As a reminder, beginning March 12, 2024, Labor Law 201-i prohibits employers from requesting, requiring or coercing an employee or job applicant to: (i) disclose a username and password or other login information in order to access a personal account; (ii) access a personal account in the employer’s presence; or (iii) reproduce information contained within a personal account through unlawful measures. This new legislation also prohibits an employer from discharging or disciplining an employee or refusing to hire an applicant for failure to disclose such information.

The legislation is subject to certain exceptions and limitations. For example, an employer may require disclosure of information to access nonpersonal accounts that allow admission to “the employer’s internal computer or information systems.”[1] Employers may also view, access and rely on information that is publicly available.

The law also sets forth certain notice and acknowledgement requirements which employers must closely review. Specifically, under Section 5(i), an employer may obtain login information for accounts provided by the employer where the account is used for business purposes and the employee was provided prior notice of the employer’s right to inquire about such information. An employer is also permitted to access an electronic communications device which is “paid for in whole or in part by the employer where the provision of or payment for such device was conditioned on the employer’s right to access.”[2] However, the employee must have received prior notice of the condition and explicitly agreed to it. Nonetheless, the employer is prohibited from accessing any personal accounts on the device.

This law excludes law enforcement agencies, fire departments and departments of corrections and community supervision.

[1] N.Y. Lab. Law § 201-i (2)(b).

[2] Id. at § 201-i (5)(iii).

[View source.]