; (2) use an automated decision system to predict behavior of a covered individual that is unrelated to the work of the covered individual for the employer; (3) use workplace surveillance to monitor a covered individual while the covered individual is off-duty or in a sensitive area, such as a restroom or locker room, location provided for the covered individual to express breast milk, or location provided for the covered individual to pray or participate in a religious activity; (4) use workplace surveillance on a covered individual in any manner that threatens the mental or physical health of the covered individual; (5) use data collected through workplace surveillance on a covered individual for a purpose that is not disclosed in accordance with section 3(a)(1)(F); or (6) sell or license data collected on a covered individual to any person (including a third party or service provider of the employer) or, except as otherwise provided in law, government entity. (b) Transfer of personally identifiable data (1) Employer An employer may not transfer data on a covered individual collected using workplace surveillance to a third party unless, for each instance of a transfer— (A) the employer— (i) discloses the transfer to the covered individual; and (ii) provides cybersecurity protections and encryption for the data; and (B) the covered individual does not opt out of the instance of the transfer. (2) Third party A third party that an employer uses for workplace surveillance may not transfer data on a covered individual, including any such data that was transferred to the third party by the employer in accordance with paragraph (1). (c) Employment-Related decisions An employer that makes an employment-related decision with regard to a covered individual using data from workplace surveillance shall— (1) not later than 7 days after making such an employment-related decision, disclose to the covered individual that such employment-related decision was made using data from workplace surveillance