New York Video Surveillance Laws

New York video surveillance laws create overlapping compliance duties for security teams. A lawful program depends on more than where cameras are installed. Employee notice and data handling can each create separate risk. City-specific rules may add another obligation. Security directors and facilities managers should review each surveillance obligation separately.

How New York Separates Video Surveillance Rules

New York Penal Law Article 250 includes unlawful surveillance and dissemination provisions in Sections 250.40 through 250.65. For video surveillance, liability turns on whether the subject occupies a location where a reasonable person would believe they could fully disrobe in privacy.

Where Cameras Are Prohibited

Section 250.45 lists specific locations where a rebuttable presumption of illegitimate purpose applies automatically: bedrooms, changing rooms, fitting rooms, restrooms, toilets, bathrooms, washrooms, showers, and any room assigned to guests or patrons in a motel, hotel, or inn.

Installing cameras in any of these locations may trigger a rebuttable presumption that they were installed for the purpose of surreptitiously viewing, broadcasting, transmitting, recording, photographing, filming, or taking an image of another person, which the installer can rebut with evidence that the device was not used for that purpose.

Labor Law § 203-C separately prohibits employers from making video recordings of employees in restrooms, locker rooms, or employer-designated changing rooms, absent a court order. No employer may record employees in a restroom, locker room, or room designated for changing clothes. This prohibition cannot be overcome by signage or consent.

Permitted locations include lobbies, building entrances, retail sales floors, open work areas, parking lots, hallways, stairwells, elevator banks, and restricted-access technical spaces. Security teams should verify that camera angles do not inadvertently capture any portion of a prohibited area, such as a hallway camera angled toward a restroom interior.

The § 250.65 Safe Harbor

Section 250.65 provides an explicit exemption from criminal liability under §§ 250.45, 250.50, 250.55, and 250.60 for security systems meeting either of two conditions: a written notice is conspicuously posted on the premises stating that video surveillance has been installed for security purposes, or cameras are installed so their presence is clearly and immediately obvious.

Satisfying both conditions simultaneously is the recommended approach.

Workplace Electronic Monitoring Notice

Civil Rights Law § 52-C requires all private employers with a place of business in New York to provide written notice before monitoring employee telephone conversations, email, or internet usage. New York law separately addresses certain forms of workplace video recording and privacy-related surveillance.

Three Obligations Under § 52-C

Employers must deliver written notice to each employee at or before the time of hire, obtain a written or electronic acknowledgment of receipt, and maintain a conspicuous workplace posting visible to all monitored employees.

The notice must tell employees that monitoring may occur at any time by lawful means. The statute excludes the state and its political subdivisions. Systems monitoring conducted for general security purposes that does not target a particular employee is exempt.

Penalties escalate from $500 for a first offense to $3,000 for third and subsequent offenses, and the law authorizes the New York Attorney General to enforce these penalties. Failure to notify employees can violate the statute.

Data Handling Under the SHIELD Act

The SHIELD Act (General Business Law §§ 899-aa and 899-bb) governs data security for any entity holding computerized private information of a New York resident. The law expressly includes biometric information in its definition of "private information." The applicability of the full safeguards and breach notification requirements depends on whether the data meets the SHIELD Act's definition of protected information.

Organizations must implement reasonable administrative, technical, and physical safeguards. The physical safeguards provision includes requirements related to the disposal of protected information and media. New York law focuses on reasonable safeguards and disposal once information is no longer needed for business purposes. It does not prescribe a specific statewide minimum retention period for video footage. A December 2024 amendment imposed a 30-day breach notification deadline.

NYC Adds a Separate Compliance Layer

Biometric Identifier Information Law

NYC Local Law 3 of 2021 (Admin. Code §§ 22-1201 through 22-1205) requires commercial establishments collecting biometric identifier information from customers to post a clear, conspicuous sign at or before the point of customer entry. The law prohibits selling, leasing, or otherwise profiting from biometric data and creates a private right of action with $500 per violation in civil damages, a significant departure from Attorney General enforcement only under state law.

Landmark Building Camera Restrictions

The NYC Landmarks Preservation Commission limits camera density on designated landmark buildings: no more than two cameras per 25 feet of street frontage for small buildings and three per 25 feet for large buildings. On landmark buildings, LPC rules limit the number of security cameras based on street frontage, such as no more than two or three cameras for every 25 feet of frontage, and generally discourage installation on a primary façade unless no other option exists.

Penalties and Criminal Exposure

Unlawful surveillance in the second degree (§ 250.45) is a Class E felony. Eavesdropping (§ 250.05) carries the same classification. Staff who distribute improperly obtained footage face independent criminal liability under § 250.55 (Class A misdemeanor) or § 250.60 (Class E felony). SHIELD Act violations can result in civil penalties under New York law.

Building a Compliant Surveillance Program in New York

New York imposes distinct compliance requirements under multiple frameworks, such as the SHIELD Act and, for covered financial entities, the NYDFS Cybersecurity Regulation. Violations of Article 250 are criminally prosecuted, while employee electronic monitoring notification under CVR § 52-C is enforced through AG civil penalties.

Teams operating in New York City must also account for biometric disclosure signage and data monetization prohibitions on top of the state-level framework.

Document each obligation separately and review camera placements. Track pending legislation such as Senate Bill S7623A to help keep compliance programs aligned with the state's active regulatory trajectory.

Closing Thoughts

New York surveillance compliance depends on disciplined review of placement, notice, data handling, and local requirements. Camera deployments can drift out of alignment as views change or workplace practices shift. Regular review and clear documentation help security teams keep systems useful and reduce legal risk.

Frequently Asked Questions

What are the specific locations where security cameras are prohibited under New York state law?

New York state law absolutely prohibits cameras in employee restrooms, locker rooms, and changing areas. Other locations like bedrooms, fitting rooms, and hotel guest rooms carry a rebuttable presumption that installation of an imaging device is for no legitimate purpose under New York law.

What notice requirements must New York employers follow when monitoring employees with video surveillance or electronic monitoring?

Employers must provide written notice at or before hire, obtain written or electronic acknowledgment of receipt, and post conspicuous workplace notices visible to all monitored employees confirming that lawful monitoring may occur at any time.

How does New York City's Biometric Identifier Information Law differ from state-level surveillance regulations?

Local Law 3 enables individual customers to sue directly for violations, whereas state surveillance laws rely on Attorney General enforcement. This shifts enforcement from centralized state authority to individual plaintiffs, significantly expanding legal exposure for commercial establishments.