What's happening
This bill prohibits internet service providers from disclosing consumers' personally identifiable information without the consumer's express written approval.
Why it matters
Broadens consumer privacy protections. by defining "personally identifiable information" to include not just names and contact details, but also internet search and usage history, and even contents of data-storage devices – making the scope of protected data unusually comprehensive.
Limits ISP leverage over consumers. by explicitly prohibiting ISPs from denying service to consumers who refuse to consent to data collection or sharing, which addresses concerns about coercive or non-transparent business practices.
Creates enforceable rights for consumers. by granting individuals the ability to sue ISPs for violations, with statutory minimum damages and the right to recover legal costs, and specifically exempts these claims from mandatory arbitration clauses that often limit consumer recourse.
Establishes clear exceptions and standards. by allowing disclosure of information only under specific legal processes (e.g., subpoenas, warrants, court orders), and requiring that any consent to share data must be obtained through clear, affirmative, and conspicuous means.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Internet service providers
The bill would generally require consumer authorization before disclosing personally identifiable information and require reasonable and necessary steps to protect its security and privacy.
Household internet subscribers
Covered consumers could sue over violations, recover the greater of $500 or actual damages if they prevail or substantially prevail, and avoid contractual mandatory arbitration for those claims.
Telecommunications and internet providers using facilities covered by state or local agreements
These providers would need express written approval to collect or disclose consumers’ personal information and could not deny service because a consumer withheld approval.
Law enforcement agencies and civil litigants
The bill would permit disclosures under specified subpoenas, warrants and court orders, including civil court orders based on a compelling need that cannot be met by other means.
Headline styles
Protect Internet User Privacy
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 38
History
- Referred to consumer protection
- Referred to consumer protection
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Ban ISP Data Sharing
Assembly Floor Calendar · Sponsor Monica P. Wallace
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
518
2019-2020 Regular Sessions
IN SENATE (Prefiled)
January 9, 2019
Introduced by Sens. CARLUCCI, BROOKS, COMRIE, KAMINSKY, SAVINO, SEPULVE- DA -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to prohibiting the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 399-k to read as follows:
§ 399-k. Disclosure of personally identifiable information by an internet service provider; prohibited. 1. For the purposes of this section the following terms shall have the following meanings:
(a) "Consumer" means a person who agrees to pay a fee to an internet service provider for access to the internet for personal, family, or household purposes, and who does not resell access.
(b) "Internet service provider" (ISP) means a business entity or individual who provides consumers authenticated access to, or presence on, the internet by means of a switched or dedicated telecommunications channel upon which the provider provides transit routing of internet protocol packets for and on behalf of the consumer. Internet service provider does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities.
(c) "Personally identifiable information" means information that identifies:
(i) a consumer by physical or electronic address or telephone number;
(ii) a consumer's internet search history or internet usage history; or
(iii) any of the contents of a consumer's data-storage devices.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD00382-01-9
S. 518 2
2. Except as provided in subdivisions three and four of this section, an ISP shall not knowingly disclose personally identifiable information resulting from the consumer's use of the telecommunications or ISP without express written approval from the consumer.
(a) A telecommunications or ISP that has entered into a franchise agreement, right-of-way agreement, or other contract with the state of New York or any political subdivision thereof, or that uses facilities that are subject to such agreements, even if it is not a party to the agreement, shall not collect nor disclose personal information from a consumer resulting from the consumer's use of the telecommunications or ISP without express written approval from the consumer; and
(b) No such telecommunication or ISP shall refuse to provide its services to a consumer on the grounds that the consumer has not approved the collection or disclosure of the consumer's personal information.
