California 2025-2026 Regular Session

California Assembly Bill AB1221 Compare Versions

OldNewDifferences
1-Amended IN Assembly April 21, 2025 Amended IN Assembly March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 1221Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)February 21, 2025An act to add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment.LEGISLATIVE COUNSEL'S DIGESTAB 1221, as amended, Bryan. Workplace surveillance tools.Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would generally regulate the use of workplace surveillance tools and an employers use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a third party vendor, unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
1+Amended IN Assembly March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 1221Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)February 21, 2025An act to amend Section 1102.5 add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment. LEGISLATIVE COUNSEL'S DIGESTAB 1221, as amended, Bryan. Employment: whistleblowers. Workplace surveillance tools.Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, as specified. The bill would prohibit an employer from transferring, selling, or licensing worker data to a third party unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation.Existing law prohibits an employer from making, adopting, or enforcing any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties. Existing law defines specified terms for its purposes, as provided.This bill would make a nonsubstantive change to this provision.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.SECTION 1.Section 1102.5 of the Labor Code is amended to read:1102.5.(a)An employer, or any person acting on behalf of the employer, shall not make, adopt, or enforce any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, or from providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.(b)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for disclosing information, or because the employer believes that the employee disclosed or may disclose information, to a government or law enforcement agency, to a person with authority over the employee or another employee who has the authority to investigate, discover, or correct the violation or noncompliance, or for providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.(c)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for refusing to participate in an activity that would result in a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation.(d)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for having exercised their rights under subdivision (a), (b), or (c) in any former employment.(e)A report made by an employee of a government agency to their employer is a disclosure of information to a government or law enforcement agency pursuant to subdivisions (a) and (b).(f)(1)In addition to other remedies available, an employer is liable for a civil penalty not exceeding ten thousand dollars ($10,000) per employee for each violation of this section to be awarded to the employee who was retaliated against.(2)In assessing this penalty, the Labor Commissioner shall consider the nature and seriousness of the violation based on the evidence obtained during the course of the investigation. The Labor Commissioners consideration of the nature and seriousness of the violation shall include, but is not limited to, the type of violation, the economic or mental harm suffered, and the chilling effect on the exercise of employment rights in the workplace, and shall be considered to the extent evidence obtained during the investigation concerned any of these or other relevant factors.(g)This section does not apply to rules, regulations, or policies that implement, or to actions by employers against employees who violate, the confidentiality of the lawyer-client privilege of Article 3 (commencing with Section 950) of, or the physician-patient privilege of Article 6 (commencing with Section 990) of, Chapter 4 of Division 8 of the Evidence Code, or trade secret information.(h)An employer, or a person acting on behalf of the employer, shall not retaliate against an employee because the employee is a family member of a person who has, or is perceived to have, engaged in any acts protected by this section.(i)For the purposes of this section, employer or a person acting on behalf of the employer includes, but is not limited to, a client employer as defined in paragraph (1) of subdivision (a) of Section 2810.3 and an employer listed in subdivision (b) of Section 6400.(j)The court is authorized to award reasonable attorneys fees to a plaintiff who brings a successful action for a violation of these provisions.
22
3-Amended IN Assembly April 21, 2025 Amended IN Assembly March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 1221Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)February 21, 2025An act to add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment.LEGISLATIVE COUNSEL'S DIGESTAB 1221, as amended, Bryan. Workplace surveillance tools.Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would generally regulate the use of workplace surveillance tools and an employers use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a third party vendor, unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO
3+ Amended IN Assembly March 28, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 1221Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)February 21, 2025An act to amend Section 1102.5 add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment. LEGISLATIVE COUNSEL'S DIGESTAB 1221, as amended, Bryan. Employment: whistleblowers. Workplace surveillance tools.Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, as specified. The bill would prohibit an employer from transferring, selling, or licensing worker data to a third party unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation.Existing law prohibits an employer from making, adopting, or enforcing any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties. Existing law defines specified terms for its purposes, as provided.This bill would make a nonsubstantive change to this provision.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NO
44
5-Amended IN Assembly April 21, 2025 Amended IN Assembly March 28, 2025
6-
7-Amended IN Assembly April 21, 2025
85 Amended IN Assembly March 28, 2025
96
10-
7+Amended IN Assembly March 28, 2025
118
129 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION
1310
1411 Assembly Bill
1512
1613 No. 1221
1714
1815 Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)February 21, 2025
1916
2017 Introduced by Assembly Member Bryan(Coauthor: Assembly Member Elhawary)(Coauthor: Senator McNerney)
2118 February 21, 2025
2219
23-
24-
25-An act to add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment.
