Earlier this year, Bond’s labor and employment attorneys reported on proposed legislation that would significantly expand New York employees’ rights to access and respond to information contained in their personnel files. That legislation is now law, creating new obligations for New York employers.

On Sept. 9, 2026, Governor Kathy Hochul signed A.2107/S.3460 into law, granting current and former employees new rights concerning their personnel records. Among other things, the new law gives employees the right to access their personnel records, requires employers to provide notice when certain “negative information” is placed in a personnel record and an opportunity for employees to respond and permits employees to add certain information to their records. The law takes effect on Nov. 8, 2026 (60 days after signing).

Access to Personnel Records

The new law gives current and former New York employees the right to review their personnel records up to two times per calendar year. Upon receiving a written request, employers must furnish the requested records within five business days.

Employers must also maintain a complete copy of an employee’s personnel record, without deletions or changes, from the employee’s date of hire through three years after the employee’s termination.

Notification of “Negative Information”

Employers must notify an employee within ten days after placing “negative information” in their personnel records. Negative information includes information affecting the employee’s qualification for employment, promotion, transfer, additional compensation or potential discipline.

An employer and employee may agree to correct or remove disputed information. If they do not reach an agreement, employees may submit a written statement responding to negative information and the employer must include that statement in the employee’s personnel record.

Enforcement and Remedies

The law allows employees to seek injunctive relief to remove information from their personnel records that their employer knew or should have known was false.

The New York Attorney General is empowered to seek civil penalties ranging from $500 to $2,500 against violators of the statute. In addition, workers who experience discrimination or retaliation for asserting their rights under the law have a private right of action.

What Employers Should Do Now

With the Nov. 8, 2026 effective date approaching, New York employers should begin taking steps now to prepare for their new obligations. In particular, employers should:

1. Establish a process for personnel file requests: identify who will receive and respond to employee requests and ensure that personnel records can be located, reviewed and produced within the law’s five-business-day deadline.
2. Review what is maintained in personnel files: employers should understand what documents and information are being placed in personnel records.
3. Create a procedure for “negative information”: employers should establish a process for identifying information subject to the law’s notice requirement and ensuring that employees receive the required notice within 10 days after the information is placed in their personnel records.
4. Train managers and HR personnel: supervisors should understand that placing disciplinary or other negative information in an employee’s personnel record may trigger the new notice requirements.
5. Review existing policies and forms: employers should update personnel record, disciplinary and recordkeeping policies and consider whether procedures should be revised to account for the new requirements.
    

Employers should use the period before November 8 to identify gaps in their current practices and implement a workable process for responding to personnel record requests and complying with the law’s new notice and recordkeeping requirements.

For questions or additional information regarding the new law and its requirements, please contact Jason Kaufman, Samuel Dobre, Rachel Kreutzer, any attorney in Bond’s Labor and Employment practice or the attorney at the firm with whom you regularly work.

On Sept. 4, 2024, Gov. Kathy Hochul signed legislation requiring public employers to notify employees if their disciplinary records are requested as part of a Freedom of Information Law (FOIL) request. This legislation applies to all entities covered by FOIL and went into effect as of Sept. 4, 2024.

This legislation amends Section 87 of the Public Officers Law by adding language which states: 

All agencies subject to the requirements of [the Public Officers Law] shall develop a policy regarding providing a notification to public employees in the event that the agency is responding to a request for such employee’s disciplinary records. 

Employers previously had no obligation to notify a public employee that their disciplinary records were the subject of a FOIL request. This legislation aims to promote recruitment and retention of individuals by providing them with knowledge that an individual or outside entity requested to review their disciplinary records.

Some aspects of the policy required by this legislation may be subject to bargaining if you have employees represented by a union. If you require assistance with drafting or negotiating a policy, please contact Emily Fallon, Alyson Mathews, any member of Bond’s labor and employment practice or the attorney at the firm with whom you are regularly in contact.

As a reminder, beginning March 12, 2024, Labor Law 201-i prohibits employers from requesting, requiring or coercing an employee or job applicant to: (i) disclose a username and password or other login information in order to access a personal account; (ii) access a personal account in the employer’s presence; or (iii) reproduce information contained within a personal account through unlawful measures. This new legislation also prohibits an employer from discharging or disciplining an employee or refusing to hire an applicant for failure to disclose such information.

