new Administrator, investigative and enforcement authority similar to the Fair Labor Standards Act. It establishes a private right of action, allowing adversely affected individuals or labor organizations to sue for violations of Sections 3, 4, 5, or 8 in federal court. Remedies include actual damages (at least double), statutory damages (ranging from $500 for disclosure violations to $100,000 for willful retaliation), injunctive relief, equitable relief, and attorney's fees. It waives sovereign immunity for states and tribal governments receiving federal financial assistance and prohibits predispute arbitration agreements and joint-action waivers for claims under the Act.
The definition of 'covered employer' includes any person who employs 11 or more covered individuals. This threshold determines which employers are subject to the Act's provisions.
Section 2(9)(B)(i)
Why it matters:This is standard legislative practice for defining terms that apply throughout the bill. It's not necessarily evasive but requires careful reading of the definitions.
Case for: Setting a minimum employee threshold ensures that very small businesses, which may have limited resources, are not unduly burdened by complex compliance requirements. It allows the Act to focus on larger employers with greater capacity for data collection and, potentially, greater impact on a larger number of workers.
Case against: Critics might argue that excluding businesses with fewer than 11 employees leaves a significant portion of the workforce unprotected from surveillance and data misuse, particularly in sectors where small businesses are prevalent. They may contend that worker privacy rights should not depend on employer size.
Estimated impact: Excludes a substantial number of small businesses from the direct regulatory scope of the Act, affecting potentially millions of workers employed by these entities.
Permissible employee data collection must be 'strictly necessary to accomplish such a purpose, exclusively used to accomplish the purpose, and is the least invasive means to the covered individual that could be used to accomplish the purpose'.
Section 3(b)(4)
Why it matters:This is a key operative clause within a list of conditions. While not overtly buried, its significance could be overlooked if not read carefully within the broader context of permissible collection.
Case for: Proponents argue this language is essential to prevent employers from collecting more data than truly needed or using less privacy-protective methods. It forces employers to justify their data practices rigorously and prioritize worker privacy by seeking the least intrusive alternatives.
Case against: Opponents may argue that 'strictly necessary' and 'least invasive means' are subjective and difficult to define in practice, creating legal ambiguity and making compliance challenging. Employers might struggle to prove they've chosen the 'least invasive' option, leading to increased litigation risk.
Estimated impact: Imposes a high legal and operational bar for all employer data collection, requiring significant justification and potentially technological re-evaluation for existing systems.
Notwithstanding any other provision of law, no predispute arbitration agreement or predispute joint-action waiver shall be valid or enforceable with respect to any alleged violation of section 3, 4, 5, or 8.
Section 9(g)
Why it matters:While not hidden, its placement at the end of a lengthy enforcement section means a casual reader might overlook its profound impact on how disputes are resolved. It's a critical policy choice that could be highlighted more prominently.
Case for: Proponents argue that forced arbitration clauses and joint-action waivers effectively strip workers of their ability to seek justice for privacy violations, often forcing them into a less transparent and employer-friendly forum. This provision ensures workers can pursue their claims in court, individually or collectively, providing a more equitable path to redress.
Case against: Opponents argue that arbitration is a more efficient, less costly, and faster alternative to litigation for resolving disputes. They contend that banning predispute arbitration agreements will lead to a surge in expensive and time-consuming lawsuits, burdening both employers and the judicial system, ultimately harming economic efficiency.
Estimated impact: Significantly alters the landscape of dispute resolution for workplace privacy claims, shifting cases from private arbitration to public courts and potentially enabling more class-action lawsuits.