20+An act to amend Section 1102.5 add Part 5.7 (commencing with Section 1550) to Division 2 of the Labor Code, relating to employment.
2621
2722 LEGISLATIVE COUNSEL'S DIGEST
2823
2924 ## LEGISLATIVE COUNSEL'S DIGEST
3025
31-AB 1221, as amended, Bryan. Workplace surveillance tools.
26+AB 1221, as amended, Bryan. Employment: whistleblowers. Workplace surveillance tools.
3227
33-Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would generally regulate the use of workplace surveillance tools and an employers use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a third party vendor, unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.
28+Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.This bill would require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, as specified. The bill would prohibit an employer from transferring, selling, or licensing worker data to a third party unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation.Existing law prohibits an employer from making, adopting, or enforcing any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties. Existing law defines specified terms for its purposes, as provided.This bill would make a nonsubstantive change to this provision.
3429
3530 Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission.
3631
37-This bill would generally regulate the use of workplace surveillance tools and an employers use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a third party vendor, unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.
32+This bill would require an employer, at least 30 days before introducing a workplace surveillance tool, as defined, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define employer to include public employees, as specified. The bill would prohibit an employer from transferring, selling, or licensing worker data to a third party unless the vendor is under contract to analyze or interpret the worker data and certain other criteria are met. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology. The bill would require the Labor Commissioner to enforce the bills provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bills provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bills provisions to a civil penalty of $500 for each violation.
33+
34+Existing law prohibits an employer from making, adopting, or enforcing any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties. Existing law defines specified terms for its purposes, as provided.
35+
36+
37+
38+This bill would make a nonsubstantive change to this provision.
39+
40+
3841
3942 ## Digest Key
4043
4144 ## Bill Text
4245
43-The people of the State of California do enact as follows:SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
46+The people of the State of California do enact as follows:SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.SECTION 1.Section 1102.5 of the Labor Code is amended to read:1102.5.(a)An employer, or any person acting on behalf of the employer, shall not make, adopt, or enforce any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, or from providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.(b)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for disclosing information, or because the employer believes that the employee disclosed or may disclose information, to a government or law enforcement agency, to a person with authority over the employee or another employee who has the authority to investigate, discover, or correct the violation or noncompliance, or for providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.(c)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for refusing to participate in an activity that would result in a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation.(d)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for having exercised their rights under subdivision (a), (b), or (c) in any former employment.(e)A report made by an employee of a government agency to their employer is a disclosure of information to a government or law enforcement agency pursuant to subdivisions (a) and (b).(f)(1)In addition to other remedies available, an employer is liable for a civil penalty not exceeding ten thousand dollars ($10,000) per employee for each violation of this section to be awarded to the employee who was retaliated against.(2)In assessing this penalty, the Labor Commissioner shall consider the nature and seriousness of the violation based on the evidence obtained during the course of the investigation. The Labor Commissioners consideration of the nature and seriousness of the violation shall include, but is not limited to, the type of violation, the economic or mental harm suffered, and the chilling effect on the exercise of employment rights in the workplace, and shall be considered to the extent evidence obtained during the investigation concerned any of these or other relevant factors.(g)This section does not apply to rules, regulations, or policies that implement, or to actions by employers against employees who violate, the confidentiality of the lawyer-client privilege of Article 3 (commencing with Section 950) of, or the physician-patient privilege of Article 6 (commencing with Section 990) of, Chapter 4 of Division 8 of the Evidence Code, or trade secret information.(h)An employer, or a person acting on behalf of the employer, shall not retaliate against an employee because the employee is a family member of a person who has, or is perceived to have, engaged in any acts protected by this section.(i)For the purposes of this section, employer or a person acting on behalf of the employer includes, but is not limited to, a client employer as defined in paragraph (1) of subdivision (a) of Section 2810.3 and an employer listed in subdivision (b) of Section 6400.(j)The court is authorized to award reasonable attorneys fees to a plaintiff who brings a successful action for a violation of these provisions.
