This week, two pieces of important employee privacy legislation were passed in New York. The first is an amendment to New York’s civil rights law that adds new requirements for businesses that conduct employee monitoring activities in the state. And, the second only applies to businesses in New York City in relation to automated employment decision tools used for hiring and promotion purposes.
New York Civil Rights Law Amendment
A new amendment was signed into law on Monday, November 8, 2021, that requires employers in the state of New York to notify employees how they will be electronically monitored at the time of hiring and publish the notice so that employees may access the information.
Specifically, the law requires employers who “monitor or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage of or by an employment by any electronic device or system” to implement the following steps:
Provide employees written notice of the electronic monitoring upon hiring with sufficient details of the monitoring activities.
Obtain acknowledgement by the employee either in writing or electronically that the employee has received the written notice.
Post the notice of electronic monitoring in a conspicuous place and readily available to any employees who are subject to the monitoring.
These requirements apply to any “individual, corporation, partnership, firm, or association with a place of business in the state.” The amendment does not apply to the state or its political subdivisions. These requirements also do not apply to the extent that the monitoring is not intended to monitor employee behavior but instead solely for system maintenance and protection. To the extent that employers use the same information for dual purposes, the law will apply.
This new law will be enforced by the attorney general. Penalties are $500 for the first offense, $1000 for the second offense, and $3,000 for third and subsequent offenses. The law takes effect in May 2022.
New York City’s Law on Automated Employment Decision Tools
New York City Council passed a new law on November 10, 2021, that requires employers in the city that use automated decision-making tools for employment or promotion decisions to conduct a bias audit and notify candidates residing in the city that their application is subject to an automated decision tool.
The new law makes it unlawful for employer to use automated decision-making tools for hiring or promotion purposes within the city unless a bias audit is conducted. An independent auditor must perform the bias audit within the year prior to its use. The bias audit must include testing to assess the tool’s “disparate impact on any persons of any component 1 category required to be reported by employers pursuant to subsection (c) of section 2000e-8 of title 42 of the United States Code as specified in part 1602.7 of title 29 of the code of Federal Regulations.” Component 1 category data includes reports on the racial/ethnic and gender composition of an employer’s workforce by specific job categories. Additionally, prior to the employer’s use of the tool, the employer must make publicly available, on the employer’s (or its agency’s) website, a summary of the audit results and “distribution date of the tool.”
Employer’s must provide in its notice to candidates and employees the following information:
· That an automated decision-making tool will be used to assess or evaluate the candidate or employee; and
· The job qualifications and characteristics that the tool will use to assess the candidate or employee.
If the employer does not disclose the notice on the employer’s (or its agency’s) website, upon written request by the candidate or employee, and within 30 days of the request, the employer must make available information about the type of data collected, source of the data, and retention policy.
Employer’s must provide this notice to employees or candidates at least 10 days before the use of the automated decision-making tool and permit the individual to “request an alternative selection process or accommodation.
The new law goes into effect on January 1, 2023, and will be enforced by the city’s corporation counsel (or its designate). Civil penalties range from $500 for a first offense (and each additional violation occurring on the same day as the first offense) to not less than $500 or more than $1,500 for subsequent offenses. Additionally, every day after the first offense will give rise to a separate violation of the law. Failure to give notice will be treated as a separate offense.
Several states already require notice for employee monitoring activities, and the California Consumer Privacy Act and its amendments under California Privacy Rights Act have broader employee notice requirements. The addition of these new employment privacy laws in New York further reinforces the importance for organizations to consider their approach to employee privacy and implement practices and policies to better understand the collection and use of applicant and employee data.
Jennifer Ruehr, Of Counsel with Hintze Law, counsels retail, technology and e-commerce clients on global privacy, security, and related data technology and transactional matters.