Stop Spying Bosses Act
- Sponsor
- Sen. Markey, Edward J. [D-MA]
- Committees
- Health, Education, Labor, and Pensions Committee (primary)
- Last action
- Jun 18, 2026
Bottom line
The bill aims to significantly enhance worker privacy and control over personal data by restricting employer surveillance, increasing transparency, and providing robust enforcement mechanisms.
What it actually does
This bill, the "Stop Spying Bosses Act," establishes a comprehensive framework to regulate employer surveillance and data collection practices. It prohibits employers from collecting certain types of employee data, such as information related to union activities, political opinions, or off-duty conduct, and sets strict conditions for permissible data collection. The bill mandates extensive disclosures to employees about data collection and usage, grants employees rights to access and correct their data, and establishes a new Worker Protection and Technology Division within the Department of Labor to oversee and enforce these provisions. It also creates a private right of action for violations and invalidates predispute arbitration agreements for claims under the Act.
Proponents argue
Proponents argue that the bill is a necessary response to the proliferation of intrusive workplace surveillance technologies and algorithmic management, which they contend erode worker privacy, facilitate discrimination, and suppress organizing efforts. They assert that the legislation will empower workers with greater control over their personal data, foster transparency in employment practices, and ensure that data collection is limited to what is strictly necessary for legitimate business functions, thereby promoting fairness and dignity in the workplace.
Opponents contend
Opponents may contend that the bill imposes excessive compliance costs and administrative burdens on employers, potentially hindering productivity, innovation, and economic competitiveness. They might argue that the broad definitions of "employee data" and strict limitations on collection and transfer could impede legitimate business operations, security measures, and performance management. Furthermore, critics are likely to raise concerns that the private right of action and the invalidation of predispute arbitration agreements could lead to a surge in litigation, increasing legal expenses and uncertainty for businesses.
The bill is moderately long and contains numerous detailed definitions and legal provisions. An informed reader would require significant time to fully grasp its implications, which may exceed the time typically allotted for reviewing legislative proposals.
Sec. 3
Employee Data Collection and Usage Prohibitions
This section establishes strict limits on what employee data employers can collect and how it can be used. It explicitly prohibits collection related to union activities, political views, health status unrelated to job duties, and off-duty activities. Any permissible data collection must be strictly necessary, the least invasive, limited in scope, and retained only as long as reasonably necessary, with a maximum of three years post-separation or application discontinuation.
Supporters argue
Proponents argue that these prohibitions are essential to protect workers from intrusive surveillance, prevent discrimination based on non-work-related characteristics, and safeguard fundamental rights like freedom of association and political expression. They assert that limiting data collection to what is strictly necessary ensures that employers focus on job performance rather than personal lives.
Critics contend
Opponents contend that these restrictions place an undue burden on employers, limiting their ability to monitor productivity, ensure workplace security, prevent fraud, and manage their workforce effectively. They may argue that some prohibited data, like health status, could be relevant for workplace safety or benefits administration, and that the 'off-duty' prohibition is overly broad.
Tradeoffs
The provision navigates the tension between an individual's right to privacy and an employer's legitimate business interests. It aims to prevent overreach by employers while acknowledging the need for some data collection for operational purposes, but the strictness of the prohibitions may be seen as limiting employer flexibility.
Sec. 3(c)
Data Selling and Transfer Restrictions
This provision explicitly bans employers and their service providers from selling or licensing employee data to any person. It further restricts transferring employee data to service providers, requiring disclosure to the covered individual, cybersecurity protections, encryption, and the covered individual's opt-in consent for each instance of transfer. Transfers to third parties are generally prohibited unless legally mandated.
Sec. 4
Comprehensive Employee Data Disclosure Requirements
This section mandates that employers provide detailed disclosures to each covered individual and publish them conspicuously. These disclosures must specify what employee data is collected, how, when, where, its frequency, storage location, who has access, the purposes of collection and use, and the identity of any third parties or service providers involved. Crucially, employers must also explain how collected data affects work-related decisions, and all disclosures must be accessible, in plain language, and tailored to the individual's job functions and risk level.
