Quick Hits<\/p>\n
New York Governor Kathy Hochul signed Senate Bill S3460 on September 9, 2026, adding new Section 210-b to the New York Labor Law.<\/p>\n
The law takes effect sixty days after signing, or November 8, 2026.<\/p>\n
Employers must provide employees with a copy of their personnel record, at no cost, within five business days of a written request.<\/p>\n
Employers must notify employees within ten days of placing negative information in a personnel file and permit written rebuttals.<\/p>\n
Violations carry fines of $500 to $2,500, enforced by New York\u2019s attorney general, and the statute includes an express anti-retaliation provision.<\/p>\n
Questions remain as to scope and enforcement, but employers should be aware of the potential for a new retaliation-based cause of action.<\/p>\n
Background<\/p>\n
On September 9, 2026, Governor Kathy Hochul signed Senate Bill S3460<\/a>, adding new Section 210-b to the New York Labor Law. The law applies to both private- and public-sector employers and extends access rights to current and former employees alike. According to the governor\u2019s office, New York now joins at least seventeen other states with a personnel-file access requirement.<\/p>\n Governor Hochul signed S3460 at the state\u2019s annual Labor Appreciation Reception at the City University of New York\u2019s (CUNY) School of Labor and Urban Studies, underscoring the labor-friendly legislative environment in Albany ahead of the upcoming gubernatorial election. The law takes effect on the sixtieth day after signing, or November 8, 2026.<\/p>\n What Counts as a \u2018Personnel Record\u2019?<\/p>\n The statute defines a \u201cpersonnel record\u201d broadly as \u201ca record kept by an employer that identifies an employee, to the extent that the record is used, has been used, or may affect or be used relative to that employee\u2019s qualifications for employment, promotion, transfer, additional compensation, or disciplinary action.\u201d<\/p>\n That definition is not limited to a physical or single folder maintained by human resources (HR). The law specifically requires that personnel records include, without limitation, the following written information or documents prepared by the employer:<\/p>\n the employee\u2019s name, address, and date of birth;<\/p>\n the employee\u2019s job title and description;<\/p>\n the employee\u2019s rate of pay and other compensation;<\/p>\n the employee\u2019s starting date of employment;<\/p>\n the employee\u2019s job application and resume;<\/p>\n all performance evaluations of the employee;<\/p>\n written warnings of substandard performance;<\/p>\n lists of probationary periods;<\/p>\n waivers signed by the employee;<\/p>\n copies of dated termination notices; and<\/p>\n any other documents relating to disciplinary action.<\/p>\n The definition also extends to records held by third-party vendors who have a contractual agreement with the employer to keep or supply personnel records. The one limitation is that a personnel record does \u201cnot include information of a personal nature about a person other than the employee if disclosure would constitute a clearly unwarranted invasion of [that] other person\u2019s privacy.\u201d<\/p>\n Notably, the statute\u2019s use of \u201cwithout limiting the applicability or generality of the foregoing\u201d suggests that the enumerated list is expansive. Emails, investigation notes, informal disciplinary memos, and records maintained outside a traditional HR file may qualify if they are used or could be used in connection with employment decisions. The precise boundaries of this definition will likely be shaped by future guidance or litigation.<\/p>\n The Five-Business-Day Clock and Limits on Requests<\/p>\n Once the law takes effect, an employer that receives a written request from an employee must provide a complete copy of the employee\u2019s personnel record, at no cost, within five business days. Employers may limit employees to two requests per calendar year, but a request triggered by the placement of negative information in the file does not count toward that cap.<\/p>\n The right to access personnel records extends to former employees as well. The statute defines \u201cemployee\u201d as \u201ca person currently employed or formerly employed by an employer.\u201d However, employers are required to retain a complete personnel record (without deletions or expungement) only from the date of hire through three years after separation. Former employees who make a request after that three-year window may find that the employer is no longer obligated to maintain the record, though the statute does not impose a deadline on the former employee\u2019s right to make a request.<\/p>\n For employers with decentralized HR operations, multiple worksites, or a mix of paper and electronic recordkeeping systems, operationalizing a five-business-day turnaround may require significant resources.<\/p>\n Notice of Negative Information and the Right to Respond<\/p>\n Perhaps the most significant and ambiguous aspect of the new law is the notice-and-rebuttal requirement. The statute requires employers to notify an employee within ten days of placing in the employee\u2019s personnel record any information that is, has been used, or may be used to negatively affect the employee\u2019s qualifications for employment, promotion, transfer, additional compensation, or the possibility that the employee will be subject to disciplinary action.<\/p>\n The breadth of this language raises practical questions. A written warning or a performance improvement plan would almost certainly trigger the notice obligation. But what about a mediocre but not overtly negative performance review? Or an email from a manager documenting a performance conversation? The statute does not clearly define what it means to \u201cnegatively affect\u201d an employee\u2019s qualifications, and the word \u201cmay\u201d suggests the obligation could be interpreted very broadly. These questions are likely to remain unresolved until the Attorney General\u2019s office issues guidance or litigation tests the boundaries.