Privacy, security, and confidentiality safeguards

(a) Prohibited disclosures A participating entity may not submit under section 4(a)— (1) personal data or information linked or reasonably linkable to an individual; (2) employer-specific, customer-specific, or individual-specific performance data; (3) trade secrets, proprietary algorithms, model weights, training datasets, or source code; (4) information that a participating entity is contractually prohibited from disclosing pursuant to agreements or terms with consumers, users, or enterprise, governmental, or institutional customers or that the participating entity otherwise commits to protecting from disclosure in policies or representations, including restrictions or commitments on data use, aggregation, or secondary disclosure; or (5) data in violation of a contract or other terms with an enterprise customer, consumer, or user, including contractual restrictions on data use, aggregation, disclosure, or secondary analysis. (b) Compliance with applicable laws In making submissions under section 4(a), a participating entity shall exclude or further aggregate data as necessary to comply with other applicable laws. (c) Compliance with contract terms This Act shall not be construed to obviate the terms, including privacy or data protections, in any contract between a participating entity and its customers, users, or other consumers. (d) Safeguards In preparing data for purposes of making submissions under section 4(a) and making such submissions, a participating entity shall apply aggregation, anonymization, and de-identification techniques consistent with guidance issued under section 6(c). (e) Freedom of information act Any aggregated workforce transparency data submitted under section 4(a) shall be exempt from the disclosure requirements under section 552 of title 5, United States Code (commonly known as the Freedom of Information Act).