4447
4548 The people of the State of California do enact as follows:
4649
4750 ## The people of the State of California do enact as follows:
4851
49-SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
52+SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
5053
5154 SECTION 1. Part 5.7 (commencing with Section 1550) is added to Division 2 of the Labor Code, to read:
5255
5356 ### SECTION 1.
5457
55-PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
58+PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
5659
57-PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
60+PART 5.7. Workplace Surveillance Tools1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
5861
5962 PART 5.7. Workplace Surveillance Tools
6063
6164 PART 5.7. Workplace Surveillance Tools
6265
63-#### PART 5.7. Workplace Surveillance Tools
66+1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof. (2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.
6467
65-1550. As used in this part:(a) Agency means the Labor and Workforce Development Agency or any of its designees.(b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.(2) Authorized representative does not mean a workers employer.(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.(2) Employer includes an employers labor contractor.(d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.(e) Public prosecutor has the same meaning as defined in Section 180.(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.(f)(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.(g)(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.(h)(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.(i)(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.
68+
6669
6770 1550. As used in this part:
68-
69-###### 1550.
7071
7172 (a) Agency means the Labor and Workforce Development Agency or any of its designees.
7273
7374 (b) (1) Authorized representative means a person or organization appointed by the worker to serve as an agent of the worker.
7475
7576 (2) Authorized representative does not mean a workers employer.
7677
77-(c) (1) Employer means a person who or governmental entity that directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes worker, including all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.
78+(c) (1) Employer means a person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment, of any worker. This includes all branches of state government, or the several counties, cities and counties, and municipalities thereof, or any other political subdivision of the state, or a school district, or any special district, or any authority, commission, or board or any other agency or instrumentality thereof.
7879
7980 (2) Employer includes an employers labor contractor.
8081
8182 (d) Employment-related decision means a decision by an employer that impacts wages, wage setting, benefits, compensation, hours, work schedule, performance evaluation, hiring, discipline, promotion, termination, job tasks, skill requirements, responsibilities, assignment of work, access to work and training opportunities, productivity requirements, workplace health and safety, and any other terms or conditions of employment.
8283
8384 (e) Public prosecutor has the same meaning as defined in Section 180.
8485
85-(f) Neural data means information that is generated by measuring the activity of an individuals central or peripheral nervous system, and that is not inferred from nonneural information.
86+(f) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.
8687
87-(f)
88+(g) Worker means a natural person or that persons authorized representative acting as a job applicant to, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.
8889
89-(g) Vendor means a third party, subcontractor, or entity engaged by an employer or an employers labor contractor to provide software, technology, or a related service that is used to collect, store, analyze, or interpret worker data or worker information.
90+(h) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.
9091
91-(g)
92+(i) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.
9293
93-(h) Worker means a natural person or that persons authorized representative acting as a job applicant to, person, an employee of, or an independent contractor providing service to, or through, a business or a state or local governmental entity in a workplace.
94+1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format. (3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.
9495
95-(h)
9696
97-(i) Worker data means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a covered worker, regardless of how the information is collected, inferred, or obtained.
98-
99-(i)
100-
101-(j) Workplace surveillance tool means any system, application, instrument, or device that collects or facilitates the collection of worker data, activities, communications, actions, biometrics, or behaviors, or those of the public, public that are also capable of passively surveilling workers, by means other than direct observation by a person, including, but not limited to, video or audio surveillance, continuous incremental time-tracking tools, geolocation, electromagnetic tracking, photoelectronic tracking, or that utilizes a photo-optical system or other means.
