NY Requires Notice of Electronic Monitoring to Employees — Are You In Compliance?
As of May 7, 2022, new amendments to the New York Civil Rights Law (linked here) requiring New York employers to provide notice of electronic monitoring to employees went into effect. If your company has not already taken necessary steps towards compliance, here is what you need to know.
Who does the law apply to?
Basically everyone - the new law applies to “[a]ny employer who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employee by any electronic device or system . . .”
The law defines “employer” broadly, covering “any individual, corporation, partnership, firm, or association with a place of business in the state.” As such, most private employers, regardless of size, are covered by the new law.
What is covered?
In classic fashion, the law does not define the terms “monitor” or “intercept” and New York state has issued no interpretive guidance to date to provide any clarity.
As one point of guidance, New York courts, like many federal courts, have construed the term “intercept,” as used in the Federal Wiretap Act, narrowly to require that the interception of an electronic communication be contemporaneous with the transmission of that communication. See, e.g., Tantaros v. Fox News Network, LLC, No. 17 CIV. 2958 (GBD), 2018 WL 2731268, at *7 (S.D.N.Y. May 18, 2018). Assuming the term “intercept” will be construed in a similar way under this law, then notice obligations under the law are triggered by employers engaging in real-time monitoring of employee electronic communications and usage.
What does the law require?
New York employers who “monitor” or “intercept” telephone conversations, electronic mail, or internet access or usage by any employees are required to:
- Provide notice, and acquire acknowledgment from, new hires – The law requires that covered employers provide notice of monitoring to all new employees upon hiring. This notice must be in writing, electronic record or another form and must be acknowledged in writing or in an electronic form.
- The law only requires that newly hired employees provide acknowledgment of written notice upon hire.
- Such written or electronic acknowledgement is not required for existing employees.
- Post notice for all employees – The law also requires covered employers to post a notice of their electronic monitoring in a “conspicuous place” which is readily available for viewing by all employees subject to the electronic monitoring.
However, the text of the law itself provides what appears to be “model” language. Section 52-c (2)(b) of the law states:
For purposes of written notice required by paragraph (a) of this subdivision, an employee shall be advised that any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times and by any lawful means.
This language is broad and, at a minimum, only requires that employers advise employees that employees may be subject to monitoring. Employers should consider expanding this language to identify what specific monitoring activities the employer is engaging in.
Additionally, the new law does not appear to be limited to work-issued devices, and as such, if employers are engaging in monitoring that occurs on employees’ personal devices that are being used for work purposes, clarifying such monitoring in the notice is important. Including such details would help to promote transparency.
Employers should check with privacy counsel before monitoring personal devices.
Are there any exceptions?
While the terms “monitor” and “intercept” have been left undefined, the law expressly provides for certain processes that are not covered by the law, which include processes that:
- Are designed to manage the type or volume of incoming or outgoing email, voicemail, or internet usage;
- Are not targeted to monitor or intercept electronic activities of a particular individual; and
- Are performed solely for computer system maintenance and/or protection.
What are the penalties for failing to comply?
The Attorney General of New York is charged with enforcing the new law. Employers are subject to a maximum civil penalty of $500 for their first violation, $1,000 for their second violation and $3,000 for each subsequent violation. The law is unclear as to whether each failure to provide notice or obtain an acknowledgment from a new hire is a separate violation.
Additionally, there is no private right of action under the law.
What are the next steps employers should take?
- Determine the scope of the employer’s electronic monitoring, and identify whether such monitoring triggers an obligation to provide notice under the law.
- Draft an electronic monitoring notice that complies with the law (i.e. at minimum, include the “floor” language provided for by the law) and consider including expanded language describing the specific monitoring activities.
- Post notice of electronic monitoring on intranet sites. Employers should also consider posting this notices conspicuously in a public area in the workplace, such as by coffee machines or printer areas, to ensure legal compliance.
- Incorporate the notice and acknowledgment form into onboarding processes for new hires. Because the law explicitly allows the notice to new hires be in “electronic form,” employers using electronic onboarding processes should consider providing this notice, as well as obtaining electronic acknowledgments, through such electronic processes. These notices and acknowledgments should be securely filed and maintained.
- Employers should also consider updating their employee handbooks and policies to reflect the law’s notice requirements.