New York Requires Private Employers to Notify Employees of Telephone, Email, and Internet Monitoring

On November 8, 2021, New York Governor Kathy Hochul signed into law a bill that will require private New York employers who monitor employees’ electronic communications to provide written notice to employees before engaging in such monitoring activities. The new law, which will be codified as Section 52-c of the New York Civil Rights Law, will not prohibit management from monitoring employees’ electronic communications. An employer will retain the right to monitor employees’ telephone, computer, and internet access and usage, so long as the employer informs the employees of such electronic monitoring.

Requirements of the New Law

The new statute, which will go into effect on May 7, 2022, has several notice requirements to which private employers, regardless of size, with “a place of business in” New York State must adhere. First, employers must provide to employees “prior written notice upon hiring” which “shall be in writing, in an electronic record, or in another electronic form” if the employer does or plans to monitor or intercept employees’ telephone, email, and internet access usage. Second, the employee must acknowledge the notice either in writing or electronically. Finally, all employers must post the notice of electronic monitoring in a conspicuous location which is easily visible to all employees who are subject to the electronic monitoring.

The written notice must inform employees that any and all telephone and email transmissions or conversations, or any internet access or usage, via the use of any electronic device or system may be subject to electronic monitoring by the employer at any and all times and by any lawful means.

The law applies to an employer’s monitoring the electronic communications of a remote employee in New York State, so long as the employer “has a place of business in” New York State. However, the statute does not define “a place of business.” Accordingly, it will remain to be determined whether the new law will protect a remote employee in New York State who works from a home office for an employer based outside of New York State whose only presence in New York State is that employee’s home office. However, rather than engage in litigation over whether the home office is “a place of business in” New York, the prudent course will be for such foreign employer to provide the required notice to the employee based in New York State (and to obtain the required written acknowledgment from the employee).

Notably, the new law does not apply to processes that are designed to manage the type or volume of incoming or outgoing email or telephone voice mail, or internet usage, that are not targeted to monitor or intercept the email, telephone voice mail, internet usage of a particular individual, and that are performed solely for the purpose of computer system maintenance and protection.

Enforcement

The New York State Attorney General will have exclusive authority to enforce this new law. Employers who are found to be in violation of the law will be subject to a maximum civil penalty of $500 for the first offense, $1,000 for the second offense, and $3,000 for the third and each subsequent offense. Employees will not have a private right of action to commence a lawsuit under the new statute.

Next Steps for Employers

Before the law goes into effect on May 7, 2022, employers need to determine if they engage in electronic monitoring practices that trigger the new statute’s notice obligations. If the employer determines that it has to provide the notice, it must draft and distribute the notice of electronic monitoring to all new hires and to all existing employees. The employer must also conspicuously post the notice of monitoring in the workplace. Further, management needs to institute an ongoing procedure to make sure that all new hires receive the notice and return the required acknowledgement, and that the employer retains every acknowledgement.

Management also needs to remember that the federal Electronic Communications Privacy Act of 1986 (“ECPA”) already prohibits an employer from intentionally intercepting the oral, wire, and electronic communication of employees. However, the ECPA’s “Business Purpose Exception” permits an employer to monitor oral and electronic communications as long as it shows that it did so for legitimate business reasons. Further, the ECPA’s “Consent Exception” allows employers to monitor employee communications using monitoring apps and other means, so long as the employee consents to such monitoring. Management generally can infer employees’ consent when employees use employer-provided electronic equipment after receiving detailed notice of the employer’s acceptable use policies and a statement that the management will enforce such policies. A violation of ECPA compliance can result in civil as well as criminal penalties.

If you have any questions about this new employee monitoring statute, please contact Charles H. Kaplan (646.218.7513), Monaliza Seepersaud (646.218.7542), or any other member of our Labor & Employment Practice.