Protect New Yorkers' Data

Section 1. Short title. This act may be known and cited as the "New York privacy act".

§ 2. The general business law is amended by adding a new article 42 to read as follows:

ARTICLE 42

NEW YORK PRIVACY ACT Section 1100. Definitions.

1101. Jurisdictional scope.

1102. Data fiduciary.

1103. Consumer rights.

1104. Transparency.

1105. Responsibility according to role.

1106. De-identified data.

1107. Exemptions.

1108. Liability.

1109. Enforcement.

1110. Preemption.

§ 1100. Definitions. The definitions in this article apply unless the context clearly requires otherwise:

1. "Affiliate" means a legal entity that controls, is controlled by, or is under common control with, another legal entity, where the entity holds itself out as affiliated or under common ownership such that a consumer acting reasonably under the circumstances would anticipate their personal data being provided to an affiliate.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD10868-05-9

A. 8526 2

2. "Consent" means a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of a consumer's agreement to the processing of personal data relating to the consumer, such as by a written statement or other clear affirmative action.

3. "Consumer" means a natural person who is a New York resident. It does not include an employee or contractor of a business acting in their role as an employee or contractor.

4. "Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

5. "Data broker" means a business, or unit or units of a business, separately or together, that earns its primary revenue from supplying data or inferences about people gathered mainly from sources other than the data sources themselves.

6. "De-identified data" means:

(a) data that cannot be linked to a known natural person without additional information not available to the controller; or

(b) data (i) that has been modified to a degree that the risk of re-identification is small as determined by a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for de-identifying data, (ii) that is subject to a public commitment by the controller not to attempt to re-identify the data, and (iii) to which one or more enforceable controls to prevent re-identification has been applied. Enforceable controls to prevent re-identification may include legal, administrative, technical, or contractual controls.

7. "Developer" means a person who creates or modifies the set of instructions or programs instructing a computer or device to perform tasks.

8. "Identified or identifiable natural person" means a person who can be identified, directly or indirectly, in particular by reference to specific information including, but not limited to, a name, an identification number, specific geolocation data, or an online identifier.

9. "Minor" means any person under eighteen years of age.

10. "Personal data" means information relating to an identified or identifiable natural person.

(a) "Personal data" includes:

(i) an identifier such as a real name, alias, signature, date of birth, gender identity, sexual orientation, marital status, physical characteristic or description, postal address, telephone number, unique personal identifier, military identification number, online identifier, Internet Protocol address, email address, account name, mother's maiden name, social security number, driver's license number, passport number, or other similar identifier;

(ii) information such as employment, employment history, bank account number, credit card number, debit card number, insurance policy number, or any other financial information, medical information, mental health information, or health insurance information;

(iii) commercial information, including a record of personal property, income, assets, leases, rentals, products or services purchased, obtained, or considered, or other purchasing or consuming history;

(iv) biometric information, including a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry;

(v) internet or other electronic network activity information, including browsing history, search history, content, including text, photographs, audio or video recordings, or other user generated-content,

A. 8526 3

non-public communications, and information regarding an individual's interaction with an internet website, mobile application, or advertisement;

(vi) historical or real-time geolocation data;

(vii) audio, electronic, visual, thermal, olfactory, or similar information;

(viii) education records, as defined in section thirty-three hundred two of the education law;

(ix) political information or information on criminal convictions or arrests;

(x) any required security code, access code, password, or username necessary to permit access to the account of an individual;

(xi) characteristics of protected classes under the human rights law, including race, color, national origin, religion, sex, age, or disability; or

(xii) an inference drawn from any of the information described in this paragraph to create a profile about an individual reflecting the individual's preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

(b) The term personal data does not include publicly available information. "Publicly available information":

(i) means information that is lawfully made available from federal, state, or local government records; and

(ii) does not include biometric information collected by a covered entity about an individual without the individual's knowledge, or information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records.

(c) Personal data does not include de-identified data.

11. "Process" or "processing" means any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, deletion, or destruction.

12. "Processor" means a natural or legal person who processes personal data on behalf of the controller.

13. "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

14. "Restriction of processing" means the marking of stored personal data with the aim of limiting the processing of such personal data in the future.