3. An ISP may disclose personally identifiable information concerning a consumer:
(a) pursuant to a grand jury subpoena, in accordance with subdivision eight of section 190.30 of the criminal procedure law;
(b) pursuant to a warrant issued in accordance with article six hundred ninety or article seven hundred of the criminal procedure law;
(c) pursuant to a court order in a pending criminal proceeding upon a showing that such personally identifiable information is relevant and material to such criminal action or proceeding;
(d) pursuant to a court order in a pending civil proceeding upon a showing of compelling need for such information that cannot be accommodated by other means;
(e) to a court in a civil action for conversion commenced by the ISP or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and then only to the extent necessary to establish the fact of the subscription delinquency or purchase agreement, and with appropriate safeguards against unauthorized disclosure;
(f) to the consumer who is the subject of the information, upon written or electronic request and upon payment of any fee not to exceed the actual cost of retrieving the information;
(g) to another ISP for purposes of reporting or preventing violations of the published acceptable use policy or consumer service agreement of the ISP; except that the recipient may further disclose the personally identifiable information only as provided by this chapter; or
(h) to any person with the authorization of the consumer.
4. (a) The ISP shall obtain the consumer's authorization for the disclosure of personally identifiable information in writing or by electronic means.
(b) The request for authorization must reasonably describe the types of persons to whom personally identifiable information may be disclosed and the anticipated uses of the information.
(c) In order for an authorization to be effective, a contract between an ISP and the consumer must state that the authorization will be obtained by an affirmative act of the consumer.
(d) The provision in the contract must be conspicuous.
(e) Authorization shall be obtained in a manner consistent with guidelines issued by representatives of the ISP or online industries, or in any other manner reasonably designed to comply with this section.
5. The ISP shall take all reasonable and necessary steps to maintain the security and privacy of a consumer's personally identifiable information.
S. 518 3
6. A consumer who prevails or substantially prevails in an action brought under this section is entitled to the greater of five hundred dollars or actual damages. Costs, disbursements, and reasonable attorney fees may be awarded to a party awarded damages for a violation of this section. The action available under this section is exempted from any mandatory arbitration clauses that may exist in the contract between the ISP and the consumer. In a civil action under this section, it is an affirmative defense that such information was released or otherwise available in violation of this section notwithstanding reasonable practices established and implemented by the defendant to prevent violations of this section.
7. This section does not limit any greater protection of the privacy of information under other law, except that:
(a) nothing in this section shall be deemed to limit the authority under other state or federal law of law enforcement to obtain information; and
(b) if federal law is enacted that regulates the release of personally identifiable information by ISPs but does not preempt state law on the subject, state law prevails.
§ 2. This act shall take effect on the ninetieth day after it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to prohibiting the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer
Purpose of general idea of bill
The bill provides protections to New Yorkers by requiring that ISPs not sell consumer information, unless authorization is conspicuously requested and expressly given; nor may an ISP refuse to provide service for failure to give consent.
Summary of specific provisions
Section 1. Amends the general business law as follows:
Add 399-k (1) defines the terms consumer, internet service provider (ISP) and personally identifiable information.
Add 399-k(2) prohibits ISPs from disclosing a consumer's personal infor- mation without express written consent.
Add 399-k(3) provides exceptions to the requirements of subsection 2 for the purpose of cooperating with law enforcement.
Add 399- k(4) requires ISPs to obtain consumer authorization for disclo- sure and requires the authorization request to be conspicuous.
Add 399- k(S) requires the ISP to take reasonable steps to protect a consumer's personal information.
Add 399-k(6) grants a right of action is against an ISP where this section is violated and excluding the right of action from any mandatory clause that may exist in the contract between the ISP and the consumer.
Add 399-k(7)to address other laws that may impact this section.
Justification
This legislation is being introduced in response to Congress's decision to repeal internet privacy regulations set to take effect earlier this year. This legislation requires ISPo to obtain the consent of their customers before disclosing any personally identifiable information of the customer, hind prohibits an ISP from refusing service if a customer does not want to give consent to disclosure.
This legislation gives customers control over whether their personal data disclosed and shared. ISP providers have access to "an unprecedented breath" of electronic personal information, including a customer's name, address, financial information, every website visited, the links clicked on in those websites, geo-location information, and the content of our electronic communications. ISPs should not be permit- ted to disclose such deeply personal information for commercial gain without customer consent. This legislation places control over disclo-
sure in the hands of the customer, where it belongs, and prohibits an ISP from refusing to provide service unless consent is given.
Prior legislative history
2017-18: S5603b/A7191b - CONSUMER PROTECTION/passed assembly
Fiscal implications for state and local governments
None
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.