Monitoring employee communications – particularly electronic communications – is standard practice for most U.S. employers. Beginning in May 2022, however, employers in New York state who engage in electronic monitoring of employee communications will be required to make certain disclosures to their workers.
Pre-employment written notice for new hires
More particularly, on November 8, 2021, Governor Kathy Hochul signed into law state Senate Bill S2628 requiring that all Empire State employers – regardless of size or location within the state – provide prior written notice to newly hired employees if they intend to monitor or otherwise intercept employee emails, text messages, telephone conversations, Internet access, or usage of an electronic device or system. The notice must be provided in writing, in an electronic record, or in another electronic form, and must be acknowledged by each employee either in writing or electronically.
Notably, notice only needs to be provided “upon hiring.” This means that notices only need to be given to employees hired on or after May 7, 2022 – the law’s effective date – but not to existing employees. In addition to this notice, employers must post a notice of electronic monitoring in a conspicuous location within the workplace that is readily available for viewing by all employees who will be subject to the monitoring.
Escalating penalties for repeat violators
Employees are not expressly authorized to pursue private claims for alleged violations of the new law. However, the law will be enforceable by the New York state office of the attorney general, which is authorized to seek penalties of up to $500 for the first offense, $1,000 for a second offense, and $3,000 for third and subsequent offenses.
Trending? New York joins Connecticut, Delaware, and California
New York’s new notice requirement and civil penalty regime appear closely modeled after similar requirements in Connecticut and Delaware, both of which have been on the books for two decades. New York’s copycat legislation may indicate renewed state-level interest in scrutinizing employers’ data collection and use practices. California’s comprehensive privacy laws, the California Consumer Privacy Act of 2018 (CCPA) and its 2020 successor, the California Privacy Rights Act (CPRA), do not expressly address the monitoring of employee communications. They also treat many aspects of the employee-employer relationship as out-of-scope – at least until the laws’ partial exemption for employee data expires in January 2023. However, employers with a California presence may wish to consider the possible applicability of the CCPA’s current general notice requirements, which are not subject to the exemption and may impose comparable pre-data-collection notice obligations on employers.