Relates to establishing the New York state online privacy act

Summary of provisions

Overview: This bill

* creates a new Office of Privacy Protection in the Executive Depart- ment, overseen by a commissioner confirmed by the Senate. The office provides oversight, information, referral, and enforcement of the priva- cy laws updated in this bill.

* creates a 9-member public-private Privacy Protection Advisory Commit- tee to aid the office in policy and oversight.

* prohibits sharing personally identifiable information by a website or online service without express permission of the user,

* requires that websites and online services have a privacy policy that is publicly accessible by being on the first webpage of a site or easily accessible by email

* prohibits imposition of penalties for refusing access to an individ- ual's social media by employers or universities,

* extends the protections in the federal Children's Online Privacy Protection act to minors over 13 and less than 16 (COPPA already protects minors under 13),

* requires notification to the office in the event of a security breach

* creates significant penalties for willful or negligent failure to comply with the new privacy provisions

* authorizes creation of a new breach alert system in the Office of Information Technology Services.

Detail:

Section 1. Creates a new article 10-a in the executive law, the Office of Privacy Protection, whose purpose is to promote and protect the privacy of personal information of individuals. The office is headed by a commissioner confirmed by the Senate. Responsibilities are to:

1. Receive complaints concerning violations of Article 39-H of the General Business Law, the New York State online privacy act, Article 39-F, the breach law, and violations of other privacy-related laws, refer them to appropriate agencies, and require follow up reports.

2. Provide information and referral on use, protection, and disposal of personally identifiable information in the State online privacy act and the breach law, including the lawful use of social security numbers.

3. Develop informational and educational programs and materials on privacy issues.

4. Assist as requested in training of local, state, and federal law enforcement agencies on identity theft and other privacy-related crimes.

Privacy Protection Advisory Committee: The measure also creates the 9-member Privacy Protection Advisory Committee, with ex officio members (secretary of state, attorney general, commissioner of Homeland Securi- ty, and \director of the Office of Information Technology Services) and five persons appointed with Senate confirmation who have been executives in the information technology industry for five years or more, or have been privacy compliance officers, or consultants, academic researchers, teachers, lawyers, or have held a similar position requiring expertise in the field of privacy and information technology. The director of the Office of Information Technology services chairs the advisory committee. Terms are two years, and the committee is required to meet at least three times a year. The Committee is to advise the commissioner on all matters relating to privacy concerns, and on such other matters as the commissioner shall request. Members receive only actual and necessary traveling and other expenses while engaged in the performance of their duties.

The Office reports annually on January 30 of each year to the Governor, the president of the Senate, the Assembly Speaker, and Senate and Assem- bly minority leaders.

Sections 2 and 3. renumbers one of the sections 399-ddd as 399-dddd, and renumbers Article 40 and sections 900 and 901 as Article 45 and sections 950 and 951.

Section 4. Amends the General Business law with a new Article 39-H, the New York State Online Privacy act.

Section 901. Definitions. Key definitions parallel those in other states, especially California, to establish the categories that consti- tute "Personally identifiable information," the contents of a "Privacy Policy," and "Operator" of an online service or website,"user," "website," "minor," etc.

Section 902. Purpose, application, exceptions, and waiver. States the purpose of the article as protecting the privacy of personally identifi- able information of users.

Provides for exceptions on application of the article for any non-com- mercial website or online service that does not collect personally iden- tifiable information concerning users, the state or federal government, or a financial institution that has adopted safeguards complying with Gramm-Leach-Bliley Act standards.

Allows for exceptions to disclosure of personally identifiable informa- tion is the disclosure is made pursuant:

(a) to a court order, a grand jury subpoena, or otherwise pursuant to requirements of law;

(b) to a court in a civil action for conversion commenced by the opera- tor or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, to the extent necessary to establish the fact of the delinquency;

(c) for the sole purpose of validating the identity of the user or for a fraud investigation or to a business subsidiary or related entity if restricted to disclosure solely for a legitimate business reason;

(d) at the request of the user;

(e) when the information is to be used for any business function permit- ted or allowed under the Gramm Leach Bliley Act, P.L. 106-102 (1999) by any entity regulated by such act;

(f) in connection with a request for credit or a credit transaction initiated by the user or in connection with a lawful request for a consumer report or investigative consumer report;

(g) for purposes of employment;

(h) solely for statistical purposes, in a form that cannot be used to identify a particular person.

This law pre-empts local law. Any waiver of a provision of this article is contrary to public policy and is void and unenforceable.

