Enacts New York State Internet Privacy Law to which operators of websites may voluntarily be subject; limits disclosure of personal information to those submitting

Title of bill

An act to amend the general business law, in relation to protecting the privacy of internet users

Purpose or general idea of bill

To create a New York State Internet Privacy Law with rigorous privacy rules, which New York State could enforce against web site operators who hold out to the public that they comply with the law.

Summary of specific provisions

Section one is the bill's short title: the New York State Internet Privacy Law. Section two contains legislative findings. Section three continues the substance of the law, including definitions, applicability, disclosure rules, third parties' obligations, inspection rights, and enforcement provisions. Section four sets the law's effective date.

Justification

Privacy is a major concern of Internet users. Surveys regularly report that the lack of privacy is the most significant factor inhibiting potential customers from engaging in on-line transactions. When Internet use first took off, most users thought that their activity could be done anonymously. At this point, most people are at least somewhat aware that Internet use is not private. The typical Internet user leaves detailed trail of personal information on what subjects interest them, what they might buy, and who they correspond with. That detailed personal information is bought and sold as commodity. But, the specifics as to what information is collected, and who gets the information, remain largely a mystery.

Most responsible companies doing business on the Internet recognize the importance of privacy protection. Many have established privacy policies, and some participate in self-regulatory schemes. The difficulty with self-regulatory plans is that they are not enforceable. Neither federal nor state law protects privacy of Internet use. The borderless nature of the Internet, and concomitant jurisdictional problems, have been problematic for states interested in protecting Internet privacy.

The key element of the instant bill is that it applies only to a web business that chooses to hold out to the public that it complies with the privacy law. In doing so, the business would be effectively submitting itself to New York State's jurisdiction, and the first enforceable Internet privacy law in the United States. Internet users' privacy would be protected by meaningful enforcement mechanisms. And, businesses would benefit by potential customers feeling secure enough to conduct business with them. Consumer choices would, for the first time, include protecting their privacy with a clearly enforceable law. The law's substantive privacy rules would be strong, and in line with generally accepted principles of privacy protection, including notice, and personal control of information. Third parties which receive information would also have to comply with this law. Enforcement would be by Attorney General action, or by private lawsuits.

Prior legislative history

2000: A.9401-A (Parment) - Passed Assembly. 2001: A.5789 (Stringer) - Held in Rules Committee. 2002: A.5789 (Stringer) - Referred to Consumers. 2004: A.4385 (Klein) - Referred to Consumers. 2006: S.4597 - Referred to Consumer Protection. 2008: S.2227 - Referred to Consumer Protection.

Fiscal implications

None.

Effective date

180 days succeeding enactment.