102-
103-1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.(2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.(3) The notice shall be separate from any other communication and shall not contain any information on another subject.(b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.(c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).(d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.(e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:(1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.(2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.(3) The frequency of surveillance and worker data collection.(4) A description of where, how, and for how long worker data will be stored.(5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.(6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.(7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.(8) A written policy informing the worker about how the worker can access the worker data.
10497
10598 1551. (a) (1) At least 30 days before introducing a workplace surveillance tool, an employer shall provide to any worker that will be directly or indirectly affected a plain language, written notice, pursuant to subdivision (e), in the language in which routine communications and other information are provided by the employer to workers.
106-
107-###### 1551.
10899
109100 (2) The employer may provide the notice via a simple and easy-to-use method, including an email, a hyperlink, or another written format.
110101
111102 (3) The notice shall be separate from any other communication and shall not contain any information on another subject.
112103
113104 (b) An employer who began using a workplace surveillance tool before January 1, 2026, shall provide the notice described by subdivision (a) before February 1, 2026.
114105
115106 (c) An employer shall maintain an updated list of all workplace surveillance tools in use and provide the notice described by subdivision (a) to any worker hired after the date on which the employer complied with subdivision (a).
116107
117108 (d) An employer shall provide additional notice to workers within 30 days of any significant updates or changes made to the workplace surveillance tool or in how the employer is using the workplace surveillance tool. Notices shall be provided within 30 days.
118109
119110 (e) The notice required by this section relating to workplace surveillance tools shall contain all of the following information:
120111
121112 (1) A description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose.
122113
123114 (2) A description of the specific activities, locations, communications, and job roles that will be electronically monitored and the technologies that will be used.
124115
125116 (3) The frequency of surveillance and worker data collection.
126117
127118 (4) A description of where, how, and for how long worker data will be stored.
128119
129120 (5) Information about who is authorized to access the worker data gathered and under what conditions, including the names of vendors.
130121
131122 (6) Whether the workplace surveillance tool will be used to make employment-related decisions and which decisions those will be.
132123
133124 (7) The right of a worker to access and correct worker data collected by the workplace surveillance tool.
134125
135-(8) A written policy informing the worker about how the worker can access the worker data.
126+1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees to be jointly and severally liable for worker data breaches.(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.
136127
137-1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.(2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.(d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.(e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.(f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.(g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.
138128
139-1552. (a) An employer shall not transfer, sell, disclose, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply: the contract includes all of the following terms:
140129
141-###### 1552.
130+1552. (a) An employer shall not transfer, sell, or license worker data, including deidentified or aggregated data, to a vendor, subcontractor, or other third party, including another employer, unless the vendor is under contract to analyze or interpret the worker data, and all of the following apply:
142131
143-(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data. shall not transfer, sell, disclose, license, or otherwise distribute the worker data.
132+(1) The vendor has entered into a contract with the employer that prohibits the sale or licensing of the worker data.
144133
145134 (2) The vendor implements reasonable security procedures to protect the worker data from unauthorized or illegal access, destruction, use, modification, or disclosure.
146135
147-(3) The vendor agrees and employer agree to be jointly and severally liable for worker data breaches. breaches experienced by the vendor to the extent the breach involves worker data provided by the employer.
136+(3) The vendor agrees to be jointly and severally liable for worker data breaches.
148137
149-(4) The vendor shall not transfer, sell, disclose, license, or otherwise distribute any product that results from the vendors analysis or interpretation of the worker data, except to provide the agreed-upon product to the employer.
138+(b) An employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law.
150139
151-(b) An (1) Subject to paragraph (2), an employer, or a vendor acting on behalf of an employer, shall not share worker data with the state or a local government unless required to do so by law. another person or governmental agency unless it is necessary to obtain information from the business or worker for an investigation by the governmental agency of a failure to comply with a specific state law that the governmental agency is responsible for enforcing.
152-
153-(2) An employer, or a vendor acting on behalf of an employer, shall not share worker data with law enforcement except pursuant to a valid court order.