Sec. 5
Employee Data Access, Correction, and Decision Reconsideration
This section grants covered individuals the right to obtain any employee data collected on them within 30 days of request and to have incomplete or erroneous data updated or corrected at any time. Furthermore, if an employer uses employee data to make a work-related decision, they must disclose the categories of data used and allow the individual at least seven days to review that data, correct inaccuracies, and request reconsideration of the decision based on the updated information.
Sec. 6
Creation of Worker Protection and Technology Division
This section establishes a new Worker Protection and Technology Division within the Department of Labor, to be led by an Administrator appointed by the President. This division is authorized to hire specialized staff, including technologists, without typical civil service restrictions and with flexible compensation. It also mandates the creation of four advisory boards (User, Research, Product, Labor) composed of experts from various fields, including privacy, technology, labor organizations, and civil rights, to advise the Administrator on emerging practices and functions under the Act.
Sec. 9
Comprehensive Enforcement Mechanisms and Remedies
This section outlines robust enforcement powers for the Secretary of Labor, acting through the new Administrator, including investigative authority (similar to the Fair Labor Standards Act) and the ability to receive and resolve complaints. Crucially, it establishes a private right of action, allowing affected individuals and labor organizations to sue for violations, with remedies including actual and statutory damages, injunctive, and equitable relief. It also waives sovereign immunity for states and tribal governments receiving federal financial assistance, making them subject to these actions, and invalidates predispute arbitration agreements and joint-action waivers for claims under this Act.
Defines "employer" broadly to include private entities with 11 or more covered individuals, public agencies, the Government Accountability Office, the Library of Congress, and various federal and state employing offices, ensuring wide applicability of the Act.
Sec. 2(9)
Why it matters:While standard legislative practice to define terms upfront, the expansive nature of this definition is highly consequential for the bill's scope and the number of entities it will regulate.
Case for: Proponents argue that a broad definition is necessary to provide comprehensive protection to a wide range of workers across different sectors and employment arrangements, preventing loopholes that could exclude vulnerable populations from the Act's protections.
Case against: Critics might argue that including smaller employers (11+ individuals) or various government entities could impose disproportionate compliance burdens on organizations with limited resources, potentially leading to unintended negative economic impacts or administrative strain.
Estimated impact: Significantly expands the scope of federal worker privacy protections to a vast number of employers and workers, including many small businesses and public sector entities not typically covered by federal privacy laws.
Defines "employee data" expansively to include virtually any information that identifies or relates to a covered individual, encompassing personal identifiers, workplace activities, communications, device usage, biometric data, personality test results, automated decision system inputs/outputs, health data (including for infectious diseases), and online activity.
Sec. 2(10)
Why it matters:Standard legislative practice to define terms upfront, but the breadth of this definition is critical to the bill's overall scope and the types of information subject to its protections and regulations.
Case for: Proponents argue that a broad definition is essential to cover the full spectrum of modern surveillance technologies and data collection practices, preventing loopholes that could allow employers to circumvent the Act's protections by collecting data not explicitly listed.
Case against: Opponents may contend that such a broad definition could inadvertently capture data not intended for regulation, making compliance overly complex and potentially stifling innovation in workplace management tools, or creating ambiguity for employers trying to understand their obligations.
Estimated impact: Establishes a very wide scope for data subject to the bill's protections and regulations, encompassing nearly all forms of digital and physical information an employer might collect about a worker.
States that no predispute arbitration agreement or predispute joint-action waiver shall be valid or enforceable with respect to any alleged violation of the Act's core provisions (Sections 3, 4, 5, or 8).
Sec. 9(g)
Why it matters:While technically an enforcement mechanism, its placement at the end of the section might obscure its significant impact on legal recourse, as it fundamentally alters how disputes under this Act can be resolved.
Case for: Proponents argue this ensures workers can pursue their claims in court, individually or collectively, preventing employers from forcing disputes into arbitration, which is often seen as an employer-friendly forum that limits worker remedies and transparency.
Case against: Opponents contend that arbitration offers a more efficient, private, and less costly alternative to litigation for resolving disputes. They argue that invalidating these agreements undermines contractual freedom, increases court caseloads, and could lead to more protracted and expensive legal battles.
Estimated impact: Significantly shifts the landscape for dispute resolution regarding worker data privacy claims, favoring judicial processes over private arbitration and potentially enabling class-action lawsuits.