Private employers in New York will now need to notify and obtain employee acknowledgement prior to engaging in any electronic monitoring under the provisions of S2628, signed by Governor Kathy Hochul on November 8, and effective May 7, 2022. With this law, New York joins Connecticut and Delaware in mandating that employers provide employee notice of monitoring, which, in practice, can be integrated into the sort of employee privacy notice required under the California Consumer Privacy Act.

Applicability and Obligations for Businesses

S2628 applies to any private employer with a place of business in New York that electronically monitors employees’ communications and internet activity. The law’s core provisions require that upon an employee’s hiring, the employer must provide prior written notice alerting the employee that their telephone conversations, e-mails, and internet access or usage may be monitored using any electronic device or system such as a computer, telephone, wire, radio, or electromagnetic, photoelectronic, or photo-optical systems. The notice must be in writing or electronic form and acknowledged by the employee in writing or electronically. Employers must also post the notice describing the electronic monitoring in a conspicuous place that is readily available for employees to view.

Catching up to Connecticut and Delaware

Employers in Delaware and Connecticut will be familiar with these requirements under corresponding state laws. In Delaware, under 19 Del. C. § 705, any employer that monitors or otherwise intercepts any telephone conversation, e-mail, or internet access or usage must provide prior notice to Delaware employees. Such notice can occur either as (1) a one-time notice, before monitoring, in writing or in electronic form, with a written or electronic acknowledgement from the employee, or (2) an electronic notice at least once during each day the employee accesses the employer-provided e-mail or internet access services.

Similarly, Connecticut’s Gen. Stat. § 31-48(d) mandates that any employer engaged in electronic monitoring (defined as the collection of information about employees’ activities or communications on the employer’s premises other than by direct observation) must give prior written notice to all employees. Like the New York law, Connecticut requires that the employer post in a conspicuous place which is readily available for viewing by employees a notice concerning the employer’s types of electronic monitoring. However, unlike the New York statute, which requires both prior written notice and a conspicuously posted notice, Connecticut law provides that posting in this manner can satisfy the prior written notice requirement.

Exceptions

The New York law exempts from the notice and acknowledgement requirement those processes that are (i) designed to manage the type or volume of incoming or outgoing e-mail, telephone voice mail, or internet usage; (ii) not targeted to monitor or intercept a particular individual’s e-mail, telephone voice mail, or internet usage; and (iii) performed solely for the purpose of computer system maintenance or protection.

Enforcement

While the New York law does not provide for a private right of action, the state attorney general can impose civil penalties of $500 for the first offense, $1,000 for the second offense, and $3,000 for the third and all subsequent offenses.

Next Steps

Prior to the law’s effective date in May 2022, New York employers should either draft individual forms notifying employees of any electronic monitoring or revise existing acceptable use policies to discuss such monitoring. Regardless of the method selected, employers must ensure that employees provide written or electronic acknowledgement prior to commencing their employment and that the notice is posted in a conspicuous place for employees to review. With New York joining Connecticut and Delaware in requiring the disclosure of monitoring, and California mandating an employee privacy policy that would also disclose such monitoring, one can safely assume that most large U.S. companies will soon need to provide employees with notice of these activities and with a means for employees to acknowledge their monitoring.