This bill, titled the "Stop Spying Bosses Act," seeks to significantly restrict and regulate how employers collect, use, and transfer employee data. It applies to a broad range of employers, including those with 11 or more covered individuals, and defines "employee data" expansively to include personally identifiable information, workplace activities, biometric data, and inputs/outputs from automated decision systems. The legislation establishes strict prohibitions on collecting or using employee data for specific purposes, such as identifying labor organization activities, ascertaining political opinions, religious views, or health status unrelated to job duties, or monitoring off-duty activities. Employers are also forbidden from collecting data in sensitive areas like break rooms, restrooms, or an employee's home. These measures aim to protect workers' privacy and prevent discriminatory practices. Permissible data collection is narrowly defined, requiring that it not be otherwise prohibited and serve specific, legitimate purposes like essential job functions, quality assurance, periodic performance assessment, or health and safety. Any collected data must be strictly necessary, the least invasive means, limited to the fewest individuals, and retained only as long as reasonably necessary, with a maximum retention period of three years post-separation or application discontinuation. The bill explicitly prohibits employers and their service providers from selling or licensing employee data. Transfers to service providers are only allowed with prior disclosure to the employee, cybersecurity protections, encryption, and the employee's explicit opt-in for each instance. Transfers to third parties are generally prohibited, except where required by law. Employers are mandated to provide comprehensive disclosures to covered individuals and publish them conspicuously. These disclosures must detail what data is collected, how, when, where it's stored, who has access, its purposes, and how it affects work-related decisions. Disclosures must be accessible, in plain language, and tailored to the individual's job functions and risk level, with initial disclosures provided upon hiring or application, and updates for any changes. Employees are granted the right to access any data collected on them within 30 days of a request and to have incomplete or erroneous data updated or corrected. When a work-related decision is made using employee data, the employer must disclose the categories of data used and allow the employee to review their data, compare it with aggregated data of similarly situated individuals, correct inaccuracies, and request reconsideration of the decision. To enforce these provisions, the bill establishes a Worker Protection and Technology Division within the Department of Labor, headed by an Administrator. This division will have investigative authority similar to the Fair Labor Standards Act, prioritizing industries with high surveillance rates. The bill also creates a private right of action, allowing adversely affected individuals or labor organizations to sue for damages, injunctive relief, and attorney's fees, with specific statutory damages for different types of violations. Whistleblower protections are included, prohibiting employers from discriminating or retaliating against individuals who exercise their rights under the Act or report violations. States are also empowered to bring civil actions on behalf of their residents for violations. The bill requires the Secretary of Labor to conduct an annual study on workplace surveillance and submit findings and recommendations to Congress, while also coordinating with other federal and state agencies to ensure consistent regulatory treatment of employee data.