New York Employers Must Notify Employees of Phone and Email Monitoring

Seyfarth Synopsis: Under a new statute, New York employers are required to notify employees if they intend to monitor their company-controlled phones, email, or internet use.

New York Governor Kathy Hochul signed legislation on November 8, 2021 that requires all private employers to notify their employees of their intention to monitor work phones, email, or internet use.  The law is effective as of May 7, 2022.

Under the new law, any employer that monitors or otherwise intercepts email or transmissions by employees must provide them with written notice upon hiring.  (The law does not specifically address notice requirements for current employees.)  The notice must be in writing or electronic format and must be acknowledged in writing or electronically by the employee.

Additionally, employers must post a notice in a “conspicuous place which is readily available for viewing by its employees.”  The notice must advise employees that “any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times and by any lawful means.”

According to the “justification” section of the bill provided by the sponsors, employers “will retain the right to monitor computer usage, simply with the stipulation that employees are informed of surveillance practices,” which they say “will increase transparency within the organization,” “help to avoid lawsuits and litigation regarding invasion of privacy,” and “permit employees to make informed decisions about their internet use with full knowledge of the ramifications of their actions, while supporting companies' ability to monitor Internet activity within their organization.” 

The bill specifically provides that it does not apply to processes that (1) are designed to manage the type or volume of incoming or outgoing electronic mail or telephone voice mail or internet usage, (2) are not targeted to monitor or intercept the activities of a particular individual, and (3) are performed solely for the purpose of computer system maintenance and/or protection.

Any employer that violates the law will be subject to a maximum civil penalty of $500 for the first offense, $1,000 for the second offense, and $3,000 for the third and each subsequent offense.  The law will be enforced by the state Attorney General, not the Department of Labor, and does not provide for a private right of action.  (The statute is an amendment to the state’s Civil Rights Law, not the Labor Law or the Human Rights Law.)

Please reach out to the authors of this alert or another Seyfarth contact if you wish to discuss these developments.