903. Requirement for privacy policy and confidentiality. 1. Requires operator to conspicuously post its privacy policy. 2. Requires operator to keep confidential: (a) All personally identifiable information, other than the user's email address, unless the user gives permission; (b) The electronic email address of user, if the user so requests. 3. Makes confidentiality requirements of law regarding social security numbers applicable to websites and online services, extends disclosure prohibi- tion to portions of social security numbers, and requires express consent of the individual for disclosure. 4. requires operators to destroy information on cancellation of service, with notice to the user. 5. Makes voluntary disclosure of personally identifiable information consent by the user to the collection of information by the operator.

904. Privacy protection for minors. extends privacy protects now avail- able to minors under the federal Child's Online Privacy Protection Act to children over age 13.

905. Responsibilities concerning privacy policies and social media. 1. Prohibits an employer from requiring or requesting an employee or appli- cant for employment to disclose a username or password for social media, or to access social media in the presence of the employer, or to divulge any social media, and prohibits retaliation for refusing to accommodate a request or demand that violates this section. However, allows such requests when relevant to an investigation of allegations of misconduct or violation of law. Makes clear that this does not prohibit an employer from terminating or otherwise taking an adverse action against an employee or applicant as may be otherwise permitted by law. 2. Makes same restrictions for colleges and universities and prohibits them from penalizing a student, prospective student, or student group for refusing to comply with a request or demand that violates this section. Provides exceptions for alleged student misconduct or violations of law. Requires a college or university shall conspicuously post its privacy policy including its privacy policy regarding social media.

906. Requirement to report a security breach. Requires an operator to inform the office of privacy protection regarding a security breach as defined in article 39-F of the general Business law, and to the Office of Information Technology.

907. Liability for failure to comply. 1. Makes negligent failure to comply with section 903 (keeping personally identifiable information confidential) liable for actual damages and attorney's fees. Allows as a defense about posting of privacy notice that information was provided to all affected users within 30 days of the date the operator knew that it had failed to post.

2. Makes willful violation of release of personally identifiable inflation or of failure to report a security breach subject to an addi- tional penalty of $1,000 for each violation of release of personal information or misuse of social security numbers.

3. Establishes a fine of $500 for knowingly making a false or misleading statement in a privacy policy or failure to provide privacy protection for minors with a cap of $500,000 for any single event.

4. Establishes a fine actual damages with a payment of not less than $500 for the prevailing party pursuant to section 675 of this chapter for violations of access to social media.

5. makes rights and remedies available under this section\cumulative to other and to any other rights and remedies available under law.

915. Enforcement. The Attorney General or any District Attorney may apply for an order temporarily or permanently restraining and enjoining any person from violating any provision of this article.

Section 5. Amends there State technology Law by adding a new Article 4 to create a Breach Notification Service under the Office of Information Technology Services. In this service, a user would register and be alerted by email to breaches of its card companies or financial services, including the name of the company, the date of the breach, the geographic area of the breach, and toll-free numbers of credit reporting agencies.

Existing law

New bill.

Justification

The proliferation of technology has been so rapid and the use of it has become so pervasive that it is important to establish guidelines and protections for personal privacy. This bill does that by providing that except under strictly defined situations, personally identifiable infor- mation cannot be released except with the permission of the user who provided that information, and it establishes a requirement that opera- tors of websites and online services establish and show to users their privacy policies, and notify them in the case of a breach of security that compromises the integrity of the information. It also establishes appropriate penalties for violations.

Personal data that would have taken laborious effort to collect and correlate just a few years ago can be analyzed and stored in individual- ized profiles today very quickly. Consumers lack information about how their data is being used and shared, because companies are not required to tell them in a straightforward manner. Tracking is customized and surveillance ongoing.

Fair Information Practices are a set of widely endorsed principles first described by the federal trade commission in its 1998 report. The prin- ciples include:

1. Notice/Awareness - Consumers should be given notice of an entity's information practices before any personal information is collected from them.

2. Choice/Consent Choice and consent in an online information-gathering sense means giving consumers options to control how their data is used.

3. Access/Participation Access as defined in the Fair Information Prac- tice Principles includes not only a consumer's ability to view the data collected, but also to verify and contest its accuracy. This access must be inexpensive and timely in order to be useful to the consumer.

4. Integrity/Security Information collectors should ensure that the data they collect is accurate and secure.

5. Enforcement/Redress In order to ensure that companies follow the Fair Information Practice Principles, there must be enforcement measures. This framework is addressed in this legislation. FISCAL IMPLICATIONS:

Effective date

120 days after it becomes law.