(b) Employee monitoring restricted. An employer shall not engage in electronic monitoring of an employee unless all of the following requirements are met: (1) the employer's purpose in utilizing the electronic monitoring is to: (A) assist or allow the employee to accomplish an essential job function; (B) monitor production processes or quality; (C) ensure compliance with applicable employment or labor laws; (D) protect the health, safety, or security of the employee, clients, or the public; (E) secure the employer's physical or digital property; (F) conduct periodic assessment of employee performance; or (G) track time worked or production output for purposes of determining the employee's compensation; (2) the specific form of electronic monitoring is necessary to accomplish the purpose identified pursuant to subdivision (1) of this subsection and is used exclusively to accomplish that purpose; (3) the specific form of electronic monitoring is the least invasive means, with respect to the employee, of accomplishing the purpose identified pursuant to subdivision (1) of this subsection; (4) the specific form of electronic monitoring is used with the smallest number of employees, collects the smallest amount of data necessary to accomplish the purpose identified pursuant to subdivision (1) of this subsection, and is collected not more frequently than necessary to accomplish that purpose; and (5) the employer ensures that only authorized persons have access to any data produced through the electronic monitoring and that the data is only used for the purpose and duration that the employee has been notified of pursuant to subsection (c) of this section.

(c) Required notice for employee monitoring. (1) At least 15 calendar days prior to commencing any form of electronic monitoring, an employer shall provide notice of the electronic monitoring to each employee who will be subject to it. The notice shall, at a minimum, include the following information: (A) the specific form of electronic monitoring; (B) a description of the intended purpose of the electronic monitoring and why the electronic monitoring is necessary to accomplish that purpose; (C) a description of how any data generated by the electronic monitoring will be used, including whether and how the data generated by the electronic monitoring will be used to inform employment-related decisions; (D) a description of the technologies that will be used to conduct the electronic monitoring; (E) a description of the specific activities, locations, communications, and job roles that will be electronically monitored; (F) the name of any person conducting electronic monitoring on the employer's behalf and any associated contract language related to the monitoring; (G) the name of any person, apart from the employer, who will have access to any data generated by the electronic monitoring and the reason why the person will have access to the data; (H) the positions within the employer that will have access to any data generated by the electronic monitoring; (I) when, where, and how frequently monitoring will occur; (J) the period of time for which any data generated by the electronic monitoring will be retained by the employer or another person and when that data will be destroyed; (K) notice of how an employee may access the data generated by the electronic monitoring and the process to correct any errors in the data; (L) a cover sheet that concisely summarizes the details contained in the notice; (M) notice of an employee's rights pursuant to this section and the judicial and administrative remedies available for redressing the wrongful use of electronic monitoring; and (N) instructions on how an employee can file a complaint against an employer for violations of this section. (2) If an employer uses electronic monitoring to track employee productivity or performance, the employer shall include the following information in the notice required by subdivision (1) of this subsection: (A) the performance or productivity standards by which employees will be assessed and how employees will be measured against those standards; (B) how performance or productivity data will be monitored and collected, including the identity of the employees subject to such monitoring and when, where, and how the monitoring and data collection will occur; and (C) any adverse consequences for failing to meet a performance or productivity standard and whether there is any bonus or incentive program associated with meeting or exceeding each standard. (3)(A) Notice of electronic monitoring provided pursuant to this section shall be written in plain, clear, and concise language and provided to each employee in the employee's primary language. (B) An employer shall provide a new, updated notice to employees if it makes any significant changes to the manner of electronic monitoring or to the way that the employer utilizes the electronic monitoring or any data generated by it.

(d) Prohibitions on employee monitoring. Notwithstanding the purposes for electronic monitoring set forth in subdivision (b)(1) of this section, electronic monitoring shall not be used: (1) in any manner that violates State or federal labor, employment, civil rights, or human rights laws; (2) in relation to employees who are off-duty and not performing work-related tasks, including employees on-call; (3) to identify, punish, or obtain information about employees exercising legal rights, including rights guaranteed by labor and employment laws; (4) for audio-visual monitoring of bathrooms, locker rooms, changing areas, breakrooms, smoking areas, areas designated for the expression of breast milk, employee cafeterias, lounges, or other similarly private areas; (5) to determine the frequency with which employees visit or use bathrooms, locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, or other similarly private areas; (6) for monitoring, including audio-visual monitoring, of any space within an employee's residence or personal vehicle, or a property owned or rented by the employee, unless the monitoring is necessary to ensure the employee's health and safety or to verify the security of employer or client data; (7) to obtain information about an employee's actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, pursuit or receipt of reproductive health care, sex, sexual orientation, gender identity or expression, marital status, family responsibilities, personal appearance, immigration status, political affiliation or association, neurodiversity, veteran status, or other classification protected under State or federal law; (8) to take adverse employment action against an employee on the basis of data collected via continuous incremental time-tracking tools; or (9) in a manner that harms health or safety or violates the legal rights of any employee.

(e) Restriction of employee monitoring through personal devices. (1) An employer shall not require an employee to install an application on a personal device for purposes of electronic monitoring or to wear a device or attach, embed, or physically implant a device on the employee's clothing that can be used for electronic monitoring, unless the electronic monitoring is: (A) necessary to accomplish the employee's essential job function; and (B) limited to only the times and activities necessary to accomplish the essential job functions. (2) Any location tracking function of an application or device shall be disabled outside of the times when the employee is engaged in activities necessary to accomplish essential job functions. (3) An employer shall not require an employee to physically implant a device on the employee's body for purposes of employee monitoring.

