Relates to regulation of unsolicited advertisements and sale, rental or exchange of personal information

Summary of specific provisions

The bill provides that whenever a person, firm, partnership, corporation or association purchases or acquires through trade a listing of persons utilizes in any unsolicited advertisement or unsolicited telephone advertisement, such entity shall establish an opt-out system and disclose to the consumer that he/she has the right to restrict unsolicited advertisements. The entity shall maintain an exclusion list of advertisement. Disclosure is not required in instances where such entity has an established business relationship with the consumer.

Additionally, whenever any person, firm, partnership, corporation, or association sells, rents, exchanges or releases or is preparing to sell, rent, release or exchange customer personal information, the entity must establish a system whereby a client or customer can opt-out of the practice of having his/her personal information commercially released. In addition to disclosing to consumers the practice of commercially trading customer information and the opt-out option prior to selling, renting or releasing personal identification information, a clear and conspicuous written notice disclosing this practice must be given to the consumer or data subject upon initial contact and on at least an annual basis. Such conspicuous notice may be inserted in a mailing or billing statement. Those consumers who want to restrict the sale or release of their listing or personal identification information shall be listed on an exclusion list. The list shall be used only for compliance with the requirements of this act and not for trade or commercial purposes.

Whenever the court determines that a violation involving disclosure occurred, the Court shall impose a civil penalty not to exceed two hundred fifty dollars. When the court determines that a violation involving the exclusion list has occurred, the court shall impose a civil penalty of not more than five hundred dollars. A second or

subsequent offense shall be punishable by a civil penalty not to exceed one.

No person, firm, partnership, corporation or association shall be deemed to have violated the provisions, if such entity shows by a preponderance of the evidence that the violation was not intentional and resulted from a bona fide error made notwithstanding the maintenance of procedures adopted to avoid such error. Any person injured by reason of any violation may bring an action to recover actual damages or fifty dollars, whichever is greater.

The court may increase the award to an amount not to exceed three times the actual damages up to one thousand dollars if the court finds that the defendant willfully or knowingly violated the provisions.

Effects of present law which this bill would alter

The general business law is amended by adding two new sections 394-f and 394-g.

Justification

Advancements in computer science, telecommunication, and data collection are having revolutionary impacts on our lives. Individuals are losing control over personal and sensitive information and lifestyle data. Privacy is being slowly eroded. Data about almost every aspect of our lives are being collected, stored, and sold faster than you can say computer. The new technologies, which came of age in the 1980's, not only, facilitate increased demands for personal information but also more intrusive data collection and information sharing. Now, sophisticated computer-matching projects allow companies to cross reference and correlate extensive and highly detailed databanks.

Computer matching or databanking compares information on a database with that on another often resulting in more detailed databases. By overlaying the data available through many systems, it's now possible to create a remarkably detailed picture of anyone. Rarely do they ask our permission to use that information or sell it to others. We are not compensated in any way and we are not given any opportunity to ensure that the data are accurate. Data about almost every aspect of our lives are being collected, stored and sold. Today, credit bureaus, credit card companies, banks, publishers, telemarketers, utilities, non-profits and other businesses compile customer or clientele information and peddle lists to direct marketers usually without the knowledge or consent of their constituents. Moreover, list brokers and other companies purchase information and glean data from various sources to develop detailed profiles and dossiers for further commercial exploitation.

Unfortunately, this data gets into the hands of con artists who perpetrate fraud against the unsuspecting consumer. The customer list of

NEW YORKER magazine, for example, rents for over $26,000 whereas the list of the WALL STREET JOURNAL costs $168,000. As many as 75% of nonprofit organizations rent or exchange donor lists without the consent of the contributors. In other examples, it has been reported that a national weight loss group sold its membership list to a company that sells chocolate candy. A nonprofit group fighting Sudden Death syndrome sold a donor list to a broker who then tried to sell the list to others marketing the list as a good pool of potential customers for children's products, even though some lost their babies. A dating service, which had promised confidentiality to its clients, sold their names to a company that marketed the list as a group of singles and as potential buyers of specialized foods. Some businesses and organizations are concerned about the privacy concerns of consumers. While Red Cross, Reader's Digest and AT&T refuse to rent their lists to others, many businesses who trade or offer names for rent or sale give their customers the option to restrict the sale of their information (e.g. American Express, Lands End). Since 1980, the disabled American Veterans has been one of the major non-profits to include a statement on its solicitations advising donors that it occasionally rents its mailing list and advising donors to notify them if they want their names deleted. As a result of database marketing and computer matching, marketers identify customers for targeting marketing and other solicitations. Because of waste and inefficiencies in direct marketing, it would be better for marketers and others to institute the opt-out process because the marketing lists would consist of better prospects -- those consumers who chose not to opt-out. One can argue that bills or other solicitations providing for an opt-out for consumers enables marketers and businesses to target hotter prospects, those that really want to receive the solicitations.

