While employers generally provide some form of notice of electronic monitoring, as a matter of practice, in their employee handbook, New York now requires transparency about workplace monitoring as a matter of law.  On November 8, 2021, New York’s governor signed a bill that amends New York State’s Civil Rights Law to require private employers not only to notify employees of electronic monitoring, but also to obtain their written acknowledgement of the notice.  The amendment will become effective on May 7, 2022.

To whom does the law apply?

The law applies to all employers with a place of business in New York State regardless of size.  Unlike many employment laws, this one has no carve-out for small employers.

Employers must provide the notice to employees only “upon hiring.”  Consequently, the law does not require employers to undertake the burden of providing notice to, and obtaining acknowledgements from, all current employees.  Instead, employers can simply deliver the notice and obtain the acknowledgment as part of the on-boarding process.

Notably, neither the new law itself nor the Civil Rights Law defines the term “employee,” raising the question, which has become increasingly critical since the start of the COVID-19 pandemic, whether the law applies to remote workers who do not live in New York.  To resolve this issue, New York employers will need to undertake a fact-specific inquiry to determine the “place of employment” of remote employees living outside of New York State.

New York employers that allow employees to use a personal device for work, i.e., that have implemented a “Bring-Your-Own-Device” (BYOD) program, should note that the notice requirement is not limited to employees who use employer-issued computers and mobile devices.  Thus, employers must provide the notice to any employee who participates in the employer’s BYOD program and who uses a personal device to transmit e-mail through the corporate e-mail server or to access the internet through the employer’s internet connection  

What are the details of the law’s requirements?

The law has two main requirements. First, employers that “monitor or otherwise intercept” their employees’ telephone calls, e-mail, or internet access or usage must provide written notice to employees who are subject to the monitoring and obtain their written acknowledgement of the notice.  The notice can be provided, and the acknowledgment obtained, electronically. 

Second, employers must also post the notice in a conspicuous place that is readily accessible to employees subject to electronic monitoring.  Employers can post this notice, for example, where they post all other legally required, employment-related posters/notices.

The new law appears to mandate the specific content of these notices.  The law provides that employers “shall advise” relevant employees that:

any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times and by any lawful means.

Given the law’s intention of promoting transparency, employers should consider whether to expand upon this notice language — for example, by specifically identifying which telephone lines will be subject to monitoring, whether both incoming and outgoing calls will be monitored, and whether personal calls are allowed on monitored lines.  This type of more-detailed notice should help to deter policy violations by providing unequivocal notice of the circumstances where misuse of corporate communications capabilities will be caught.

The law does not specifically address whether this notice must be delivered as a stand-alone document or whether the notice could be included in a larger document, such as an employee handbook.  However, the requirement that relevant employees specifically acknowledge the notice suggests that, at a minimum, if the notice is included within a larger document, employers should require an acknowledgment that is specific to the notice of electronic monitoring.

What are the limitations on the notice requirement?

The statute excludes from the notice requirement several methods of workplace surveillance many employers commonly use.  First, by specifically limiting the notice requirement to telephone, e-mail, and internet monitoring, the law, by negative inference, excludes surveillance by video cameras.  For the same reason, the law does not apply to location tracking, which is especially important for employers with vehicle fleets or large numbers of field employees.

The statute’s wording also strongly suggests that an employer’s review of stored e-mail and of voice mail left in an employee’s corporate voicemail box falls outside the purview of the law’s notice requirement.  This is because the law requires notice only when employers “monitor or otherwise intercept” employees’ telephone, e-mail and internet communications.  While the statute itself does not define the term “monitor” or “intercept,” New York courts, following the lead of federal courts construing the term “intercept” as used in the Federal Wiretap Act, have limited the term “intercept” as used in other New York laws to the acquisition of wire or electronic communications in transmission, i.e., real-time monitoring.  Consequently, the term “intercept” as used in the new law does not appear to encompass review of e-mail that already have been received, or listening to a recorded voicemail message.

Finally, the statute expressly excludes from the notice requirement electronic monitoring conducted solely for computer system maintenance and/or protection.  This exclusion would encompass, for example, use of data loss prevention (DLP) software and software that monitors internet traffic for malicious software.

Who will enforce the law?

There is no private right of action for violations of this statute; however, New York’s attorney general is authorized to enforce this statute.  The statute provides fines for violations of up to $500 for the first violation, $1,000 for the second violation, and $3,000 for the third and each subsequent violation.  It is unclear whether each failure to notify an individual employee of electronic monitoring and/or each failure to obtain that employee’s acknowledgement of the notice would be a separate violation.

Is the New York law an outlier?

While New York is the latest state to legislate in this area in quite some time, Connecticut and Delaware enacted similar laws in the early 2000s.  Delaware requires employers to either (1) provide electronic notice of monitoring to employees at least once during each day the employee accesses the employer-provided e-mail or internet; or (2) provide to employees a one-time notice of electronic monitoring. The penalties are $100 per violation. Connecticut’s law is more akin to New York’s law. Connecticut requires employers to (1) give written notice to employees who would be subject to electronic monitoring; and (2) post the notice in a conspicuous place. The Connecticut law has the same penalty structure as the New York law.

What can New York employers do next?

New York employers should consider taking the following steps:

• Determine the scope of their electronic monitoring activities and identify which of those monitoring activities fall within the scope of the notice requirement;
• Identify those new hires that will be subject to electronic monitoring and decide whether it will provide notice of electronic monitoring to, and obtain acknowledgement from, only those employees, or whether to distribute the notice more broadly for employee relations and deterrence reasons;
• Draft the notice language in a way that balances legal compliance, transparence, deterrence, and employee relations concerns;
• Develop a process for ensuring that all relevant new hires receive and acknowledge the notice of electronic monitoring; and
• Ensure each version of the notice presented to employees as well as acknowledgements are stored in a way that allows for easy production in the event the New York attorney general ever were to investigate allegations of non-compliance.