Amendment ID: S2608-1

Amendment 1

Protecting Employee Data

Ms. Edwards, Ms. Rausch, Ms. Kennedy, Ms. Miranda and Messrs. Eldridge, Brady, Gómez, Keenan, Payano and Collins move that the proposed new draft be amended in section 6 by inserting at the end thereof the following paragraph:-

(g) An employer acting as a controller is prohibited from transferring employees' personal data for any reason, unless such data is operationally necessary to obtain services or a product.  Any contract with a processor or third party shall ensure that employee personal data is used only to the extent necessary to effectuate the contract between the employer and the processor or third party and may not be utilized by the employer, processor or third party for any other purpose.  All contracts between employers and a processor or third party must contain adequate provisions to ensure the privacy of employee data, limit use to functions necessary to execute the commercial purpose of the contract between the processor or third party and the employer and make provisions for the security and timely destruction of employee data. Nothing in this chapter waives or releases an employer from their bargaining obligations vis-a-vis an employer's use of employee personal data and its impacts on employee terms and conditions of employment under state and federal labor relations law.