15.(a) "Sale", "sell" or "sold" means the exchange of personal data for consideration by the controller to a third party.

(b) "Sale" does not include the following: (i) the disclosure of personal data to a processor who processes the personal data on behalf of the controller; (ii) the disclosure of personal data to a third party with whom the consumer has a direct relationship for purposes of providing a product or service requested by the consumer or otherwise in a manner that is consistent with a consumer's reasonable expectations

A. 8526 4

considering the context in which the consumer provided the personal data to the controller; (iii) the disclosure or transfer of personal data to an affiliate of the controller; or (iv) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets, if consumers are notified of the transfer of their data and of their rights under this article and affirmatively consent to the disclosure and transfer of data.

16. "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred over time from a consumer's activities across web sites, applications or online services. It does not include advertising to a consumer based upon the consumer's current visit to a web site, application, or online service, or in response to the consumer's request for information or feedback.

17. "Opt-in" means affirmative, express consent of an individual for a covered entity to use, disclose, or permit access to the individual's personal data after the individual has received explicit notification of the request of the covered entity with respect to that data.

§ 1101. Jurisdictional scope. 1. This article applies to legal entities that conduct business in New York state or produce products or services that are intentionally targeted to residents of New York state.

2. This article does not apply to:

(a) state and local governments;

(b) personal data sets to the extent that they are regulated by the federal health insurance portability and accountability act of 1996, the federal health information technology for economic and clinical health act, or the Gramm-Leach-Bliley act of 1999; or

(c) data sets maintained for employment records purposes.

§ 1102. Data fiduciary. 1. Personal data of consumers shall not be used, processed or transferred to a third party, unless the consumer provides express and documented consent. Every legal entity, or any affiliate of such entity, and every controller and data broker, which collects, sells or licenses personal information of consumers, shall exercise the duty of care, loyalty and confidentiality expected of a fiduciary with respect to securing the personal data of a consumer against a privacy risk; and shall act in the best interests of the consumer, without regard to the interests of the entity, controller or data broker, in a manner expected by a reasonable consumer under the circumstances.

(a) Every legal entity, or affiliate of such entity, and every controller and data broker to which this article applies shall:

(i) reasonably secure personal data from unauthorized access; and

(ii) promptly inform a consumer of any breach of the duty described in this paragraph with respect to personal data of such consumer.

(b) A legal entity, an affiliate of such entity, controller or data broker may not use personal data, or data derived from personal data, in any way that:

(i) will benefit the online service provider to the detriment of an end user; and

(ii) (A) will result in reasonably foreseeable and material physical or financial harm to a consumer; or

(B) would be unexpected and highly offensive to a reasonable consumer.

(c) A legal entity, or affiliate of such entity, controller or data broker:

A. 8526 5

(i) may not disclose or sell personal data to, or share personal data with, any other person except as consistent with the duties of care and loyalty under paragraphs (a) and (b) of this subdivision;

(ii) may not disclose or sell personal data to, or share personal data with, any other person unless that person enters into a contract that imposes the same duties of care, loyalty, and confidentially toward the consumer as are imposed under this section; and

(iii) shall take reasonable steps to ensure that the practices of any person to whom the entity, or affiliate of such entity, controller or data broker discloses or sells, or with whom the entity, or affiliate of such entity, controller or data broker shares. Personal data fulfills the duties of care, loyalty, and confidentiality assumed by the person under the contract described in subparagraph (ii) of this paragraph, including by auditing, on a regular basis, the data security and data information practices of any such entity, or affiliate of such entity, controller or data broker.

2. For the purposes of this section the term "privacy risk" means potential adverse consequences to consumers and society arising from the processing of personal data, including, but not limited to:

(a) direct or indirect financial loss or economic harm;

(b) physical harm;

(c) psychological harm, including anxiety, embarrassment, fear, and other demonstrable mental trauma;

(d) significant inconvenience or expenditure of time;

(e) adverse outcomes or decisions with respect to an individual's eligibility for rights, benefits or privileges in employment (including, but not limited to, hiring, firing, promotion, demotion, compensation), credit and insurance (including, but not limited to, denial of an application or obtaining less favorable terms), housing, education, professional certification, or the provision of health care and related services;

(f) stigmatization or reputational harm;