New York Will Soon Require Employers to Notify Employees in Writing About Phone, Email, and Internet Monitoring

On November 8, 2021, Governor Hochul signed a bill into law that requires private New York employers to provide written notice to employees before monitoring their telephone, email, and internet access or usage.  This law goes into effect on May 7, 2022.

Who does the law apply to?

The new legislation requires all private employers, regardless of size, with a place of business in New York State that engage in electronic monitoring of employee phone, email, and internet access or usage to “give prior written notice upon hiring to all employees who are subject to electronic monitoring.”

Does the notice have to be issued in a specific form?

Employers must provide the notice in writing, in an electronic record, or in another electronic form and, importantly, employers must make sure employees acknowledge the notice in writing or electronically.  Unless further guidance is issued, it is unclear whether this notice can be included in an employee handbook or must be delivered as a stand-alone document.

In addition, the law requires employers to post the electronic monitoring notice in a “conspicuous place which is readily available for viewing” by employees subject to the monitoring.

So, what does the notice need to say?

In terms of the contents of the notice, it should advise the employee “that any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times and by any lawful means.”

Non-compliance has its costs…

If employers violate the law, they could face up to $500 for the first offense, $1,000 for the second offense, and $3,000 for the third, and each subsequent, offense.

Are there any exceptions?

The law, however, does create an exception for certain activity that is (a) designed to manage the type or volume of email, telephone, or internet use; (b) not targeted to monitor or intercept the email, telephone, or internet usage of a particular employee; and (c) performed solely for purposes of systems administration and/or protection. Therefore, notice is not required for such activity.

What to do next?

Employers should review their policies and speak to counsel about what actions must be taken to comply with this new law on or before the May 7, 2022 effective date. Employers should draft notice language that complies with the law’s requirements and decide upon a process that ensures all new hires receive the notice and provide the requisite acknowledgment.