New York Employers' Guide to Implementing Employee Monitoring Software

Studying the legal requirements should be the first step for any New York employer looking to implement or are currently using employee monitoring software Federal and state laws aim at protecting employee rights (including the right to privacy). They may impose significant limitations on monitoring practices the businesses may use.

Federal laws

On the federal level, the notable piece of legislation is the Electronic Communications Privacy Act (ECPA) of 1986. Under it, the intentional interception of wire, oral, and electronic communications is prohibited. However, there are two exceptions for employers:

• They can monitor communications if they have a legitimate business interest (the business purpose exception).

• Employers are allowed tracking if at least one party to the communication has consented (the consent exception). Ideally, this consent should be explicit. Although courts often interpret an employee's use of company-provided devices after the notice about monitoring as implied consent, explicit permission is always a safer approach.

Employers can track only company-owned devices and systems. If they want to track personal communications or devices, they can do it only with explicit consent or in case of rare exceptions.

The Stored Communications Act (SCA) is a part of ECPA that regulates employer access to stored electronic communications. Examples of such communications are emails or work-related call recordings saved on company servers. Generally, employers can access stored communications on their systems. However, accessing an employee's personal accounts (like a private Gmail) requires employee consent or a legal basis like a warrant.

New York State laws

New York has several notable regulations that complement the federal law. The first one is the Electronic Monitoring Law (Civil Rights Law Section 52-c), which took effect on May 7, 2022. It applies to all private employers in the area, regardless of their size, who monitor employees' electronic communications.

According to the Electronic Monitoring law, organizations must provide written notice to employees upon hire and annually thereafter, informing them that their communications may be monitored. Employees must acknowledge receipt of this notice in writing or electronically. Besides, employers must post these notices in conspicuous places where they can be seen by all employees (physical posters or electronic notices on login screens or internal networks).

The next crucial regulation is the New York Employee Privacy Law, effective March 12, 2024. Under it, employers must not request or require employees or job applicants to disclose usernames, passwords, or other authentication information for personal accounts (such as social media). Employers also must not demand employees to log in to their accounts in the employer's presence.

Beyond these already existing regulations, proposed legislation can further change monitoring practices. In 2023, the New York State Senate proposed Draft Bill 7623 which would restrict employers from using fully-automated decision-making tools. Employers would not be able to use these tools to screen candidates or make other decisions impacting work schedules, compensations, disciplinary actions, performance evaluations, and other terms of employment. In light of rapid AI development and its potentially biased output, such regulations are reasonable. Besides, Senate Bill 7623 proposes further restrictions on workplace monitoring, such as using the least intrusive methods, minimizing data collection, proportionality, and detailed notice about what data is collected, how, when, and for what purpose.

Implementing employee monitoring software effectively goes beyond simply complying with relevant privacy regulations. Employers should also think about the ethical side of the matter and the potential effects of monitoring on employees' morale and motivation. If we combine legal requirements and ethical considerations, we can list the following best practices for implementing monitoring software:

• Be transparent: Be upfront with your employees about the existence, nature, and purpose of monitoring. Acquire employee consent for tracking, especially if you track their communications.
• Limit monitoring to legitimate business purposes: only monitor activities directly relating to your stated business objectives, such as performance evaluation or protecting trade secrets. Avoid monitoring employees' personal communications or areas where employees have a reasonable expectation of privacy.
• Minimize data collection: collect only the data necessary to achieve your monitoring goal. The less sensitive data you collect, the lower the risk of misuse or a data breach. Delete the data that does not serve its purpose anymore.
• Never monitor employees' private social media accounts or ask them to provide their usernames or passwords to their private accounts.
• Seek expert legal counsel: the legal field can be tricky and changeable. This article is a general overview and may not reveal all the intricacies of the NY regulations and unique circumstances of your business. When in doubt, consult with an attorney specializing in New York employment law to ensure your monitoring plans, policies, and implementation methods are fully compliant.
• Develop a comprehensive employee monitoring policy: this policy should cover the scope of collected data, terms of its storage and use, and monitoring practices. The policy should be readily available to all employees.
• Regularly review and update the policy: Technology changes rapidly, and so can laws and best practices. Periodically review your monitoring policy and practices to ensure they remain compliant with current federal and New York state laws and still serve their intended purpose effectively and ethically.
• Ensure consistency and non-discrimination.

A clear, comprehensive, well-crafted employee monitoring policy is a necessary part of employee monitoring. It makes the tracking practices clear for the staff and the employer and minimizes potential legal and ethical pitfalls. It should include the following key components:

• A clear statement of the monitoring purpose
• Scope of monitoring: what activities and communications are tracked
• Methods used for monitoring (video surveillance, network logs, monitoring software, etc.)
• Description of how the collected data is used, how long it is stored, and who has access to it
• A clear statement that employees should not expect privacy when using company-owned devices, networks, and systems, regardless of whether the usage is work-related or personal
• Compliance with law
• Consequences of the policy violation
• A section where employees sign or electronically confirm that they have received, read, and understood the policy.

When the first draft of the policy is complete, ask a legal counsel experienced in New York employment law to review it. This way, you will be sure it complies with current state and federal regulations.

When the policy is complete, distribute it among the employees. Collect written or electronic acknowledgments of acceptance from all employees, particularly new hires during onboarding. Maintain records of these acknowledgments.

The policy should always be available to all employees. For example, you can place it in the employee handbook, company intranet, or the common area.

Do not forget to regularly review and update the policy following the evolving technology and legal landscape.

Implementing employee monitoring in New York requires careful consideration of federal and stringent state regulations and the creation of a comprehensive monitoring policy. Prioritizing legitimate business purposes, practicing data minimization, and seeking legal counsel are essential steps in creating a compliant and ethical monitoring program that benefits the employer and the workforce. Responsible implementation is key to leveraging monitoring technology effectively while upholding legal obligations and fostering a trusting work environment.