Relates to establishing the New York state online privacy act

Summary of provisions

Section New Office of Online Privacy and Internet Safety.

Creates a new article 10-A in the executive law, the Office of privacy protection and internet safety, to promote and protect the online priva- cy and internet safety of personal information of individuals and private businesses by receiving, addressing, referring, and mediating complaints, developing education and outreach programs, and disseminat- ing model privacy policies; by conducting research; and by coordinating the activities of state agencies performing online privacy protection and Internet safety functions. The Office is headed by a commissioner appointed by the governor by and with the advice and consent of the Senate. Reports are die by Jan 30 of each year on the activities of the office.

Creates the online privacy protection and intemet safety advisory committee, of 10 public and private appointees. the Secretary of State, Attorney General, Commissioner of Homeland Security, Commissioner of the Office of Online Privacy Protection and Internet Safety, and the Direc- tor of the Office of Information Technology Services; and five persons who have been employed at the level of executive officer in companies in the information technology industry for a period of five years or more. All private individuals are appointed for three years by the Governor with the advise and consent of the Senate. The purpose of the committee is to advise the commissioner on matters relating to online privacy and internet safety concerns, review and comment on rules, regulations, guidelines, and programs of the office, provide guidance and support for program development; make recommendations; and take other actions. The existence of the committee assures that there will be ongoing communi- cation and coordination between all entities involved in online privacy protection and online security and safety.

Language elsewhere in the bill including in the effective date requires the executive to submit a plan for the orderly transfer of appropriate functions and personnel to the new office from the Office of Information Technology Services, Consumer Affairs, Homeland Security, and other agencies as may be appropriate, within six months of the passage of the act, and to transfer funds for the agency subsequent to that time, but in no case later than by the beginning of the next fiscal year.

Section 2, 3, and 4.Privacy protections extended for Social Security Numbers.

Renumbers and amends sections § 399-ddd of the General Business law to extend the same requirements for privacy of social security numbers to any part of the SS number.

Sections 5 and 6. Privacy of NYS 0nline Accounts and Social Media Priva- cy Act

Renumbers section 900 and 901 of the general business law and creates a new Article 39-H, the NYS Online Accounts and Social Media Privacy Act, to prohibit employers, educational institutions, and landlords from requiring employees or prospective employees, students or prospective students, and tenants or prospect tenants respectively to provide access to personal email or social media accounts or from requiring access to these accounts, or to take adverse action against them for refusing access.

The section also creates exceptions to this prohibition, for accounts paid for by the employer or the academic institution;information in the public domain, disciplining or discharging an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal internet account without authorization; conducting an investigation if there is specific information about activity on the employee's personal internet account, or in the case of unlawful activities or misconduct Waiver of the section concerning employees or prospective employees is declared contrary to public policy and void and unenforceable Students are allowed to voluntarily consent to disclosure. Remedies include an action brought by the Attorney Gener- al, and a civil penalty of $500 per violation.

Sections 7 and 8. Privacy protections extended against phishing

Amends 390-b of the General Business law (phishing) to include social media and to prohibit individuals from deceptively representing them- selves as another person in order to obtain financial information or information which would allow such person to gain access to financial information. The law currently applies only to a person deceptively representing himself or herself as an agent of a business or government.

Sections 9, 10, and 11. Privacy protections extended in breach law

Amends Article 39-F of the General Business law (breach law) to add a Data Breach group to consist of the attorney general, the secretary of state, the commissioner of the division of homeland security and emer- gency services, the chief information officer of the office of informa- tion technology services, the superintendent of the division of state police, and the commissioner of the office of online privacy and inter- net safety They are to work together to streamline notification and handling of data breaches.Current law requires that breach notification

go separately to the Attorney general, the Secretary of State, and the Division of State Police.

Section 12. Requirement for privacy policy & notification of disposal of private information.

Amends the General Business Law to create a new Article 39-I, Require- ments For Use And Destruction Of Online Personal And Private Informa- tion. Requires that online services provide notice as to their privacy policy and the process for destruction of personal information. Sets liability as actual damages incurred and court costs, but allows a 30-day window for a provider to come into compliance after notification.

Section 13. Severability.

Existing law

New bill. Current law requires notification of breaches to Consumer Affairs (Department of State), the Attorney General, and the State Police. Current law has requirements for confidentiality for social security numbers but not for portions of the numbers Current phishing statutes only apply to falsely representing oneself as an agent of a business or government.

Justification

While there are laws on the books in New York intended to provide priva- cy protections, these have not been undated in some years, and changes in technology and in available resource have made some of the intended protections less robust than when originally enacted. At the same time, some State agencies have gained additional expertise and ability to deal with and work with privacy issues This measure seeks to draw on the best knowledge, information, and expertise, and reform the system where necessary in ways that will increase privacy protections for individ- uals, businesses large and small, and for other entities.

A key way in which this is done is by the creation of an Office of Privacy Protection and Internet Safety, reporting directly to the Gover- nor, and working with a public-private advisory group to stay current as to new threats and opportunities. The new office will assure that consumers receive timely information concerning security breaches, and will work with the Attorney General and others to develop and coordinate appropriate state responses when there are breaches, develop model privacy and Internet safety policies for businesses and internet enti- ties, provide education and training to individuals and businesses in collaboration with the online industry, and create an ongoing policy group to anticipate new technologies and programs and threats.

The development of new internet tools and programs - and threats - is moving very rapidly As an example, ten years ago there was no Twitter, Facebook was just being launched, and Pinterest had not been dreamed of Each new technological development brings enjoyment and entertainment,

but also is a ground for new threats We need to be looking and these and balancing the issues of pleasure, risk, and security People and busi- nesses need to know what steps they can take to protect themselves, and what to do if their security is violated.

The recent news reports about large-scale breaches of security and loss of personally identifiable information to hackers has worrisome conse- quences. Significantly, since only the breaches get reported, there are thousands of ongoing daily attacks on public and private websites and internet services that the public never hears of. The risk threat is ongoing.

There are several purposes to the legislation to inform and educate consumers concerning online privacy and in Internet safety issues, to insure that providers are taking all necessary steps to protect the confidentiality of the information they receive; to coordinate an adequate State response to help individual consumers and businesses, and to prosecute hackers and offenders; to prohibit certain violations of privacy by corporations, academic, and landlords; and to rewrite the privacy laws in this area to insure that penalties are equal to the damages inflicted.

This is needed legislation at a time of enhanced threats.

Fiscal implications

To be determined.

Effective date

The first day of the year succeeding its enactment.