; and (2) not later than 7 days after such disclosure, enable the covered individual to— (A) review such data and related aggregated data for other similarly situated covered individuals of the employer; and (B) in accordance with the procedures described in section 3(e)(2), have any data described in paragraph (1) that is incomplete or erroneous updated or corrected. (d) Minimization (1) Collection An employer may not collect data on a covered individual that is not reasonably related to operations of the employer. (2) Employee access An employer shall restrict access to data on a covered individual by another covered individual of the employer based on the specific and reasonable business rationale of the employer that is proportionate to the need for such access. (e) Employer contracts with any third party or service provider that the employer uses for workplace surveillance An employer that uses a third party or service provider for workplace surveillance shall include in any contract between the employer and such third party or service provider entered into after the effective date of this section an agreement to comply with the requirements of this section. (f) Effective date This section shall take effect on the date that is 60 days after the date of enactment of this Act. 5. Establishment of privacy and technology division (a) In general There is established in the Department of Labor the Privacy and Technology Division. (b) Administrator of the privacy and technology division The President shall appoint an Administrator of the Privacy and Technology Division to head the Privacy and Technology Division. (c) Employees and advisory boards of the Division (1) In general The Administrator— (A) may select, appoint, and employ, without regard to the provisions of sections 3309 through 3318 of title 5, United States Code, individuals, including technologists, directly to positions in the competitive service, as defined in section 2102 of such title, to carry out the duties of the Administrator under this Act