What's happening
This bill prohibits credit and debit card issuers from accepting nonpublic personal information from third parties, with certain exceptions, and imposes civil penalties for violations.
Why it matters
Limits the sharing and collection of sensitive personal information. By restricting issuers from accepting or soliciting nonpublic personal information from third parties (except banks for identity verification and fraud prevention), the bill aims to reduce the risk of data leaks and misuse of consumer data.
Aligns with federal privacy standards. The bill’s definition of “nonpublic personal information” matches the federal standard (under 15 U.S.C. § 6809(4)), ensuring consistency and clarity about what data is protected.
Allows essential exceptions for financial operations and security. The bill carves out exceptions for situations where sharing information is necessary for transactions, account servicing, or fraud prevention, balancing privacy with the practical needs of financial services.
Introduces financial penalties to incentivize compliance. By imposing civil penalties of up to $2,000 per violation, the bill seeks to deter unlawful data practices and encourage issuers to prioritize consumer privacy.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Stop Third-Party Card Data Sharing
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 38
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to consumer protection
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1404
2019-2020 Regular Sessions
IN SENATE
January 14, 2019
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to prohibiting issuers from accepting nonpublic personal information of holders from a third-party
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 518-b to read as follows:
§ 518-b. Prohibited credit card user information requests. 1. Issuers of credit cards and debit cards are prohibited from accepting or soliciting the nonpublic personal information of a holder from a third-party. Provided, however, that no provision of this section shall be deemed to prohibit an issuer of a credit card or debit card from accepting or soliciting from a banking organization, as defined in section two of the banking law, the nonpublic personal information of a holder for the purpose of verifying the identity of such holder and preventing improper or unauthorized use.
2. Nonpublic personal information shall have the same meaning as in 15 U.S.C. § 6809(4).
3. This section shall not prohibit the disclosure of nonpublic personal information to a third party:
(a) As necessary to effect, administer, or enforce a transaction requested or authorized by the consumer;
(b) In order to service or process a financial product or service requested or authorized by the consumer;
(c) In order to maintain or service the consumer's account held by the issuer of the credit or debit card; or
(d) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD06487-01-9
S. 1404 2
4. A violation of the provisions of this section by an issuer shall be punishable by a civil penalty not to exceed two thousand dollars for each such violation.
§ 2. This act shall take effect on the first of September next succeeding the date on which it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to prohibiting issuers from accepting nonpublic personal information of holders from a third-party
Purpose
This bill would prohibit card issuers from accepting or soliciting nonpublic personal information about a cardholder from a person other than the card holder.
Summary of provisions
Section one of this bill adds a new Section 518-b to the General Busi- ness Law, which would prohibit issuers of credit cards and debit cards from accepting or soliciting the nonpublic personal information of a cardholder from a person other than the card holder, while allowing for the transmission of this information between these companies to facili- tate services authorized by the cardholder. A violation of these provisions would be punishable by a civil penalty not to exceed two thousand dollars for each such violation.
Section two of the bill provides that the bill takes effect on the first of September next succeeding the date on which this bill becomes law.
Justification
Third-parties should not be permitted to give personal information about a credit or debit cardholder to the issuer of the card. The cardholder is ultimately responsible for the use of the card, and their credit history is effected by any use of or changes to the account. Any errors in the information provided by a third-party might be recorded on a consumer credit report, where even providing a different street address can affect a consumer's credit history. Also, if a third party were permitted to give the address of the cardholder to the issuer, they might be able to divert monthly statements to another address or raise the limit of the line of credit attached to the card. Likewise, in the case of a divorced spouse or when a child is a third-party user of their parent's card, such a user might be able to cause harm to the cardholder or the cardholder's credit by giving inaccurate or misleading informa- tion to the issuer.
In recognition of the fact that the cardholder is ultimately responsible for the use of their card, this legislation would make them the sole source of personal information about themselves. At the same time, this bill would not limit the transmittal of financial or transaction infor- mation by merchants or businesses, in recognition of the fact that the transmittal of these types of information is necessary for the use of credit and debit cards. Finally, this bill also conforms with current federal legislation (the Gramm-Leach-Bliley Act) on this issue.
Prior legislative history
2005-2006: Consumer Protection Committee (S.4687/A.9321) 2007-2008: Consumer Protection Committee (S.4308/A/6852) 2011-2012: Consumer Protection Committee (S.5061) 2013: Rules Committee (S.760) 2014: Consumer Protection Committee (S.6280). 2017-18: S4056 - CONSUMER PROTECTION
Fiscal impact
None to the state.
Effective date
On the first of September next succeeding the date on which it shall have become a law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.