The legislation is subject to certain exceptions and limitations. For example, an employer may require disclosure of information to access nonpersonal accounts that allow admission to “the employer’s internal computer or information systems.”[1] Employers may also view, access and rely on information that is publicly available.

The law also sets forth certain notice and acknowledgement requirements which employers must closely review. Specifically, under Section 5(i), an employer may obtain login information for accounts provided by the employer where the account is used for business purposes and the employee was provided prior notice of the employer’s right to inquire about such information. An employer is also permitted to access an electronic communications device which is “paid for in whole or in part by the employer where the provision of or payment for such device was conditioned on the employer’s right to access.”[2] However, the employee must have received prior notice of the condition and explicitly agreed to it. Nonetheless, the employer is prohibited from accessing any personal accounts on the device.

This law excludes law enforcement agencies, fire departments and departments of corrections and community supervision.

If you have any questions regarding the NLRB’s new rule, please contact Kali Schreiner, any attorney in Bond’s labor and employment practice or the Bond attorney with whom you are regularly in contact.

---

[1] N.Y. Lab. Law § 201-i (2)(b).

[2] Id. at § 201-i (5)(iii).

Today, an employee shares joyous news and says, “I’m expecting and due in 20 weeks!” You respond with congratulations, but then start thinking about all the new pregnancy-related legal protections you must comply with. Look no further, here are some highlights on what to expect when your employee is expecting…and beyond.

Read More >> What to Expect When Your Employee is Expecting…and Beyond!

With the proliferation of remote work options in today’s post-pandemic world, employers’ electronic monitoring of their employees’ daily activities has become more routine. On October 31, the National Labor Relations Board (Board) general counsel (GC) released a new memo cautioning against the potential violations of Section 7 of the National Labor Relations Act (Act) that use of such electronic monitoring may raise by “significantly impairing or negating employees’ ability to engage in protected activity and keep that activity confidential from their employer[.]” The GC announced intent to urge the Board to “zealously enforc[e]” existing Board precedent in this context and protect employees rights “to the greatest extent possible.”

Read More >> NLRB General Counsel Issues Memo on Electronic Monitoring, Artificial Intelligence and Employee’s Section 7 Rights

On July 19, 2022, Gov. Kathy Hochul announced the launch of a statewide hotline for employees who believe they have been sexually harassed in the workplace. This announcement follows several pieces of legislation¹ passed in March 2022, in which sexual harassment protections for employees were expanded. As part of the legislation, the New York State Division of Human Rights was directed to establish a toll-free, confidential hotline for complainants of workplace sexual harassment. Employees can call the hotline and receive advice on their legal rights as applied to their specific circumstances from attorneys, who staff the hotline pro bono. As of July 20, 2022, the hotline is operational from 9 a.m. to 5 p.m., and can be reached at 1-800-HARASS-3 (1-800-427-2773).

Read More >> NYS Launches Sexual Harassment Hotline

New York entities have one month to prepare required notices to employees for certain types of electronic monitoring. On Nov. 8, 2021, Gov. Hochul signed into law an amendment to the New York Civil Rights Law, that requires any private individual or entity with a place of business in the state to provide notice to employees for certain types of electronic monitoring. The law goes into effect on May 7, 2022, pushing employers to determine the scope of their electronic monitoring activities and begin updating their policies and issuing notices to ensure compliance with the new law’s requirements prior to its effective date.

Read More >> Mark Your Calendars: One Month Until New York’s Law Requiring Notice of Electronic Monitoring of Employees Goes into Effect

On March 29, 2022, a federal court in Upstate New York permanently enjoined New York State from requiring employers to include a government-issued “notice” of workers’ rights and remedies in their employee handbooks regarding reproductive health decisions.

Read More >> Court Permanently Enjoins New York from Enforcing Employee Reproductive Rights Notice Provision

On Nov. 8, 2021, New York Gov. Kathy Hochul signed a bill amending New York’s Civil Rights Law by adding a new section that requires employers to give prior written notice of any electronic monitoring to employees upon hire. The law takes effect on May 7, 2022. The law applies to all private sector employers in New York, regardless of the size of the employer. 

