On November 8, 2021, New York became the third state to require private employers to provide employees with notice of employer monitoring of phone, email, and internet access/usage. New York’s new law (SB 2628) goes into effect on May 7, 2022. New York joins Connecticut and Delaware, whose laws are already in effect. Unfortunately for employers, the three laws differ with respect to what is covered, when and how employers are to notify employees, and the amount of civil penalties.
What is covered
The New York law will cover any private employer with a place of business in the state
who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio, or electromagnetic, photoelectronic or photooptical systems.
Connecticut uses a similar list, but also broadly covers “collection of information on an employer’s premises concerning employees’ activities or communications by any means other than direct observation.” On the other hand, Delaware regulates both public and private employers but affects employers as well as any of their agents or representatives that: “monitor or otherwise intercept any telephone conversation or transmission, electronic mail or transmission, or Internet access or usage of or by” a Delaware employee.
Employee notice
New York’s new law will require private employers to notify new employees on hiring, and will require the employer to post a “notice of electronic monitoring in a conspicuous place which is readily available for viewing by its employees who are subject to electronic monitoring.” Connecticut has a similar conspicuous posting requirement, but requires notice be provided to all employees. In contrast, Delaware gives employers a choice: either (1) provide notice every day when the employee accesses employer-provided email or the Internet, or (2) provide one-time written or electronic notice to the employee, which the employee must acknowledge electronically or in writing.
Civil Penalties
The new New York law does not include a private right of action, but will permit the Attorney General to bring an action for $500 for the first offense, which can increase to $1,000 for a second offense, and $3,000 thereafter. Connecticut uses a similar structure, although the Labor Commissioner is the enforcement agency. In Delaware, the law simply provides for a $100 civil penalty for each violation, which can be filed in any court of competent jurisdiction.
Takeaways
We note that none of these three laws contains an express exception for civil discovery, so companies should include the proper language in their on-screen statements that employees must acknowledge in order to access the company systems and/or in the employee handbooks that employees must sign.
Companies may want to review their employee privacy and monitoring policies, especially with the new New York law taking effect in May of 2022, and the California Privacy Rights Act, Colorado Privacy Act, and Virginia Consumer Data Protection Act all taking effect in 2023. Note also that these state laws are in addition to employers’ obligations under federal laws, such as the Electronic Communications Priva
