What's happening
This bill prohibits credit and debit card issuers from accepting nonpublic personal information about cardholders from third parties, with specific exceptions, and imposes civil penalties for violations.
Why it matters
Limits third-party sharing of sensitive data. By restricting card issuers from accepting nonpublic personal information from third parties (with narrow exceptions), the bill aims to reduce the risk of data leaks and unauthorized use of personal financial information.
Protects consumer privacy. The bill aligns the definition of "nonpublic personal information" with federal law, ensuring that private details about cardholders are not freely exchanged or sold between companies, except for fraud prevention or account maintenance.
Increases accountability for card issuers. The imposition of civil penalties (up to $2,000 per violation) creates a financial deterrent for companies that might otherwise be lax with consumer data, encouraging stronger compliance and data-handling practices.
Allows necessary exceptions for consumer benefit. The bill permits sharing information when needed for legitimate purposes—such as verifying identity, processing transactions, maintaining accounts, or preventing fraud—striking a balance between privacy and practical business needs.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Limit Card Data Sharing
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to consumer protection
- Committed to rules
- Advanced to third reading
- 2nd report cal.
- 1st report cal.359
- Referred to consumer protection
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
4056
2017-2018 Regular Sessions
IN SENATE
February 2, 2017
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to prohibiting issuers from accepting nonpublic personal information of holders from a third-party
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 518-b to read as follows:
§ 518-b. Prohibited credit card user information requests. 1. Issuers of credit cards and debit cards are prohibited from accepting or soliciting the nonpublic personal information of a holder from a third-party. Provided, however, that no provision of this section shall be deemed to prohibit an issuer of a credit card or debit card from accepting or soliciting from a banking organization, as defined in section two of the banking law, the nonpublic personal information of a holder for the purpose of verifying the identity of such holder and preventing improper or unauthorized use.
2. Nonpublic personal information shall have the same meaning as in 15 U.S.C. § 6809(4).
3. This section shall not prohibit the disclosure of nonpublic personal information to a third party:
(a) As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer;
(b) In order to service or process a financial product or service requested or authorized by the consumer;
(c) In order to maintain or service the consumer's account held by the issuer of the credit or debit card; or
(d) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD09609-01-7
S. 4056 2
4. A violation of the provisions of this section by an issuer shall be punishable by a civil penalty not to exceed two thousand dollars for each such violation.
§ 2. This act shall take effect on the first of September next succeeding the date on which it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to prohibiting issuers from accepting nonpublic personal information of holders from a third-party
Purpose
This bill would prohibit card issuers from accepting or soliciting nonpublic personal information about a cardholder from a person other than the card holder.
Summary of provisions
Section one of this bill adds a new Section 518-b to the General Business Law, which would prohibit issuers of credit cards and debit cards from accepting or soliciting the nonpublic personal information of a cardholder from a person other than the card holder, while allowing for the transmission of this information between these companies to facilitate services authorized by the cardholder. A violation of these provisions would be punishable by a civil penalty not to exceed two thousand dollars for each such violation.
Section two of the bill provides that the bill takes effect on the first of September next succeeding the date on which this bill becomes law.
Justification
Third-parties should not be permitted to give personal information about a credit or debit cardholder to the issuer of the card. The cardholder is ultimately responsible for the use of the card, and their credit history is effected by any use of or changes to the account. Any errors in the information provided by a third-party might be recorded on a consumer credit report, where even providing a different street address can affect a consumer's credit history. Also, if a third party were permitted to give the address of the cardholder to the issuer, they might be able to divert monthly statements to another address or raise the limit of the line of credit attached to the card. Likewise, in the case of a divorced spouse or when a child is a third-party user of their parent's card, such a user might be able to cause harm to the cardholder or the cardholder's credit by giving inaccurate or misleading information to the issuer.
In recognition of the fact that the cardholder is ultimately responsible for the use of their card, this legislation would make them the sole source of personal information about themselves. At the same time, this bill would not limit the transmittal of financial or transaction information by merchants or businesses, in recognition of the fact that the transmittal of these types of information is necessary for the use of credit and debit cards. Finally, this bill also conforms with current federal legislation (the Gramm-Leach-Bliley Act) on this issue.
Prior legislative history
2005-2006: Consumer Protection Committee (S.4687/A.9321) 2007-2008: Consumer Protection Committee (S.4308/A/6852) 2011-2012: Consumer Protection Committee (S.5061) 2013: Rules Committee (S.760) 2014: Consumer Protection Committee (S.6280).
Fiscal impact
None to the state.
Effective date
On the first of September next succeeding the date on which it shall have become a law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.