Read More >> New York Enacts Law Requiring Employers to Provide Notice of Electronic Monitoring

On December 11, 2018, the New York Court of Appeals issued a decision (over two dissenting opinions) addressing public access to police personnel and disciplinary records.  The Court held that certain personnel records sought by the New York City Civil Liberties Union (“NYCLU”) pursuant to the Freedom of Information Law (“FOIL”) are exempt from disclosure under New York Civil Rights Law § 50-a and New York Public Officers Law § 87(2)(a).  In doing so, the Court affirmed the decision of the Appellate Division, First Department, and the broad applicability of Civil Rights Law § 50-a to requests for police personnel/disciplinary records.

Read More >> New York Court of Appeals Issues Decision Addressing Public Access to Police Personnel and Disciplinary Records

It seems that reports of hackers breaching a business’s security measures to obtain customer information appear on an almost weekly basis.  Unfortunately, businesses need to worry not only about the unauthorized access of customer data by hackers, but also the unauthorized access of sensitive employee information as well.

Read More >> Employers May Be Liable for the Release of Employees' Personally Identifying Information in Data Breaches

Inherent in all employment relationships is the fact that employers are privy to all sorts of confidential information about their employees.  For example, in order to do something as simple as paying an employee’s wages, an employer will generally need to know the employee’s social security number, and, in cases of direct wage deposit, will also need to know the employee’s bank account information.  Employers also often come into possession of confidential medical information in connection with employees’ requests for medical leaves of absence under the Family and Medical Leave Act, or when engaging in the “interactive process” with disabled employees who have requested accommodation for their disabilities. Because employers are necessarily privy to confidential employee information, they are also inherently at risk for unauthorized disclosure of such information to others.  Especially with all of the news in recent months about consumer and employee data breaches, employers should question whether the security measures they have in place to protect private employee information are actually sufficient. But even those employers who have generally taken appropriate security measures are not necessarily immune from potential liability and are still at risk for potential disclosure of confidential information.  Take, for example, the situation where an employer, who has otherwise implemented appropriate controls to protect confidential information, is undergoing maintenance of its IT system, and during the maintenance process certain file access restrictions are temporarily disabled.  That is precisely the situation that occurred in Tank Connection, LLC v. Haight, a case that was decided by the U.S. District Court for the District of Kansas on February 5, 2016. The employer in Tank Connection, a manufacturer of above-ground storage tanks with approximately 300 employees, was like many other employers with regard to how it limited employee access to its IT systems:  “Each employee's computer was password protected.  Access to data on the server was controlled by user-account privileges (Microsoft Active Directory).  The user accounts were set up with standard authentication practices including user name and password.”  The company also had certain IT directories and files that were only accessible to Tank Connection’s president and network administrator because they contained confidential and proprietary information.  So far, so good.  But here comes the problem.  When the company changed its IT servers, certain security settings were not correctly transferred from the old server to the new, and a file whose access was previously restricted to the president and network administrator was now accessible to employees.  Unfortunately, this mistake was not discovered by the company until after a particular employee, who was leaving the company to work for a competitor, accessed and copied confidential information from the file just prior to leaving Tank Connection. When the mistake was ultimately discovered, Tank Connection took legal action to recover the information from the now former employee.  The company claimed that notwithstanding the mistake with the IT server, the employee accessed the information without authorization and essentially “stole” it from the company.  But the court ultimately rejected this claim, reasoning:  “The problem with Tank Connection's argument that [the employee] exceeded his authorized access is that it is premised upon a restriction that was supposed to be incorporated into its network settings, but which in fact was not. . . .  The fact that Tank Connection inadvertently provided [this employee] with access to the folder did not restrict or limit his authority.  Nor does the fact that [the employee] apparently accessed these folders for purposes contrary to Tank Connection’s interests amount to evidence that he exceeded ‘authorized access.’” In other words, despite Tank Connection’s intent to maintain confidentiality of the file, the inadvertent mistake that occurred with the IT server resulted in the company failing to properly protect the confidential information and exposing it to potential disclosure and misuse. An important lesson should be learned from the Tank Connection, LLC case -- actions speak louder than intentions with regard to maintaining confidentiality.  Even an employer’s best intentions to protect the confidentiality of employee information can go awry and will be rendered meaningless if the employer’s actions do not actually safeguard the information at issue.  To ensure that intentions match actions, employers should regularly audit their information security protocols, including all security measures in effect on their IT systems to protect confidential employee information kept in electronic form, to ensure the continued functionality of such measures and make sure that what they think is in place actually is.