<\/p>\n Once notice is given, the employee has the right to respond. If the employee disagrees with any information in the file, the employer and employee may mutually agree to remove or correct it. If they cannot reach agreement, the employee may submit a written statement explaining the employee\u2019s position, which then becomes a permanent part of the personnel record. That statement must be included whenever the underlying information is transmitted to a third party, so long as the original information is retained in the file.<\/p>\n The law also provides employees with a remedy for false information: if an employer places information in a personnel record that the employer \u201cknew or should have known to be false,\u201d the employee may seek expungement through a collective bargaining agreement, other personnel procedures, or the judicial process.<\/p>\n Enforcement and Penalties<\/p>\n The statute provides that any violation \u201cshall be punished\u201d by a fine of between $500 to $2,500. Enforcement authority rests exclusively with the Office of the New York Attorney General.<\/p>\n Notably, the statute does not appear to create an express private right of action for violations of the access, notice, or response provisions. The enforcement language mirrors the structure of the Massachusetts statute, which similarly channels enforcement through the state\u2019s attorney general rather than through individual lawsuits for statutory violations. That said, the statute does create a separate right of action for employees seeking to expunge false information from their personnel records.<\/p>\n Whether the absence of a broader private right of action will limit the statute\u2019s practical enforcement remains to be seen. Under the Massachusetts model, the limited enforcement mechanism provided for criminal fines enforceable by the attorney general ultimately left a gap that the courts ultimately filled through the common law, as discussed below.<\/p>\n Anti-Retaliation Protections<\/p>\n The statute includes an express anti-retaliation provision that goes beyond its Massachusetts counterpart. Section 210-b(8) provides that no employer \u201cshall discharge, threaten, penalize, or in any other manner discriminate or retaliate against any employee who exercises such employee\u2019s rights under this section.\u201d<\/p>\n The statute further defines prohibited retaliation to include, but not be limited to, \u201cthreatening to contact or contacting United States immigration authorities or otherwise reporting or threatening to report an employee\u2019s suspected citizenship or immigration status or the suspected citizenship or immigration status of an employee\u2019s family or household member.\u201d<\/p>\n This anti-retaliation language is significant for several reasons. First, it establishes an explicit statutory prohibition on retaliation that the Massachusetts statute does not contain (though under Massachusetts law<\/a>, an employee discharged for submitting a written rebuttal in response to the placement of negative information in his personnel file can state a claim against the employer for wrongful termination in violation of public policy). Second, it sweeps broadly: the phrase \u201cin any other manner discriminate or retaliate\u201d could encompass a wide range of adverse employment actions, from termination and demotion to less obvious forms of retaliation such as schedule changes, reassignments, or exclusion from opportunities. Third, the immigration-specific language reflects the legislature\u2019s awareness of vulnerable worker populations and is consistent with a trend in recent New York employment legislation.<\/p>\n However, the statute does not specify the enforcement mechanism for the anti-retaliation provision. It is not clear whether the \u201cenforced by the attorney general\u201d language in Section 210-b(7) is meant to apply to retaliation claims under Section 210-b(8), or whether the retaliation provision creates an independent basis for an employee to bring a private claim. This ambiguity is likely to generate future litigation.<\/p>\n What Employers Can Do Now<\/p>\n With an effective date of November 8, 2026, employers operating in New York should consider taking the following steps:<\/p>\n Auditing existing records and storage practices. Determine what is currently maintained in personnel files, where those files reside, and whether they align with the statute\u2019s broad definition of \u201cpersonnel record.\u201d<\/p>\n Building a request-response process. Establish a clear intake process for written requests, designate responsibility for compiling records, and create a workflow that can consistently produce a complete copy within the five-business-day window.<\/p>\n Developing a negative-information protocol. Create procedures for identifying when information that may negatively affect an employee is added to a file, issuing the required ten-day notice, and receiving and filing employee rebuttal statements.<\/p>\n Given the ambiguities in the statute\u2019s enforcement provisions, the potential for additional retaliation claims, and the short compliance windows, employers will want to ensure that their policies, practices, and training programs are aligned with the new law.<\/p>\n Ogletree Deakins\u2019 New York offices<\/a> will continue to monitor developments and will provide updates on the New York<\/a> blog as additional information becomes available.<\/p>\n Follow and Subscribe
LinkedIn<\/a> | Instagram<\/a> | Webinars<\/a> | Podcasts<\/a><\/p>\n