154-
155-(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date cybersecurity safeguards in place.
140+(c) An employer or vendor shall keep worker data secure by preventing unauthorized access and implementing a security system with up-to-date safeguards in place.
156141
157142 (d) Worker data collected by an employer or a vendor shall be accessible only to authorized personnel.
158143
159144 (e) If a data breach occurs, the employer shall give notice to workers of the specific categories of data that were impacted in the security breach as soon as possible.
160145
161146 (f) A vendor shall return to the worker and employer all worker data collected through a workplace surveillance tool in a user-friendly format and delete any remaining copies of the worker data at the end of the vendors contract with the employer.
162147
163148 (g) An employer using data collected from a workplace surveillance tool to make employment-related decisions shall retain that worker data for at least five years from the date the worker data was collected.
164149
165-(h) An employer shall allow a worker to access and correct worker data correct inaccurate worker data and obtain worker data collected by its workplace surveillance tool. tool by making a digital or paper form available to the worker upon request within five business days of that request.
150+(h) An employer shall allow a worker to access and correct worker data collected by its workplace surveillance tool.
166151
167-(i) An employer shall collect, use, and retain worker data only that is reasonably necessary and proportionate to achieve the purposes disclosed pursuant to subdivision (e) of Section 1551 for which the personal information was collected or processed.
152+1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.
168153
169-1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:(1) Prevents compliance with or violates any federal, state, or local law.(2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.(3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.
154+
170155
171156 1553. (a) An employer shall not use a workplace surveillance tool that does any of the following:
172-
173-###### 1553.
174157
175158 (1) Prevents compliance with or violates any federal, state, or local law.
176159
177160 (2) Identifies, obtains, or infers information about workers engaging in activity protected by state or federal labor law.
178161
179162 (3) Obtains or infers a workers immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability, criminal record, credit history, or status protected under Section 12940 of the Government Code.
180163
181-(4) Incorporates facial recognition, gait recognition, neural data collection, or emotion recognition technology.
164+(4) Incorporates facial recognition, gait recognition, or emotion recognition technology.
182165
183-(b) (1) An employer shall not rely primarily on worker data from an electronic a workplace surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews. worker.
184-
185-(2) If an employers use of worker data collected by a workplace surveillance tool contributes to a disciplinary or discharge decision by the employer, the employer shall do all of the following:
186-
187-(A) Use a human reviewer to conduct the employers own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.
188-
189-(B) (i) Notify the worker that the disciplinary or discharge decision was made using worker data collected by a workplace surveillance tool, provide the worker and the workers authorized representative with an opportunity to request access to and obtain surveillance and corroborating data, and provide the worker with an opportunity to correct any erroneous worker data by making a paper or digital request form available to the worker at the time the decision is communicated.
190-
191-(ii) A request pursuant to clause (i) shall be made within five business days of the notice required by clause (i).
192-
193-(C) The employer shall make any valid correction of worker data within 24 hours of the workers request and shall change the disciplinary or discharge decision made if the worker data validates the change.
166+(b) An employer shall not rely primarily on worker data from an electronic surveillance tool to discipline or discharge a worker. An employer shall use a human reviewer to conduct their own investigation and compile corroborating or supporting information for the decision, including, but not limited to, supervisory or managerial evaluations, personnel files, employee work product, or peer reviews.
194167
195168 1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.
196169
170+
171+
197172 1554. An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any worker for using, or attempting to use, their rights under this part, filing a complaint with the Labor Commissioner alleging a violation of this part, cooperating in an investigation or prosecution of an alleged violation of this part, or any action taken by the worker to invoke or assist in the enforcement of this part, or for exercising or attempting to exercise any right protected under this part.
198-
199-###### 1554.
200173
201174 1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.(b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.(c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.(d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.(e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.
