Employee monitoring laws in New York

Where workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.

An employer that monitors or otherwise intercepts an employee's telephone conversations or transmissions, email or other electronic transmissions, or internet access or usage, by any electronic device or system (computer, telephone, wire, radio, electromagnetic, photoelectronic or photo-optical systems included), must give prior written notice on hiring to every employee subject to that monitoring. The notice may be in writing, an electronic record or another electronic form, and the employee must acknowledge it in writing or electronically.

The employer must also post the notice of electronic monitoring in a conspicuous place readily available for viewing by the employees who are subject to the monitoring.

For the written notice, the employee must be advised that any and all telephone conversations or transmissions, email or transmissions, and internet access or usage by the employee through any electronic device or system (computer, telephone, wire, radio, electromagnetic, photoelectronic or photo-optical systems included) may be subject to monitoring at any and all times and by any lawful means.

Sections 250.45 to 250.60 do not apply to law enforcement personnel on authorised duties, to a security system announced by a prominent written notice on the premises saying video surveillance has been installed for security, or to video devices fitted so that anyone can see them at once. The compliance duty for any business running security cameras is therefore a posted notice at the premises or plainly visible cameras, and never coverage of the rooms listed in 250.45(3). For the dissemination offences the obscenity-law provisions of sections 235.15(2) and 235.24(1) and (2) apply.

Before any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.

Workers and their representatives should be told about every data collection process, the rules governing it and their rights.

Covert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.

An employer must not arrange or permit video capture of a worker inside a restroom, a locker room or a room set aside for staff to change clothes, unless a court order allows it. The duty is on causing the recording, so cameras installed by landlords, contractors or security vendors at the employer's request are caught, as are cameras outside the room whose field of view reaches inside.

A video recording made in violation of the section may not be used by the employer for any purpose, including discipline, investigation, litigation or security review. The control is a procedure that quarantines and destroys any such footage once discovered.

Deliberately using or fitting an imaging device to covertly watch, broadcast or record someone in a bedroom, changing room, fitting room, restroom, toilet, bathroom, washroom or shower, or in a room assigned to a guest at a hotel, motel or inn, without that person's knowledge or agreement, is the second-degree offence. There is a rebuttable presumption that the actor had no legitimate purpose.

The second-degree offence (class E felony) includes covertly viewing, broadcasting or recording, with an imaging device one uses or installs, a person who is dressing or undressing or that person's intimate parts, in a protected setting and without their knowledge or agreement, for amusement, entertainment or profit, to degrade or abuse, or for sexual arousal or gratification; recording under a person's clothing without consent; and recording in an identifiable manner a person engaged in sexual conduct in a place of reasonable privacy without consent.

Unless the chapter specifically provides otherwise, no person may intentionally intercept, try to intercept, or procure anyone else to intercept or try to intercept, any wire, oral or electronic communication. For an employer this covers real-time capture of calls, email or messages in transit, keystroke or screen tools that acquire message contents as they are sent, and listening devices, unless an exception (provider, business extension, consent) applies.

A person not acting under color of law may intercept a wire, oral or electronic communication where that person is a party to it or one of the parties has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act against the Constitution or the laws of the United States or any State. Employers commonly obtain the employee's prior consent through a signed monitoring policy; consent must cover the monitoring actually carried out, and state all-party consent laws can still apply.

The prohibition turns on the use of an electronic, mechanical or other device. Telephone or telegraph equipment or facilities, or their components, furnished to the subscriber or user by a provider in the ordinary course of its business and used by the subscriber or user in the ordinary course of its business (or furnished by the subscriber or user to connect to the service and so used), and equipment used by a provider in the ordinary course of its business, are not such a device. An employer's use of its phone system to monitor business calls can fall outside the prohibition where the monitoring is in the ordinary course of business; hearing aids are also excluded.

A person who, without lawful authority, wiretaps, mechanically overhears a conversation, or intercepts or accesses electronic communications commits eavesdropping, a class E felony. For a business this means call recording, meeting capture, voicemail and email monitoring and network interception are lawful only where at least one party (for conversations) or the sender or receiver (for telephone and electronic communications) has consented, or an eavesdropping warrant authorises it.

Monitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.

Output from electronic surveillance should never be the sole input when a worker's performance is judged.

Keep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.

Unless subsection (c) applies, no person may intentionally access without authorization a facility through which an electronic communication service is provided, or intentionally exceed an authorization to access it, and thereby obtain, alter or prevent authorized access to a wire or electronic communication while it is in electronic storage in that system. Penalties (2701(b)): for commercial advantage, malicious destruction, private gain or in furtherance of a criminal or tortious act, up to 5 years (10 for a repeat); otherwise up to 1 year (5 for a repeat after a prior conviction). For an employer this reaches logging into an employee's personal email, social media or messaging account, for example with a saved password on a work device, without the employee's authorization.

Subsection (a) does not apply to conduct authorized by the person or entity providing the wire or electronic communications service. An employer that provides its own email or messaging service to employees can authorize access to communications stored on that service; the authorization does not extend to services the employer does not provide, such as an employee's personal webmail.

Subsection (a) does not apply to conduct authorized by a user of the service with respect to a communication of, or intended for, that user. Access to an employee's stored messages with that employee's authorization is outside the offense; access to a third party's messages needs that user's authorization or another exception.

5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.

Employers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.

Employers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.