Stop ISPs Sharing Your Data

Section 1. The general business law is amended by adding a new section 399-k to read as follows:

§ 399-k. Personally identifiable information; non-disclosure. 1. For the purposes of this section, the following terms shall have the following meanings:

(a) "Internet service provider" (ISP) means any business entity or individual that provides consumers, businesses or organizations with authenticated access to the internet as part of a service.

(b) "Consumer" means any person who agrees to pay a fee to an ISP for access to the internet and who does not resell access.

(c) "Personally identifiable information" means information that identifies:

(i) a consumer by physical, electronic mail address, Internet Protocol (IP) address or telephone number;

(ii) a consumer's internet search history or internet usage history; or

(iii) any of the contents of a consumer's data-storage devices.

2. (a) An ISP operating in the state of New York shall honor a consumer's request that the ISP refrain from sharing, selling, providing or in any way disclosing to a third party any of his or her personally identifiable information, whether such a request is made by postal mail, electronic mail, telephone or in person. Such a request shall be deemed to apply to the personally identifiable information for all individuals

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD06556-01-9

S. 1180 2

that access the internet through usage of that consumer's internet service account.

(b) No ISP shall refuse to provide its services to a consumer because the consumer requested that his or her personally identifiable information not be disclosed or disseminated to a third party. No ISP shall in any way disrupt, block or slow down the internet access of a consumer because the consumer has requested that his or her personally identifiable information not be disclosed or disseminated to a third party.

3. ISPs shall provide consumers with a copy, either in electronic or written form, of their privacy policy that shall include its data collection and use practices, third party relationships, purposes of data collection and process by which consumers can exercise control over personally identifiable information as provided in this section. The privacy policy shall be provided to consumers upon entering into a contract or agreement with the ISP and subsequently upon any significant changes made to such policy.

4. An ISP may disclose personally identifiable information of a consumer who requested that his or her information not be disclosed under the following circumstance:

(a) pursuant to a grand jury subpoena, in accordance with subdivision eight of section 190.30 of the criminal procedure law;

(b) pursuant to a warrant issued in accordance with article six hundred ninety or seven hundred of the criminal procedure law;

(c) pursuant to a court order in a pending criminal proceeding upon a showing that such personally identifiable information is relevant and material to such criminal action or proceeding;

(d) pursuant to a court order in a pending civil proceeding upon a showing of compelling need for such information that cannot be accommodated by other means;

(e) to a court in a civil action for conversion commenced by the ISP or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and then only to the extent necessary to establish the fact of the subscription delinquency or purchase agreement, and with appropriate safeguards against authorized disclosure;

(f) to the consumer who is the subject of the information, upon request and upon payment of any fee not to exceed the actual cost of retrieving the information;

(g) to another ISP for purposes of reporting or preventing violations of the published acceptable use policy or consumer service agreement of the ISP; except that the recipient may further disclose the personally identifiable information only as provided in this chapter; or

(h) to any person with the authorization of the consumer.

5. The ISP shall take all reasonable and necessary steps to maintain the security and privacy of the personally identifiable information of a consumer who has requested that his or her information not be disclosed or disseminated.

6. A consumer who prevails or substantially prevails in an action brought under this section is entitled to the greater of five hundred dollars or actual damages. Costs, disbursements, and reasonable attorney fees may be awarded to a party awarded damages for a violation of this section. The action available under this section is exempted from any mandatory arbitration clauses that may exist in the contract between the ISP and consumer. In a civil action under this section, it is an affirmative defense that such information was released or otherwise available in violation of this section notwithstanding reasonable practices estab-

S. 1180 3

lished and implemented by the defendant to prevent violations of this section.

§ 2. This act shall take effect on the ninetieth day after it shall have become a law.