202175
176+
177+
203178 1555. (a) The Labor Commissioner shall enforce this part, including investigating an alleged violation, and ordering appropriate temporary relief to mitigate a violation or maintain the status quo pending the completion of a full investigation or hearing through the procedures set forth in Section 98.3, 98.7, 98.74, or 1197.1, including issuing a citation against an employer who violates this part and filing a civil action. If a citation is issued, the procedures for issuing, contesting, and enforcing judgments for citations and civil penalties issued by the Labor Commissioner shall be the same as those set out in Section 98.74 or 1197.1, as applicable.
204-
205-###### 1555.
206179
207180 (b) Alternatively to subdivision (a), an employee who has suffered a violation of this part, or the employees exclusive representative, may bring a civil action in a court of competent jurisdiction for damages caused by that adverse action, including punitive damages.
208181
209182 (c) This part may also be enforced by a public prosecutor pursuant to Chapter 8 (commencing with Section 180) of Division 1.
210183
211184 (d) In any civil action brought pursuant to this section in the superior court in any county where the violation in question is alleged to have occurred, or where the person resides or transacts business, the petitioner may seek appropriate temporary or preliminary injunctive relief, punitive damages, and reasonable attorneys fees and costs as part of the costs of any action for damages.
212185
213186 (e) An employer who violates this part shall be subject to a civil penalty of five hundred dollars ($500) per violation.
214187
215188 1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
216189
190+
191+
217192 1556. This part does not preempt any city, county, or city and county ordinance that provides equal or greater protection to workers who are covered by this part.
218-
219-###### 1556.
220193
221194 SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
222195
223196 SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
224197
225198 SEC. 2. The provisions of this part are severable. If any provision of this part or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
226199
227200 ### SEC. 2.
201+
202+
203+
204+
205+
206+(a)An employer, or any person acting on behalf of the employer, shall not make, adopt, or enforce any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, or from providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.
207+
208+
209+
210+(b)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for disclosing information, or because the employer believes that the employee disclosed or may disclose information, to a government or law enforcement agency, to a person with authority over the employee or another employee who has the authority to investigate, discover, or correct the violation or noncompliance, or for providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employees job duties.
211+
212+
213+
214+(c)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for refusing to participate in an activity that would result in a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation.
215+
216+
217+
218+(d)An employer, or any person acting on behalf of the employer, shall not retaliate against an employee for having exercised their rights under subdivision (a), (b), or (c) in any former employment.
219+
220+
221+
222+(e)A report made by an employee of a government agency to their employer is a disclosure of information to a government or law enforcement agency pursuant to subdivisions (a) and (b).
223+
224+
225+
226+(f)(1)In addition to other remedies available, an employer is liable for a civil penalty not exceeding ten thousand dollars ($10,000) per employee for each violation of this section to be awarded to the employee who was retaliated against.
227+
228+
229+
230+(2)In assessing this penalty, the Labor Commissioner shall consider the nature and seriousness of the violation based on the evidence obtained during the course of the investigation. The Labor Commissioners consideration of the nature and seriousness of the violation shall include, but is not limited to, the type of violation, the economic or mental harm suffered, and the chilling effect on the exercise of employment rights in the workplace, and shall be considered to the extent evidence obtained during the investigation concerned any of these or other relevant factors.
231+
232+
233+
234+(g)This section does not apply to rules, regulations, or policies that implement, or to actions by employers against employees who violate, the confidentiality of the lawyer-client privilege of Article 3 (commencing with Section 950) of, or the physician-patient privilege of Article 6 (commencing with Section 990) of, Chapter 4 of Division 8 of the Evidence Code, or trade secret information.
235+
236+
237+
238+(h)An employer, or a person acting on behalf of the employer, shall not retaliate against an employee because the employee is a family member of a person who has, or is perceived to have, engaged in any acts protected by this section.
239+
240+
241+
242+(i)For the purposes of this section, employer or a person acting on behalf of the employer includes, but is not limited to, a client employer as defined in paragraph (1) of subdivision (a) of Section 2810.3 and an employer listed in subdivision (b) of Section 6400.
243+
244+
245+
246+(j)The court is authorized to award reasonable attorneys fees to a plaintiff who brings a successful action for a violation of these provisions.