New Law Requires New York Employers to Notify Employees of Monitoring of Their Communications and Internet Usage

Starting May 7, 2022, if private employers in New York wish to monitor their employees’ phone and internet use and communications, they must give their employees advance written notice upon hiring and then post that notice conspicuously in the workplace. The new law, A.430/S.2628 (the Act), resembles electronic monitoring laws enacted by Connecticut in 1998 and Delaware in 2001, which also require employers to notify employees of certain monitoring activities. While New York employers already are subject to New York’s wiretapping law as well as federal laws such as the Electronic Communications Privacy Act of 1986, the new statute is the first New York law to impose any employee-monitoring notice requirement on them. Many organizations based in New York may need to take steps now to prepare for compliance, including updating policies and procedures and developing systems to provide the required disclosures.

Scope

The Act applies to any employer who monitors (or otherwise intercepts) an employee’s telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage. Employers may monitor employees for various reasons, including to meet regulatory obligations, to ensure workplace policies and procedures are followed, and to identify any illegal behavior such as data leaks and trade secret theft. Notice is not required, however, for processes that are designed to manage the type or volume of e-mail, voicemail, or internet usage; that are targeted to monitor or intercept activities other than the email, phone, and internet activities (e.g., monitoring an individual’s movements in the workplace via video camera) of a particular individual; or that are performed solely for the purpose of computer system maintenance and/or protection.

An “employer” includes “any individual, corporation, partnership, firm, or association with a place of business in New York,” with no size limitation. Because the law does not define “employee,” the Act creates some ambiguity about whether an employer must provide notice to certain individuals who are not traditionally considered employees but nonetheless use monitored communications systems, such as independent contractors or volunteers. The New York Attorney General, who is charged with enforcing the Act, therefore might rely on the broad definition of employee set forth in New York’s Labor Law: “any person employed for hire by an employer in any employment.” By contrast, Connecticut’s electronic monitoring law more specifically defines “employee” as any individual who performs services for an employer, as long as the employer has the right to control and direct such individual as to the result to be accomplished by the services and the details and means by which that result is accomplished.

Notice Requirement

The Act prescribes specific content requirements that apply to both the written notice and posted notice. Each notice must state that all telephone calls, emails, or internet activities may be subject to monitoring at any time and by any lawful means. The notice also must make clear that any electronic device may be monitored, including but not limited to an employee’s computer or telephone. Employees must acknowledge the written notice in writing or electronically.

The requirement that each notice be posted in a “conspicuous place which is readily available for viewing by its employees who are subject to electronic monitoring” is phrased substantially the same as the corresponding requirement in Connecticut’s law. The Act does not provide any further detail on what constitutes a “conspicuous place,” but it seems likely that it would be satisfied by posting the notice on a company’s intranet page or other portal commonly and exclusively accessed by employees, or as part of the log-in process to access the company’s computer system.

Penalties

Violations of the Act are punishable by civil penalties of up to $500 for the first offense, $1,000 for the second offense, and $3,000 for the third and each subsequent offense. These increasing penalties track the penalty structure of the Connecticut law, while the Delaware law simply provides for a civil penalty of $100 for each violation. Like both the Connecticut and Delaware laws, the Act does not create a private right of action.

Conclusion

The Act underscores that the New York legislature, which also is considering enhancing the state’s consumer privacy protection laws, is focused on improving workplace awareness of employee electronic monitoring practices and privacy more generally. In addition to assessing their employee monitoring practices and designing the required notices, businesses in New York may want to consider taking steps now to implement systems that will accurately track and store both the required disclosures and employee acknowledgments.

If you need guidance on electronic monitoring practices or compliance with these state laws, the Privacy, Cybersecurity & Data Strategy group is here to help.

© Arnold & Porter Kaye Scholer LLP 2022 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.