Require Consent to Share Data

Section 1. The general business law is amended by adding a new section 390-bb to read as follows:

§ 390-bb. Internet service providers; customer data privacy. 1. For the purposes of this section the following terms shall have the following meanings:

(a) "Internet service provider" means any person, business, or organization who is qualified to conduct business in the state that provides individuals, corporations, or other entities with access to the internet as part of a service.

(b) "Customer" means any person, corporation or entity which pays a fee to an internet service provider for access to the internet as part of a service.

(c) "Sensitive information" means any information that which can identify the customer or any other information that is specifically attributable to such customer including, but not limited to, financial or medical data, biographical information, communication content, browsing or web history, or internet usage.

(d) "Non-sensitive information" means information collected on users that is not specific to an individual customer including, but not limited to, aggregated use, subscription data or other macro level information.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD02069-01-9

A. 3612 2

2. Each internet service provider shall provide customers with a copy, either in writing or in electronic form, of their privacy policy that shall include its data collection and use practices, third party relationships, purpose of the data collection and process for customers to exercise control over their information as provided in this section. The privacy policy shall be provided to customers upon entering into a contract with the internet service provider and subsequently upon any significant changes made to such policy.

3. An internet service provider shall obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer. The internet service provider shall provide to the customer a clear and conspicuous description of the intended use of their information, including, but not limited to, type of information that may be disclosed, purpose of such disclosure, and all third party entities that may be receiving or using the information.

4. A customer shall have the option to remove their consent for the use or disclosure of non-sensitive information. The internet service provider shall develop a process for a customer to easily remove their consent for the use of any non-sensitive information. The process shall include a detailed description of the intended use of their information, including, but not limited to, type of information that may be disclosed, purpose of such disclosure, and all third party entities that may be receiving or using the information.

5. An internet service provider shall not, as a condition of the service, require consent from a customer for use of their sensitive or non-sensitive information.

6. An internet service provider may use sensitive or non-sensitive information without consent from the customer if such information is necessary in providing the service to the customer, including, but not limited to, billing, installation, and support.

7. Whenever there shall be a violation of this section, an application may be made by the attorney general in the name of the people of the state of New York to a court or justice having jurisdiction by a special proceeding to issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of such violation; and if it shall appear to the satisfaction of the court or justice that the defendant has, in fact, violated this section, an injunction may be issued by such court or justice, enjoining and restraining any further violation, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this section has occurred, the court may impose a civil penalty of not more than five hundred dollars for a single violation and not more than fifty thousand dollars for multiple violations resulting from a single act or incident. In connection with any such proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and issue subpoenas in accordance with the civil practice law and rules.

§ 2. This act shall take effect on the sixtieth day after it shall have become a law.