On November 8, 2021, Governor Katchy Hochul signed into a law a bill that will require employers to provide notice to employees of electronic monitoring of telephone, email, and internet access and usage.

The law will go into effect on May 7, 2022 and apply to all private employers with a place of business in New York State, regardless of size. Employers must provide notice to new employees upon hiring if the employer does, or plans to in the future, monitor or intercept the electronic communications of its employees. The notice to new employees must be in writing (hard copy or electronic) and must be acknowledged by the new employee either in writing or electronically. Employers will likely be able to satisfy this obligation during the onboarding process.

Current employees do not need to sign an acknowledgement, but employers must post a notice of electronic monitoring in a conspicuous place where it is readily visible to employees subject to monitoring, such as a break room.

Since the law requires that one notice be provided for current or future monitoring, it does not appear that employers will need to provide any notice to employees when starting electronic monitoring. Prior to the law going into effect, however, employers will want to consider updating their employment handbooks to include a section on electronic monitoring. Additionally, employers with remote employees will want to consider how to ensure its employees have access to the electronic monitoring notice in a fully remote environment.

The law appears to indicate what must be included in the notice, stating that employers “shall advise” employees that

Any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times any by any lawful means.

Notably, the law will not apply to processes that are designed to manage the type or volume of incoming or outgoing electronic mail or telephone voice mail or internet usage, are not targeted to monitor or intercept the activities of a particular individual, and are performed solely for the purpose of computer system maintenance and/or protection.  

There is no private right of action for individuals to enforce the law. Instead, the law will be enforced by the Attorney General. The law provides for fines of up to $500 for the first violation, $1,000 for the second violation, and $3,000 for the third and subsequent violations.

Should you have any questions or would like to better understand how this new law applies to your business, please do not hesitate to contact us.