New York Law Requires Notice of Employees' Electronic Monitoring Effective May 7, 2022

New York Gov. Kathy Hochul signed Senate Bill (SB) S2628 into law on Nov. 8, 2021. The law, which takes effect on May 7, 2022, requires every private-sector employer to provide notice of its electronic monitoring practices to all employees 1) upon hiring, with written or electronic employee acknowledgement, and 2) more generally, in a "conspicuous place" viewable by all employees.

A Closer Look at SB S2628

The new law applies to all private employers within the state, regardless of size or entity type, and governs surveillance of employee internet usage and communications, including phone calls, text messages and emails. The notice, in written or electronic form, must advise employees that any and all telephone conversations, email communications and internet access or usage may be subject to monitoring "at any and all times and by any lawful means."

The law amends the state's civil rights law and is focused primarily around protecting the privacy interests of employees and a workforce that has largely shifted to electronically based remote work in the wake of the COVID-19 pandemic. Accordingly, the new law only covers processes that target the activity or communications of a particular employee, and excludes activities designed to manage the type or volume of incoming or outgoing email, telephone voice mail or internet usage, or performed solely for the purpose of system maintenance or security. This exclusion is important, but it may give rise to some gray areas given the potential for the use of monitoring tools to achieve multiple purposes.

Employee monitoring is a common practice, and many businesses already disclose monitoring practices through employee handbooks or internal privacy policies, as well as via electronic alerts on computer login screens. Nonetheless, the new law broadly covers all private employers, so there are likely a large number of businesses that will need to review and update current practices. In addition, the required notice and affirmative employee acknowledgement "upon hiring" may necessitate an update to new-hire onboarding procedures in New York starting on May 7, 2022.

The new law grants enforcement authority to the state attorney general, who may impose civil penalties upon employers not in timely compliance. Penalties range from $500 to $3,000 per violation, with a maximum of $500 for the first offense, $1,000 for the second offense and $3,000 for any subsequent offenses. The law does not provide a private right of action.

Similarities with Other States' Laws

With the passage of SB S2628, New York follows similar requirements in Connecticut and Delaware. New York's law largely mimics the construction and enforcement of Connecticut and Delaware law, but it displays certain differences in scope and application.

Like New York's new law, Connecticut law requires employers to provide prior written notice to employees about the types of monitoring which may occur.¹ Connecticut employers must conspicuously post a notice of electronic monitoring practices, but the notice requirement is not specific to new hires and does not require affirmative acknowledgment. The Connecticut law encompasses both private and state employers and more broadly defines "electronic monitoring" as covering all information "on an employer's premises concerning employees' activities or communications by any means other than direct observation."

Connecticut law permits an employer to conduct electronic monitoring without giving prior notice if it has reasonable grounds to believe employees are violating the law, violating the legal rights of the employer or other employees or creating a hostile workplace environment. Connecticut's monitoring law is enforced by the state's labor commissioner, who may levy civil penalties ranging from $500 to $3,000.

Delaware law also requires employers to provide prior written notice regarding monitoring of phone transmissions, email and internet access or usage.² Like Connecticut, Delaware's law covers both private and state employers. Uniquely, Delaware allows employers to choose between two methods of notification: either 1) provide daily notice when the employee accesses employer-provided systems or internet, or 2) provide one-time written or electronic notice to the employee and obtain employee acknowledgement electronically or in writing. Employers who violate Delaware's monitoring law may be subject to a $100 civil penalty for each violation, which can be filed in any court of competent jurisdiction.

Notes

¹ Conn. Gen. Stat. Ann § 31-48d.

² Del. Code Ann. tit. 19, § 705.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.