In the absence of an overarching federal law, data privacy laws continue to evolve primarily at the state level. As we previously reported (“New York State Employers Required to Notify Employees of Electronic Monitoring”), effective May 7, 2022, employers must provide notice of electronic monitoring to employees as a result of an amendment to New York’s Civil Rights Law that was signed by New York Governor Kathy Hochul in November 2021.
To Whom Does the Law Apply?
Employers (individuals, corporations, partnerships, firms or associations) with a place of business in New York State that engage in electronic monitoring of employees are subject to the new requirement. Neither the State nor “any [of its] political subdivision[s]” are considered “employers” for purposes of the law.
What Are Some Examples of Electronic Monitoring?
Employers that “monitor or otherwise intercept” telephone or email communications or transmissions, or internet access or usage, should provide notice as required under the law. Employers should consider whether they should provide notice even if they do not manually review such electronic access, usage or communications.
When determining whether notice is required, employers should review the ways that employees’ electronic activity may be monitored, such as when they log in to employer-accessible devices, networks, applications and systems. Employers should include in their review non-computer devices such as telephones, wire, radio, electromagnetic, photoelectronic or photo-optical systems (i.e., systems used to control access to physical spaces or to track deliveries/employee movement).
General monitoring that is used solely for the security or maintenance of a computer system or network, and not targeted at particular individuals, such as email filters or internet access restrictions, are not considered electronic monitoring.
To Whom Must Notice Be Provided?
The law requires that notice of electronic monitoring be provided upon hiring to all employees who are subject to electronic monitoring. The law does not specify that such notice be provided only to employees located in New York State and, in the absence of further guidance or enforcement actions, employers should consider erring on the side of being more, rather than less, inclusive, unless doing so would be impracticable or impose a significant burden on the employer.
The law does not specifically require a similar, individual notice to existing employees, but employers should consider whether such notice should be incorporated in other periodic or annual notices relating to employee handbooks or policies.
When Should Notice Be Provided and How Should It Be Documented?
“Prior written notice” should be provided upon hiring, prior to any monitoring activity. It should be in writing or in an electronic record and should be acknowledged by the employee. In addition, a conspicuous notice must also be provided to employees who are subject to electronic monitoring.
What Are the Penalties for Failing to Comply?
The Office of the New York State Attorney General will enforce the law. Although the law does not give employees the individual right to sue, the attorney general is authorized to impose a maximum penalty of $500 for the first offense, $1,000 for the second offense, and $3,000 for the third and any subsequent offense. As with other laws, the attorney general may consider failure to notify each employee as a separate, individual violation.
For further assistance, please contact any of the attorneys on our Data Security & Privacy Team, our Labor & Employment Practice Team or the Phillips Lytle attorney with whom you have a relationship.