New York Law Protects Employee Privacy From Electronic Monitoring

Pandemic-related delays keep E-2 visa investors out of the U.S

Starting in May, a new law will go into effect that requires New York state employers to provide written notice before monitoring their employees’ electronic communication Initial notification occurs upon hiring, then at least once annually to all employees, informing them of the types of electronic monitoring which may occur.  The new legislation — A.430/S.2628 — was signed into law in November 2021, and is similar to electronic monitoring laws enacted by Connecticut in 1998 and Delaware in 2001.

In Connecticut, both private and public sector employers are required to notify employees prior to electronic monitoring, with similar penalties for failure to comply.  Likewise, in Delaware, an employer is not permitted to monitor or intercept an employee’s telephone conversations, email or internet usage without prior notice in writing or alternative notification each time the employee accesses the employer-provided email or Internet access services.

Before this law, New York employers were subject to New York's wiretapping law as well as federal laws such as the Electronic Communications Privacy Act of 1986. The new law hopes to balance an employee’s right to privacy and an employer’s right to monitor computer activities and telephone usage while at work.

The basics: who is covered and what the law requires

New York’s new employee privacy protection law defines an employer as an individual, corporation, partnership, firm, or association with a place of business in New York State. The law applies to employers of any size, but it excludes New York State and any political subdivision of the state.

The monitoring law does not define who an employee is, and there is some ambiguity whether employers must provide notice to workers who are not usually seen as traditional employees, like independent contractors or volunteers. The law will be enforced by the New York Attorney General so that they may use New York's Labor Law definition of an employee: "any person employed for hire by an employer in any employment."

The law covers an employee’s telephone conversations, text messages, e-mail, and overall internet access and usage. It also includes any electronic device or system, such as wire, radio, electromagnetic, photoelectronic or photo-optical systems.

With proper notice, New York employers are still allowed to monitor employees for various reasons, such as ensuring workplace policies and identifying illegal behaviors like data leaks. Employers do not need to provide notice to monitor the type or volume of e-mail, voicemail, or internet usage, and they can still use security cameras to monitor movements in the workplace. This law also allows employers to do general monitoring for malicious software or spam mail, and firewall protection.

Providing proper notice to employees is the most important factor of this new law. Employers must give both written notice and posted notice. The written notice can also be provided electronically and the employee must acknowledge receipt in writing or electronically.

The notices must state that all telephone calls, emails, or internet activities may be subject to monitoring at any time and by any lawful means. They must also state that any electronic device may be monitored, including but not limited to an employee's computer or telephone. 

The written notice must be given to employees directly, and the law requires an acknowledgment of receipt of the information either in writing or electronically, and employers must keep a written or digital confirmation of each employee’s acknowledgment. 

The posted notice must be placed in a “conspicuous place which is readily available for viewing” by employees. The law does not specify what a "conspicuous place” is, but it may be enough to post the notice on the company's intranet page or online portal frequented by employees.

The consequences of non-compliance and next steps for employers

The New York State Attorney General will enforce this law, and employers who violate it can face steep fines. Fines increase from $500 for the first offense, $1,000 for the second offense, and $3,000 for the third offense and each subsequent offense. 

Certain system-based tasks such as spam filtering, proxy servers, or firewall protections that merely scan or block certain electronic transmissions would not be covered activity that would trigger the notice requirements of the Act. Nevertheless, employers should inventory such systems, such as data loss prevention tools, to determine if they perform additional functions that might trigger a notice requirement.

The law will go into effect on May 7, 2022. New York State employers should review their electronic monitoring policies and create plans for giving their employees the required notices. Employers may also want to implement systems to track and store both the required disclosures and employee acknowledgments.