Restricts the disclosure of personal information by businesses

Section Two states the legislative intent

Section Three changes the article heading of article 39-F of the General Business Law from "Notification of Unauthorized Acquisition of Private Information" to "Acquisition and Use of Private Information."

Section Four of the bill amends the General Business Law to add a new section 899-bb which states that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all of the customer's personal information retained by the business.

A business that discloses a customer's personal information to a third party shall make the following information available to the customer free of charge:

* All categories of the customer's personal information that were disclosed; and

* The names and contact information of all third parties that received the customer's personal information from the business, including the third party's designated request address or addresses if available.

* A business required to comply with this Act shall make the required information available by one or more of the following means:

* By providing a designated request address and, upon receipt of a request, providing the customer within thirty days with the required information for all disclosures occurring in the prior twelve months, provided that:

> If the business has an online privacy policy, that policy includes a description of a customer's right, accompanied by one or more designated request addresses;-provided that a business with multiple online privacy policies must include this information in the policy of each product or service that collects personal information that may be disclosed to a third party;

> The business ensures that all persons responsible for handling customer inquires about the business' privacy practices or the business' compliance with this section are informed of all designated request addresses; and

> The business provides information pertaining to the specific customer if that information is reasonably available to the business, and provides information in standardized format if information pertaining to the specific customer is not reasonably available.

For information required to be provided under this Act, the business must provide the customer with notice including the required information prior to or immediately following a disclosure.

A business is not obligated to provide more than one notice to the same customer in a twelve-month period about the disclosure of the same personal information to the same third party and in not obligated to respond to a request by the same customer more than once within a twelve-month period.

A business in not obligated to provide information to the customer if the business cannot reasonably verify that the individual making the request is the customer.

"Categories of information" is defined as:

* Identity information including, but not limited to, real name, alias, nickname or user name;

* Address information, including but not limited to, postal address or email;

* Telephone number;

* Account name;

* Social Security number or other government-issues identification number, including but not limited to, social security number, driver's license number, identification card number and passport number;

* Birthdate or age;

* Physical characteristic information, including but not limited to height and weight;

* Sexual information, including, but not limited to, sexual orientation, sex, gender status, gender identity or expression;

* Race or ethnicity;

* Religious affiliation or activity;

* Political affiliation or activity;

* Professional or employment-related information;

* Educational information;

* Medical information, including but not limited to, medical conditions or drugs, therapies, mental health or medical products or equipment used;

* Financial information, including but not limited to, credit, debit, or account numbers account balances, payment history or information related to assets, liabilities or general creditworthiness;

* Commercial information, including but not limited to, records of property, products or services provided, obtained or considered or other purchasing or consuming histories or tendencies;

* Location information;

* Internet or mobile activity information, including, but not limited to, Internet protocol addresses or information concerning the access or use of any Internet or mobile-based site or service;

* Content, including text, photographs, audio or visual recordings or other material generated or provided by the customer.

The legislation further provides a definitional section.

A violation of the Act constitutes a right to a civil action to recover penalties by the customer, the Attorney General, a District Attorney, a City Attorney, or a City Prosecutor in a court of competent jurisdiction.

Existing law

New law

Justification

The Right to Know Act will modernize current privacy law and give New York consumers an effective tool to monitor how their personal information, including information about their health, finances, location, politics, religious, sexual orientation, buying habits, and more, is being collected and disclosed in unexpected and possibly harmful ways.

Many websites incorporate scores of tracking tools that collect information about visitors like age, gender, race, income, health concerns and recent purchases for advertising and marketing companies.

Many mobile applications (apps) share location, age, gender, phone numbers, and other personal details of both adults and children with third party companies - which can lead to potential danger for the consumer involved in the transaction. And Facebook apps used by a consumer's "friend" can often access sensitive information about that consumer, including religious, political, and sexual preferences.

There are numerous examples of companies that collect information about consumer activities inadvertently exposing sensitive personal information such as pregnancy status or sexual orientation. Data brokers are engaged in the Widespread buying, selling, and trading of personal information obtained from mobile phones, banks, social media sites, and stores creating a secondary market for confidential consumer data. When this information is incorrect, it can impact credit scores, hurting an individual at their place of employment or being denied credit. Moreover, scanners are using data broker lists to target vulnerable populations, such as senior citizens

Legislative history

New bill

Fiscal implications

Minimal

Effective date

This act shall take effect immediately.