What's happening
This bill requires internet service providers to give customers their privacy policy and obtain explicit consent before sharing sensitive customer data.
Why it matters
Expands transparency about how ISPs use your data. The bill requires internet service providers to give all customers a detailed privacy policy upfront and whenever it changes, ensuring you know exactly what data is collected, why, and with whom it may be shared.
Gives you real control over your own information. ISPs must get your explicit, written consent before sharing, selling, or using any of your sensitive data (like browsing history, financial, or medical info), and you have the right to withdraw consent for non-sensitive data too.
Stops ISPs from forcing you to give up privacy as a condition of service. The bill makes it illegal for ISPs to require customers to consent to data sharing in order to get internet service, reducing the pressure to surrender privacy for basic connectivity.
Introduces enforceable penalties for violations. The Attorney General is empowered to seek injunctions and significant civil penalties (up to $50,000 per incident) against ISPs that break these rules, adding real consequences for misuse of customer data.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Require ISP Customer Consent
Plain English, a few words. Used as the page title.
Sponsors
History
- Referred to consumer protection
- Referred to consumer protection
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Require Consent to Share Data
In Assembly Committee · Consumer Affairs And Protection · Sponsor Kenneth Zebrowski
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
5576
2017-2018 Regular Sessions
IN SENATE
April 17, 2017
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to requiring internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 390-bb to read as follows:
§ 390-bb. Internet service providers; customer data privacy. 1. For the purposes of this section the following terms shall have the following meanings:
(a) "Internet service provider" means any person, business, or organization who is qualified to conduct business in the state that provides individuals, corporations, or other entities with access to the internet as part of a service.
(b) "Customer" means any person, corporation or entity which pays a fee to an internet service provider for access to the internet as part of a service.
(c) "Sensitive information" means any information that which can identify the customer or any other information that is specifically attributable to such customer including, but not limited to, financial or medical data, biographical information, communication content, browsing or web history, or internet usage.
(d) "Non-sensitive information" means information collected on users that is not specific to an individual customer including, but not limited to, aggregated use, subscription data or other macro level information.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD10887-01-7
S. 5576 2
2. Each internet service provider shall provide customers with a copy, either in writing or in electronic form, of their privacy policy that shall include its data collection and use practices, third party relationships, purpose of the data collection and process for customers to exercise control over their information as provided in this section. The privacy policy shall be provided to customers upon entering into a contract with the internet service provider and subsequently upon any significant changes made to such policy.
3. An internet service provider shall obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer. The internet service provider shall provide to the customer a clear and conspicuous description of the intended use of their information, including, but not limited to, type of information that may be disclosed, purpose of such disclosure, and all third party entities that may be receiving or using the information.
4. A customer shall have the option to remove their consent for the use or disclosure of non-sensitive information. The internet service provider shall develop a process for a customer to easily remove their consent for the use of any non-sensitive information. The process shall include a detailed description of the intended use of their information, including, but not limited to, type of information that may be disclosed, purpose of such disclosure, and all third party entities that may be receiving or using the information.
5. An internet service provider shall not, as a condition of the service, require consent from a customer for use of their sensitive or non-sensitive information.
6. An internet service provider may use sensitive or non-sensitive information without consent from the customer if such information is necessary in providing the service to the customer, including, but not limited to, billing, installation, and support.
7. Whenever there shall be a violation of this section, an application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violation; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than five hundred dollars for a single violation and not more than fifty thousand dollars for multiple violations resulting from a single act or incident. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and issue subpoenas in accordance with the civil practice law and rules.
§ 2. This act shall take effect on the sixtieth day after it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to requiring internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer
Purpose or general idea of bill
This bill would require internet service providers to obtain consent from customers prior to using, sharing, or selling a customer's sensitive information.
Summary of provisions
Section one of the bill amends the general business law by adding a new section 390-bb as it relates to requiring internet service providers (ISPs) to provide customers with a copy of their privacy policy. In addition, it would require customers to opt-in for ISPs to use, share or sell their sensitive information and allow customers to opt-out of use of their non-sensitive or non-identifying information.
Section two of the bill relates to the effective date.
Justification
This legislation is in response to the Joint Resolution passed by Congress and signed into law by President Trump that disapproves of the Federal Communications Commission's (FCC) rule that was proposed in October 2016 that would impose opt-in consent requirements on ISPs for use of customer personal information.
The State should have in place protections for consumers whose personal information could be sold to third party advertisers and services. The bill would provide customers with more control and transparency over how their sensitive personal information is handled by ISPs.
This bill would require a customer's consent in order to share or use personal information which would include, browsing history, financial information, communication content, usage, biographical information and other data that is specific to an individual consumer. It would allow customers to opt out of the sharing of non-personal information that is used by the ISP. The legislation would also require ISPs to provide a notice to customers on data privacy that includes what data is collected, how the information is used by the company and if they sell or share any data with a third party. Finally, it would prevent ISPs from requiring customers to consent to the use of personal information as a condition of the service.
Prior legislative history
New bill.
Fiscal implications for state and local governments
None.
Effective date
This act shall take effect on the sixtieth day after it shall have become law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.