Strengthen Personal Data Privacy

Section 1. This act shall be known and may be cited as the "It's Your Data Act".

§ 2. Section 50 of the civil rights law is amended to read as follows:

§ 50. Right of privacy. A person, firm or corporation that collects, stores, and/or uses for the purpose of advertising [purposes, or for the purposes of], trade, data-mining, or generating commercial or economic value, the name, portrait [or], picture, video, voice, likeness, and all other personal data, biometric data, and location data of any living person without having first obtained the written consent of such person, or if a minor of his or her parent or guardian, or, if such consent is obtained, subsequently fails to exercise reasonable care consistent with its obligations as bailee of that individual's name, portrait, picture, video, voice, likeness, and all other personal data, biometric data, and location data, is guilty of a misdemeanor.

§ 3. Section 51 of the civil rights law, as amended by chapter 674 of the laws of 1995, is amended to read as follows:

§ 51. Action for injunction and for damages. Any person [whose name, portrait, picture or voice is used within this state for advertising purposes or for the purposes of trade without the written consent], firm or corporation that collects, stores, and/or uses for the purpose of advertising, trade, data-mining, or generating commercial or economic value, name, portrait, picture, video, voice, likeness, and all other personal data, biometric data, and location data of any living person without having first obtained the written consent of such person, or if a minor of his or her parent or guardian, or, when such consent is

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD11575-01-9

A. 7736 2

obtained, subsequently fails to exercise reasonable care consistent with its obligations as bailee of that individual's name, portrait, picture, video, voice, likeness, and all other personal data, biometric data, and location data first obtained as above provided may maintain an equitable action in the supreme court of this state against the person, firm or corporation so using his or her name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data to prevent and restrain the use thereof; and may also sue and recover damages for any injuries sustained by reason of such use and if the defendant shall have knowingly used such person's name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data in such manner as is forbidden or declared to be unlawful by section fifty of this article, the jury, in its discretion, may award exemplary damages. But nothing contained in this article shall be so construed as to prevent any person, firm or corporation from selling or otherwise transferring any material containing such name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data in whatever medium to any user of such name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data or to any third party [for sale] or transfer directly or indirectly to such a user, for use, provided that the transferring party undertakes reasonable steps to ensure that any such use is consistent with the selling or transferring party's obligations as bailee of that individual's name, portrait, picture, video, voice, likeness, and all other personal data, biometric data, and location data and use in a manner lawful under this article; nothing contained in this article shall be so construed as to prevent any person, firm or corporation, practicing the profession of photography, from exhibiting in or about his or its establishment specimens of the work of such establishment, unless the same is continued by such person, firm or corporation after written notice objecting thereto has been given by the person portrayed; and nothing contained in this article shall be so construed as to prevent any person, firm or corporation from using the name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data of any manufacturer or dealer in connection with the goods, wares and merchandise manufactured, produced or dealt in by him or her which he or she has sold or disposed of with such name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data used in connection therewith; or from using the name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data of any author, composer or artist in connection with his or her literary, musical or artistic productions which he or she has sold or disposed of with such name, portrait, picture [or], video, voice, likeness, and all other personal data, biometric data, and location data used in connection therewith. Nothing contained in this section shall be construed to prohibit the copyright owner of a sound recording from disposing of, dealing in, licensing or selling that sound recording to any party, if the right to dispose of, deal in, license or sell such sound recording has been conferred by contract or other written document by such living person or the holder of such right. Nothing contained in the foregoing sentence shall be deemed to abrogate or otherwise limit any rights or remedies otherwise conferred by federal law or state law.

§ 4. The general business law is amended by adding a new article 32-A to read as follows:

A. 7736 3

ARTICLE 32-A

IT'S YOUR DATA ACT Section 676. Definitions.

676-a. Transparency of the collection, use, retention, and shar-

ing of personal information.

676-b. Fair collection and use of personal information.

676-c. Deletion of personal information.

676-d. Access to retained personal information.

676-e. Access to disclosure of personal information.

676-f. Consent to additional collection or sharing of personal

information.

676-g. No discrimination by a business against a consumer for

exercise of rights.

676-h. Reasonable security.

676-i. Business implementation of duties.

676-j. Exceptions.

676-k. Consumer's private right of action.

676-l. Agency enforcement action.

676-m. Construction.

676-n. Attorney general regulations.

676-o. Intermediate transactions.

676-p. Non-waiver.

676-q. Severability.

§ 676. Definitions. 1. For the purposes of this article:

(a) "Aggregate consumer information" means information that relates to a group of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been de-identified.

(b) "Biometric information" means an individual's physiological, biological or behavioral characteristics or an electronic representation of such, including an individual's deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.

(c) "Business" means:

(i) A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the state of New York, and that satisfies one or more of the following thresholds:

(1) has annual gross revenues in excess of fifty million dollars, as adjusted pursuant to paragraph (f) of subdivision one of section six hundred seventy-six-n of this article;

(2) alone or in combination, annually buys, receives for the business' commercial purposes, sells, or discloses for commercial purposes, alone

A. 7736 4

or in combination, the personal information of fifty thousand or more consumers, households, or devices; or

(3) derives fifty percent or more of its annual revenues from selling consumers' personal information; and

(ii) Any entity that controls or is controlled by a business, as defined in subparagraph (i) of this paragraph, and that shares common branding with such business.

(d) "Control" or "controlled" means ownership of, or the power to vote, more than fifty percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a business.

(e) "Common branding" means a shared name, servicemark, or trademark.

(f) "Operational purpose" means the use of personal information when reasonably necessary and proportionate to achieve one of the following operational purposes:

(i) auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this paragraph and other standards;

(ii) detecting and responding to security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;

(iii) debugging to identify and repair errors that impair existing intended functionality;

(iv) short-term, transient use, provided the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;

(v) performing or providing services on behalf of the business or service provider, including maintaining or servicing accounts, billing or collecting for requested products or services, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider;

(vi) undertaking internal research for technological development and demonstration;

(vii) undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, or to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business;

(viii) customization of content; or

(ix) customization of advertising or marketing.

(g) "Collects," "collected," or "collection" means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This shall include, but shall not be limited to, receiving information from the consumer, either actively or passively, or by observing the consumer's behavior.

(h) "Commercial purposes" means to advance a person's commercial or economic interests, such as by inducing another person to buy, rent,

A. 7736 5

lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction. Commercial purposes shall not include engaging in speech that state or federal courts have recognized as noncommercial speech, including, but not limited to, political speech and journalism.

(i) "Consumer" means a natural person who is a resident of the state of New York.

(j) "De-identified" means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, provided that a business that uses de-identified information:

(i) takes reasonable measures to ensure that the data is de-identified;