Protect Online Personal Data

Section 1. The general business law is amended by adding a new section 397-b to read as follows:

§ 397-b. On-line computer services. 1. As used in this section, the following terms shall have the following meanings:

(a) "On-line computer service" means the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing or making available information using computer-based telecommunications. On-line computer service shall also include a service that permits a subscriber to retrieve stored information from or file information for storage in information storage facilities, electronic publishing or an electronic messaging service.

(b) "Personal information" means information which identifies either a specific file or service utilized or from an on-line computer service and the subscriber and/or such subscriber's on-line computer address who obtained such file or service. Personal information shall not include any record of aggregate data which does not identify a file or service utilized and a subscriber and/or such subscriber's on-line computer address.

(c) "Disclose" or "disclosure" means the sale, rental or other dissemination of personal information.

(d) "File" means a collection of related records treated as a unit.

(e) "Records" means a group of distinct data items in a computer system, manipulated as a unit.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD07226-01-9

A. 3308 2

2. Any person, firm, partnership or corporation which provides an on-line computer service may not disclose personal information concerning a subscriber to any other person, firm, partnership or corporation unless such subscriber:

(a) has received the notice provided for in subdivision three of this section; and

(b) has consented to the disclosure.

3. At the time of entering into an agreement to provide an on-line computer service to a subscriber and at such time when a service is obtained each and every on-line computer service shall provide notice in the form of a separate statement to the subscriber that clearly and conspicuously disclose the following to such subscriber:

(a) the nature of personal information collected or to be collected with respect to the subscriber and the nature and use of the information if any;

(b) the nature, frequency and purpose of any disclosure which may be made of such information, including an identification of the types of persons or person to whom such disclosure may be made;

(c) the period of time the information will be maintained; and

(d) a description of the procedures by which the subscriber may gain access to the information.

Such notices may be provided electronically by using computer-based telecommunications.

4. Upon request a subscriber shall be provided access to all personal information regarding such subscriber that is collected and maintained by an on-line computer service. Such information shall be made available at reasonable times and at a convenient location to the subscriber. Computer-based telecommunications may be the means by which such information is provided to the subscriber. The subscriber shall be provided reasonable opportunity by the on-line computer service to correct errors in personal information and the on-line computer service shall promptly correct such information. If the on-line computer service is unable to resolve any remaining differences, a subscriber shall also be provided with the opportunity to file a statement of explanation concerning the nature of any dispute.

5. Notwithstanding subdivision two of this section, an on-line computer service may disclose personal information if the disclosure is:

(a) necessary to render or conduct business or provide service to the subscriber;

(b) made pursuant to a court order;

(c) for the purpose of extending credit to the subscriber or for a check or credit card transaction when it is incidental to the sale or other transfer of the accounts receivable of the on-line computer service; and

(d) for the purpose of validating a check written by the subscriber.

6. No on-line computer service shall be deemed to have violated the provisions of this section, if such on-line computer service shows by a preponderance of the evidence that the violation was not intentional and that it resulted from a bona fide error made notwithstanding the maintenance of procedures reasonably adopted to avoid any such error.

7. Any subscriber who has been injured by reason of any violation of this section may bring an action in his or her own name to enjoin such unlawful act or practice, an action to recover his actual damages or one hundred dollars, whichever is greater, or both such actions. The court may, in its discretion, increase the award of damages to an amount not to exceed three times the actual damages up to one thousand dollars, if

A. 3308 3

the court finds the defendant willfully or knowingly violated this section. The court may award reasonable attorney's fees to a prevailing plaintiff.

8. Whenever there shall be a violation of this section, an application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violations; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than one thousand dollars for each violation. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with the civil practice law and rules.

§ 2. This act shall take effect on the first of November next succeeding the date on which it shall have become a law.