Senate Bill S2628 went into effect on May 7, 2022. The bill, which was signed into law by Governor Hochul on November 8, 2021, requires all private sector employers--regardless of size, number of employees, or entity type--to provide notice to employees of their electronic monitoring practices.

The bill amended the Civil Rights law by adding a new section, 52-c. Employers must now provide notice of their electronic monitoring practices to all employees upon hiring. Notice provided to employees upon hiring must be in writing, and the employee must acknowledge the notice in writing or electronically. Employers are not required to receive an acknowledgment from existing employees.

Employers must also post notice in a "conspicuous place" viewable to all employees who are subject to electronic monitoring. To comply with this provision of the law, employers should post a printed copy of this notice in the same place where they post other employee posters and notices. At their election, employers may also choose to post the notice on their intranet portal.

The written notice must advise employees that any and all telephone conversations, e-mail, or internet access or usage, including by computer, telephone, wire radio or electromagnetic, photoelectronic, or photo-optical systems, may be subject to monitoring "at any and all times and by any lawful means."

The Attorney General has the authority to enforce the law by imposing civil penalties. The maximum penalty for the first offense is $500; the maximum penalty for the second offense is $1,000; and the maximum penalty for the third and each subsequent offense is $3,000. The law does not include a private right of action.

The law does not apply to "processes that are designed to manage the type or volume of incoming or outgoing electronic mail or telephone voice mail or internet usage of a particular individual, and that are performed solely for the purpose of computer system maintenance and/or protection."

The stated justification for the new law is to protect employee privacy by making sure employees understand "the consequences of inappropriate internet activity." The bill also says that by making guidelines regarding appropriate internet use, employees will be less likely to "undermine company standards." Employers will still have the right to monitor employees' computer usage as long as employees are informed of the surveillance. This will "increase transparency" within organizations and avoid lawsuits regarding invasion of privacy. Lastly, employees will be able to make informed decisions regarding their internet usage with full knowledge of the impact of their decisions.

Since this law just recently took effect, employers should immediately implement the notice requirements of the law if they have not already done so. In addition to requiring new hires to acknowledge the notice in writing or electronically and posting the notice in a conspicuous place, employers should also update their employee handbooks and policies to include the notice. Although the Department of Labor has not provided a model notice, employers may wish to use language taken directly from the statute to ensure full compliance.