The public is making it increasingly clear that they are worried about the wide distribution of personal information and what, ultimately, others may do with this information or construe it to mean. Several studies and surveys have revealed that consumers are very concerned about this breach of privacy and want to make their own choices in the marketplace.

In the American Express Study 1988 -- 90% of those surveyed did not think that companies disclose enough about their list usage practices and 80% were of the opinion that companies should not give out personal information to others. In Cambridge Reports--Trend and Forecasts Technology and Consumers: Jobs, ed, and privacy 1989 survey, 2 out of 3 consumers indicated that personal privacy is important with many saying that they feared that their privacy is in jeopardy. One-half of those surveyed believed new laws are needed for the protection of privacy. In addition, in a recent Harris Poll, commissioned by Equifax, 79% of those surveyed were concerned about threats to their privacy. Only 64% had expressed the same fears in a

1978 poll. Most business executives shared this concern -- 70% of bank and thrift execs, 67% insurance execs, and 66% of the direct marketers. Of those questioned, 71% stated that consumers have lost control over how personal info is circulated and used by companies. More than 69% were opposed to direct marketers being able to buy from list making companies information about their consumer characteristics. Moreover, 76% opposed companies being able to purchase from credit bureaus names and addresses of consumers who meet certain criteria.

Furthermore, in a recent Time Magazine Poll on Privacy, 76% of the people were concerned about the amount of computerized information that business and government collect and store. In addition, 90% of the people said companies that collect and sell information should be prohibited from selling data on household income; 86% on bill-paying history; 83% medical history; and 68% on product purchases. Finally, 93% of the people agreed that companies that sell data should be required by law to ask permission from individuals before making the information available. This bill also addresses the complaint that there is too much paper invading the homes of consumers. By estimates, the average American is on more than 50 mailing lists. Six to 10,000 catalog retailers use mailing lists to send out nearly 11.8 billion catalogs a year. Over the course of a lifetime, the average American will devote 8 entire months to shifting through mail solicitations. Last year about 41 lbs. of junk mail have been generated for each adult American consuming millions of trees each year. Of the pile that reached mailboxes, an estimated 44% landed in trash cans, unopened and unread, thereby contributing to our solid waste crisis. Discards amount to more than 2% of the total clutter in our landfills. Another related complaint is that checks, credit cards, and other valuables get lost in the mounds of paper that consumers toss out daily. Because the volume of unsolicited mail is so great, people are paying less attention to each commercial piece they receive. Even businesses who have a relationship with the customer often have to convey a message several times in order to secure the consumer's attention. Thus unsolicited requests cause the price of other direct mail services to increase. From a data protection viewpoint, these marketing actions violate the Code of Fair Information Practices, a set of privacy principles drafted by government representatives and computer and privacy experts in 1973 to minimize the privacy risks of automated systems containing personal information. The core principle that any information obtained for one purpose should not be used for another purpose without the consent of the person is central to the issue. It is based on the premise that when someone gives personal information for a particular purpose -- to obtain a warranty, to reserve expects that information will not be used for another purpose without consent. This bill balances the privacy interests of consumers with business interests.

While the bill does not outlaw the practice or prohibit companies from collecting and selling records of customer information and transactions without written consent, the proposal establishes an opt-out policy which has been adopted by many responsible businesses. The proposal is consistent with the federal Telephone Consumer Protection Act of 1991, which was enacted into law to safeguard the privacy rights of consumers. Under that law, an opt-out system is mandated to prevent the marketing of listings of those who object to receiving unsolicited telephone calls.

Fiscal implications

None.

Effective date

The act shall take effect on the ninetieth day after it shall have become a law.