Given the prevalence of remote work during the pandemic, electronic monitoring and surveillance of employees has become increasingly common. New York joins a handful of other states (including California, Connecticut and Delaware) in creating a statutory scheme specific to workplace monitoring.
What Counts as “Electronic Monitoring” Under the New York Act?
Under the Act, “electronic monitoring” covers any monitoring or intercepting of:
- Phone calls, such as monitoring employee phone calls in real-time.
- Emails, including intercepting employee emails that have not already been received.
- Internet access and internet usage, targeting employee internet usage where not tied to data loss prevention software or other software that monitors internet traffic for malware.
The law also covers monitoring of videoconferencing platforms, such as Zoom meetings, and applies to any electronic device or system, including but not limited to “computer, telephone, wire, radio, or electromagnetic, photoelectronic or photo-optical systems.”2 Delaware’s law covers similar electronic monitoring practices as the New York law, whereas Connecticut’s law goes further than New York or Delaware, covering information collected about employee activities on employers’ premises “by any means other than direct observation.”3
What Counts as “Notice” Under the Act?
Employers must provide advance written notice, in electronic form, to all employees hired after May 7, 2022, that:
“any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may subject to monitoring at any and all times and by any lawful means.”4
It is unclear whether the notice must include the language in the statute verbatim, or whether employers can satisfy the notice requirement with existing policies advising employees that their electronic activities on the employer’s systems may be subject to monitoring. However, given the notice obligation in the statute is written in mandatory terms (“an employee shall be advised…”5), the cautious approach for companies would be to update existing policies with the specific notice language used in the statute.6
Employers also must obtain a written or electronic acknowledgment from employees hired after May 7 that they received the required advance notice. Because the Act does not require a stand-alone notice and acknowledgment, employers should be able to satisfy these requirements by adding the notice language and acknowledgment to an existing employee handbook or manual that employees routinely receive and acknowledge at the start of employment.
Separately, the employer must conspicuously “post” the same notice in a place where it will be “readily available for viewing” by all employees who are subject to electronic monitoring.7 It remains to be seen whether employers can satisfy the conspicuous posting requirement with an online posting of the notice on the company’s intranet or whether including the notice in an online employee handbook would be sufficiently conspicuous and “readily available” for employee viewing to satisfy the posting requirement. In the absence of guidance from New York, we recommend taking a cautious approach and posting a hard copy of the notice in the same place where the employers includes other legally required notices.
Limited Exception for Certain Processes
The Act includes a safe harbor exception, where notice is not required. In order to qualify for the exception, the electronic monitoring must:
- Be used for managing the type and volume of emails, telephone voicemail or internet usage.8
- Not be targeted to monitor or intercept email, voicemail or internet usage of a particular individual (such as video monitoring an individual’s movements in the workplace).
- Be performed solely for computer system maintenance or protection.
The safe harbor would exclude routine system-based tasks that scan or block certain transmissions, such as firewalls or general monitoring for malware or spam.
AG Enforcement of the Act
With no private right of action, enforcement is left to the New York Attorney General (NYAG). For employers that violate the Act’s requirements, the NYAG has the authority to impose a civil penalty of up to $500 for a first offense, $1,000 for the second offense and $3,000 for the third and each subsequent offense.9
Takeaway
Private employers with a place of business in New York who may monitor their employees’ use of electronic devices should update their policies related to employee use of electronic equipment to comply with the advance notice and acknowledgement requirements that will apply to all new employees hired on or after May 7, 2022, the effective date of the Act. Employers should also post the required notice in a conspicuous place that is readily accessible to current employees.
As mentioned above, New York joins a few other states with similar laws. Companies of all sizes with locations in states with employee monitoring laws should examine their employee manuals, onboarding documents and offer letters to add language that satisfies employee monitoring notification requirements. To the extent that only some employees are subject to monitoring activities by the company, it will be important to keep track of which new hires will be monitored so that the company can ensure they are provided with proper notice and their acknowledgement obtained.
Please contact a member of Akin Gump’s cybersecurity, privacy and data protection team if you have any questions about these requirements or their impact on your company.
1 N.Y.S.B. S2628 amends the Civil Rights Law by adding new Section 52-c.
2 Id.
3 Conn. Gen. Stat. § 31-48d(a)(3).
4 N.Y.S.B. S2628 § 52-c(2)(b).
5 Id.
6 Delaware’s law similarly requires advance notice and gives employers the option of providing either electronic notice once each day the employees access the employer’s systems, or a one-time prior notice. 19 Del. C. § 705(b).
7 N.Y.S.B. S2628 § 52-c(1)(2)(a).
8 Some examples of processes that perform these functions include spam filters, proxy servers and firewall protections.
9 N.Y.S.B. S2628 § 52-c(1)(3).