(f) Restrictions on use of automated decision systems. (1) An employer shall not use an automated decision system in a manner that: (A) violates or results in a violation of State or federal law; (B) makes predictions about an employee's behavior that are unrelated to the employee's essential job functions; (C) identifies, profiles, or predicts the likelihood that an employee will exercise the employee's legal rights; (D) makes predictions about an employee's emotions, personality, or other sentiments; or (E) use customer or client data, including customer or client reviews and feedback, as an input of the automated decision system.

(2)(A) An employer shall not solely rely on outputs from an automated decision system when making employment-related decisions. (B) An employer may utilize an automated decision system in making employment-related decisions if: (i) the automated decision system outputs considered in making the employment-related decision are corroborated by human oversight of the employee, including supervisory or managerial observations and documentation of the employee's work, personnel records, and consultations with the employee's coworkers; (ii) the employer has conducted an impact assessment of the automated decision system pursuant to subsection (g) of this section; and (iii) the employer is in compliance with the notice requirements of subdivision (4) of this subsection (f).

(3) An employer shall not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

(4) Prior to using an automated decision system to make an employment-related decision about an employee, the employer must provide the employee with a notice that complies with subdivision (c)(3)(A) of this section and, at a minimum, contains the following information: (A) a plain language explanation of the nature, purpose, and scope for which the automated decision system will be used, including the specific employment-related decisions potentially affected; (B) the logic used in the automated decision system, including the key parameters that affect the output of the automated decision system; (C) the specific category and sources of employee input data that the automated decision system will use, including a specific description of any data collected through electronic monitoring; (D) any performance metrics the employer will consider using with the automated decision system; (E) the type of outputs the automated decision system will produce; (F) the individuals or entities that developed the automated decision system; (G) the individual or entities that will operate, monitor, and interpret the results of the automated decision system; (H) information about how an employee can access the results of the most recent impact assessment of the automated decision system; (I) a description of an employee's rights, pursuant to subsection (j) of this section, to access information about the employer's use of the automated decision system and to correct data used by the automated decision system; and (J) a statement that employees are protected from retaliation for exercising the rights described in the notice.

(g) Impact assessment of automated decision systems. (1) Prior to utilizing an automated decision system, an employer shall create a written impact assessment of the system that includes, at a minimum: (A) a detailed description of the automated decision system and its purpose; (B) a description of the data utilized by the system; (C) a description of the outputs produced by the system and the types of employment-related decisions in which those outputs may be utilized; (D) an assessment of the necessity for the system, including reasons for utilizing the system to supplement nonautomated means of decision making; (E) a detailed assessment of the system's validity and reliability in accordance with contemporary social science standards and a description of any metrics used to evaluate the performance and known limitations of the automated decision system; (F) a detailed assessment of the potential risks of utilizing the system, including the risk of: (i) discrimination against employees on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, ancestry, place of birth, age, crime victim status, or physical or mental condition; (ii) violating employees' legal rights or chilling employees' exercise of legal rights; (iii) directly or indirectly harming employees' physical health, mental health, safety, sense of well-being, dignity, or autonomy; (iv) harm to employee privacy, including through potential security breaches or inadvertent disclosure of information; and (v) negative economic and material impacts to employees, including potential effects on compensation, benefits, work conditions, evaluations, advancement, and work opportunities; (G) a detailed summary of measures taken by the employer to address or mitigate the risks identified pursuant to subdivision (E) of this subdivision (1); and (H) a description of any methodology used in preparing the assessment. (2) An employer shall provide a copy of the assessment prepared pursuant to subdivision (1) of this subsection to an employee upon request. (3) An employer shall update the assessment required pursuant to this subsection any time a significant change or update is made to the automated decision system. (4) A single impact assessment may address a comparable set of automated decision systems deployed by an employer.

(h) Prohibitions on facial, gait, voice, and emotion recognition technology. Electronic monitoring and automated decision systems shall not incorporate any form of facial, gait, voice, or emotion recognition technology.

(i) Protection of employee privacy. (1) An employer; any person that develops, operates, or maintains electronic monitoring or an automated decision system on behalf of an employer; and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses data produced or utilized by electronic monitoring or an automated decision system shall implement reasonable security procedures and practices appropriate to the nature of the data to protect employees' personal information from unauthorized or illegal access, destruction, use, modification, or disclosure. (2) Any person that develops, operates, or maintains electronic monitoring or an automated decision system on behalf of an employer and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses data produced or utilized by electronic monitoring or an automated decision system shall, upon termination of the contract with the employer: (A) return all data and automated decision system outputs to the employer; and (B) destroy all data and automated decision system outputs in the person's possession.

(j) Employee right to access and correct data. (1) Within seven days of receiving a request, an employer shall provide an employee with access to any data that relates to the employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer. (2) Within seven days of receiving a request to correct potential errors identified by an employee, an employer shall: (A) correct the erroneous information or data and provide the employee with a notice that complies with subdivision (c)(3)(A) of this section, explaining the steps taken by the employer; or (B) provide the employee with a notice explaining that the employer has not corrected the information or data and describing the steps the employer has taken to verify the accuracy of the disputed information or data.

(k) Retaliation prohibited. An employer shall not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise the employee's rights under this section. The provisions against retaliation set forth in subdivision 495(a)(8) of this subchapter shall apply to this section.

(l) Enforcement. The provisions of section 495b of this subchapter shall apply to this section.

(5)(A) An employer that utilizes electronic monitoring shall annually provide each of its employees with a list of all electronic monitoring systems currently in use by the employer in relation to that employee. The list shall be provided in the primary language of the employee. (B) As used in this subdivision (5), "currently in use" means that the employer: (i) is currently using the system in relation to the employee; (ii) used the electronic monitoring system in relation to the employee within the past 90 days; or (iii) intends to use the electronic monitoring system in relation to the employee within the next 30 days.