On August 4, 2023, the New York legislature introduced Senate Bill 07623 (“S07623”), which would dramatically restrict employers’ ability to use both electronic monitoring and automated employment decision-making technology in the state. As currently written, S07623 would apply to all New York employers regardless of size, including an employer’s labor contractors. While S07623 is currently being reviewed by the Rules Committee and still must work its way through the legislative process, it is expected to pass in some form. Because S07623 would create significant new obligations and restrictions for New York employers, they should take note of its requirements and track its progress.

S07623, as currently written, would affect employers’ ability to use two types of tools: (i) electronic monitoring tools (“EMTs”); and (ii) automated employment decision tools (“AEDTs”). S07623’s proposed impact on each of these tools is summarized below.

Electronic Monitoring Tools (“EMTs”)

S07263 defines an EMT as “any system that facilitates the collection of data concerning worker activities or communications by any means other than direct observation, including the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectric, or photo-optical system.” This broad definition would include a number of commonly-used EMTs in the employment space, including email, keystroke and biometric monitoring. If passed, S07263 would make it unlawful for employers to use EMTs to “surveil” employees residing in New York unless: (i) the EMT is primarily intended to accomplish an allowable purpose; (ii) the specific type of EMT is strictly necessary to accomplish the allowable purpose and is the least invasive means that could reasonably be used to accomplish that purpose; and (iii) the electronic monitoring is limited to the smallest number of workers and collects the least amount of data necessary to accomplish the allowable purpose. “Allowable purposes” for EMTs are as follows: (i) allowing a worker to accomplish an essential job function; (ii) monitoring production processes or quality; (iii) assessing worker performance; (iv) ensuring compliance with employment, labor, or other relevant laws; (v) protecting the health, safety, or security of workers; (vi) administering wages or benefits; or (vii) additional purposes to enable business operations as determined by the New York Department of Labor.

S07263 would further require employers to notify employees who reside in New York that they will be subject to electronic monitoring. The notice that S07263 would require is extraordinarily thorough, and must include: (i) a description of the allowable purpose for which the EMT will be used; (ii) a description of the specific employee data to be collected, and the activities, communications, and job roles that will be electronically monitored; (iii) a description of the dates, times, and frequency that electronic monitoring will occur; (iv) whether any employee data collected through electronic monitoring will be used as an input in an AEDT; (v) whether the data collected by the EMT will be used to inform an employment decision by the employer; (vi) whether any employee data collected by the EMT will be used to assess employees’ productivity performance or to set productivity standards, and if so, how; (vii) a description of where any employee data collected by the EMT will be stored and the length it will be retained; and (viii) an explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the allowable purpose. Notice of the specific form of electronic monitoring must be clearly and conspicuously posted, and cannot say that electronic monitoring “may” take place or that the employer “reserves the right to do so.” Employers who engage in random or periodic electronic monitoring must clearly and conspicuously inform affected workers of the specific events that are being monitored at the time the monitoring takes place, unless the monitoring is necessary to preserve the integrity of an investigation of illegal activity or to protect the immediate safety of workers, customers or the public.

S07623 also contains a number of other extensive restrictions on employers’ use of electronic monitoring technology. For instance, and perhaps most broadly, employers would be unable to use electronic monitoring technology to “unduly or extremely intensify the conditions of work or to harm the health and safety of employees,” or to “identify, punish, or obtain information about employees engaging in activity protected under labor and employment law.” Employers would also be prohibited from requiring employees to install monitoring applications on their personal devices, or to “wear, embed, or physically implant those devices,” whether subcutaneously or on clothing or personal accessories, unless the monitoring in strictly necessary to accomplish essential job functions. Likewise, employers could not electronically monitor off-duty employees, and would be specifically obligated to disable location-tracking applications outside of the activities and time necessary for an employee to perform his or her job. Certain kinds of electronic monitoring, including facial recognition, gait or emotion recognition technology, would be strictly banned. 

Finally, S07623 would prevent employees from selling, transferring, or disclosing employee data collected via an EMT to any other entity, unless required under state or federal law. S07623 would also compel employers to destroy employee data collected via an EMT when “the initial purpose for collecting the data has been satisfied” or at the conclusion of the monitored employee’s employment, unless there is a “reasonable interest for the worker to access the data after the relationship has ended.” (emphasis added).

Automated Employment Decision Tools (“AEDTs”)

Following on the heels of New York City’s recently-enacted Automated Employment Decision Tools Law (the “NYCAEDTL”), S07623 would also impose restrictions on New York employers’ ability to use AEDTs if passed. Like the NYCAEDTL, S07623 would prohibit the use of AEDTs to “substantially assist or replace discretionary decision making” unless subject to a bias audit performed no more than one year prior to the AEDT’s use. Even with a proper bias audit in place, New York employers would be unable to rely solely on output from an AEDT in hiring, promotion, termination, disciplinary or compensation decisions. Similar to the NYCAEDTL, S07623 defines “AEDT” as “any computational process, derived from machine learning, statistical modeling, data analytics, or artificial intelligence, that issues simplified output” such as a “score, classification, or recommendation, that is used to substantially assist or replace discretionary decision making.”

Under S07623, employers would be required to notify all job candidates or employees that an AEDT is being used no later than ten business days prior to use, and allow candidates to request an “alternative selection process or accommodation” that does not involve the AEDT. Within the same time frame, employers would also be required to disclose the job qualifications and characteristics that the AEDT will use to make its assessment, as well as “any outputs” it will produce. Employers would be prohibited from both requiring candidates or employees to consent to the use of an AEDT and from disadvantaging candidates or employees solely on their request for an accommodation.

Unlike the NYCAEDTL, S07623 goes on to place a number of additional restrictions on employers’ use of AEDTs. Such restrictions include, but are not limited to, prohibitions on using AEDTs to: (i) “unduly or extremely intensify the conditions of work or to harm the health and safety of employees, including by setting unreasonable productivity quotas”; (ii) make predictions about a candidate or employee’s behavior, beliefs, intentions, personality, emotional state, or other characteristic unrelated to the employee’s essential job functions; (iii) implement a “dynamic wage-setting system that pays employees different wages for the same work”; or (iv) draw on facial recognition, gait or emotional recognition technologies.

Under S07623, employers who make a hiring, promotion, termination, disciplinary, or compensation decision based on output from an AEDT would be required to provide affected employees with a large quantity of information, including: (i) the specific decision for which the AEDT was used; (ii) any information or judgments used in addition to the AEDT in making the decision; (iii) the specific employee data that the AEDT used; (iv) the individual, vendor, or entity who created the AEDT; (v) the individual or entity that executed and interpreted the results of the AEDT; and (vi) a copy of any bias audits regarding the AEDT in question.

Penalties

Penalties for violating S07623 could be severe. Employers who violate S07623’s requirements would be subject to civil penalties for each day that an electronic monitoring tool or AEDT was used unlawfully, and failure to provide required notices under the law would give rise to a separate violation. Civil penalties would begin at $500 for a first violation and increase to $1,500 for subsequent violations. S07623 is silent as to whether a private right of action would be specifically authorized, but does state that its provisions “shall not be construed as to limit any right of any employee or candidate of employment to bring a civil action in any court of competent jurisdiction.”

If passed, S07623 would take effect 180 days after being signed into law.