Starting May 7, 2022, employers in the U.S. state of New York will be required to notify and obtain written confirmation from employees if their electronic activity in the workplace is being monitored.
Employers often monitor employees for a number of reasons, including to ensure that workplace policies and procedures are followed, to detect illegal behavior such as the theft of trade secrets, or to comply with regulatory obligations. As a result, many employers provide electronic watch notice in practice, via their employee handbooks.
However, due to changes to New York’s civil rights law, employers in New York are now required to explicitly inform employees whether their electronic activity will be monitored and to obtain written confirmation from employees. The new law will see New York join Connecticut Delaware among states requiring disclosure of electronic workplace monitoring.
Which businesses and individuals are covered?
The law applies to all private employers to the extent that it broadly defines “employer” as any person or entity, regardless of size, having a place of business in New York State. The law specifically excludes “the state or any political subdivision of the state”.
In particular, the law does not define “employee”, which does not specify whether employers must provide notice and obtain written certification from persons who are not considered to be employees (i.e. contractors self-employed or trainees) but who nevertheless use the employer’s monitored electronic systems. It also remains to be seen whether people hired by New York employers to work remotely out of state are entitled to the required notice. In the absence of guidelines, it may be prudent for employers to notify and obtain written confirmation from remote employees as well as others who use the employer’s monitored electronic systems.
What electronic monitoring activities are covered?
The new law will apply to all private employers who monitor or intercept telephone conversations or transmissions, mail or electronic transmissions, or their employees’ access to or use of the Internet.
It is important to note that no notice is required for processes that are:
- designed to handle the type or volume of e-mail, voicemail, or the Internet;
- targeted to monitor or intercept activities other than email, phone and Internet activity; or
- performed solely for the purposes of maintenance and/or protection of the computer system.
Accordingly, certain tasks such as spam filtering, proxy servers or firewall protections put in place only to scan or block certain electronic transmissions are not covered. Also, since the law limits the notification requirement to surveillance by email, telephone and Internet, surveillance by video cameras and location tracking should not be covered.
What does the law require?
In practice, the law imposes three requirements.
First, it requires covered employers to provide employees with an electronic lookout notice when hiring all new hires. The law provides language similar to a model employee notice that employers can use, which states:
‘[A]n the employee must be informed that all telephone conversations or transmissions, electronic mail or transmissions, or access to or use of the Internet by an employee by any electronic device or system, including, but not limited thereto, the use of any computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to surveillance at any time and by any legal means.
Second, employers must also obtain written confirmation from new employees confirming receipt of the notice. Notice may be provided, and acknowledgment obtained, electronically. Note that the law does not require employers to provide notice or obtain recognition from existing employees, although employers may choose to do so.
Third, employers must also post a lookout notice in a “conspicuous place easily accessible to
[their] employees who are subject to electronic monitoring. Employers must post this notice where they post all other legally required employment-related notices. Although the law does not define a “conspicuous space”, employers with a remote workforce would likely satisfy this obligation by posting the notice on their intranet page or other commonly accessed company portal. by employees, or as part of the login process to access the company’s computer system.
How will the law be enforced?
The law is enforced by the New York Attorney General. Violations of the law can subject employers to civil penalties of up to $500 for the first violation, $1,000 for the second violation, and $3,000 for the third and each subsequent violation. There is no private right of action. The law does not specify whether failure to notify an employee and failure to obtain the employee’s acknowledgment are separate offences.
Next steps for covered employers
Businesses with employees in New York must take action now to comply with the requirements of the law.
Specifically, organizations should update their onboarding policies and procedures to ensure that all new hires receive the required notice and execute the necessary acknowledgment. This includes identifying how new hires will be notified and collecting and storing acknowledgment forms. Additionally, employers should determine where the notice will be posted in the workplace, which may include their intranet sites or login portals. Employers should also review and, if necessary, update their employee handbooks to ensure that existing monitoring policies reflect the notice requirements of the law. Finally, although the law applies specifically to new hires, employers would be prudent to follow the same steps for existing employees subject to electronic monitoring prior to the effective date.
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.