Amendment #8 to S2619

Protecting Employee Personal Data

Ms. Montaño of Boston moves to amend the bill in Section 1, in line 459, by inserting after the words “coercive or usurious in nature.” the following new paragraph:-

“(3) An employer acting as a controller is prohibited from transferring employees' personal data for any reason, unless such data is operationally necessary to obtain services or a product pertaining to a legitimate business interest. Any contract between an employer and a controller, processor, or third party shall ensure that employee personal data is used only to the extent necessary to effectuate the contract between the employer and the controller, processor, or third party and may not be utilized by the employer, controller, processor or third party for any other purpose.  All contracts between employers and a controller, processor, or third party must contain adequate provisions to ensure the privacy of employee data, limit use to functions necessary to execute the commercial purpose of the contract between the employer and the controller, processor or third party, and make provisions for the security and timely destruction of employee data. Nothing in this chapter waives or releases an employer from their bargaining obligations vis a vis an employer's use of employee personal data and its impacts on employee terms and conditions of employment under state and federal labor relations law.”

Additional co-sponsor(s) added to Amendment #8 to S2619

Protecting Employee Personal Data