Prohibits issuers of credit cards and debit cards from knowingly accepting or soliciting financial information of a cardholder from a third-party

Title of bill

An act to amend the general business law, in relation to prohibiting issuers from accepting nonpublic personal information of holders from a third-party

Purpose

This bill would prohibit card issuers from accepting or soliciting nonpublic personal information about a cardholder from a person other than the card holder.

Summary of provisions

Section one of this bill adds a new Section 518-b to the General Business Law, which would prohibit issuers of credit cards and debit cards from accepting or soliciting the nonpublic personal information of a cardholder from a person other than the card holder, while allowing for the transmission of this information between these companies to facilitate services authorized by the cardholder. A violation of these provisions would be punishable by a civil penalty not to exceed two thousand dollars for each such violation.

Section two of the bill provides that the bill takes effect on the first of September next succeeding the date on which this bill becomes law.

Justification

Third-parties should not be permitted to give personal information about a credit or debit cardholder to the issuer of the card. The cardholder is ultimately responsible for the use of the card, and their credit history is effected by any use of or changes to the account. Any errors in the information provided by a third-party might be recorded on a consumer credit report, where even providing a different street address can affect a consumer's credit history. Also, if a third party were permitted to give the address of the cardholder to the issuer, they might be able to divert monthly statements to another address or raise the limit of the line of credit attached to the card. Likewise, in the case of a divorced spouse or when a child is a third-party user of their parent's card, such a user might be able to cause harm to the cardholder or the cardholder's credit by giving inaccurate or misleading information to the issuer.

In recognition of the fact that the cardholder is ultimately responsible for the use of their card, this legislation would make them the sole source of personal information about themselves. At the same time, this bill would not limit the transmittal of financial or transaction information by merchants or businesses, in recognition of the fact that the transmittal of these types of information is necessary for the use of credit and debit cards. Finally, this bill also conforms with current federal legislation (the Gramm-Leach-Bliley Act) on this issue.

Prior legislative history

2005-2006: Consumer Protection Committee (S.4687/A.9321) 2007-2008: Consumer Protection Committee (S.4308/A/6852) 2011-2012: Consumer Protection Committee (S.5061) 2013: Rules Committee (S.760) 2014: Consumer Protection Committee (S.6280).

Fiscal impact

None to the state.

Effective date

On the first of September next succeeding the date on which it shall have become a law.