What's happening
The New York Privacy Act establishes strict rules for businesses handling personal data, granting consumers new rights and protections over their information.
Why it matters
Establishes a legal “data fiduciary” duty. Businesses handling New Yorkers’ personal data must act in the best interests of consumers, prioritizing privacy and protection above their own profits or shareholders’ interests. This includes duties of care, loyalty, and confidentiality, similar to how lawyers or doctors are required to act for their clients.
Expands consumer control and transparency. Individuals gain strong rights to access, correct, delete, and restrict the use of their personal data, as well as to opt in or out of data processing. Companies must clearly inform consumers about what data they collect, how it’s used, and with whom it’s shared—including targeted advertising and profiling activities.
Broad definition of personal data and regulated activities. The act covers a wide range of personal information, including identifiers, financial and health data, online activity, biometric data, inferences, and more. It applies to any entity doing business with New Yorkers, even if not physically located in the state, and sets standards for data brokers.
Enforcement and private right of action. Both the Attorney General and private individuals have the right to sue for violations, with potential for damages, civil penalties, and attorney’s fees. Each affected consumer and each violation can be counted separately, increasing potential liability for businesses.
Preempts local laws in favor of statewide standard. The act overrides any local data privacy laws, ensuring a single, consistent set of rules for businesses and consumers across New York State. This may affect how companies currently comply with local ordinances or patchwork regulations.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
New York consumers
The bill would give residents rights to access, correct and delete personal data, restrict its processing and sue over violations that injure them.
Businesses collecting personal data and data brokers
Covered entities would need express, documented consent to use, process or transfer consumer data and would owe consumers fiduciary duties that supersede duties to owners or shareholders.
Online advertisers and companies using profiling
The bill would require disclosures about targeted marketing and profiling and limit decisions based solely on profiling that have legal or similarly significant effects on consumers.
New York attorney general
The bill would authorize enforcement actions, with violators subject to injunctions, damages and civil penalties and each affected individual and violated provision counted separately.
Headline styles
Protect Personal Data Rights
Plain English, a few words. Used as the page title.
Sponsors
History
- Referred to consumer protection
- Referred to consumer protection
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Protect New Yorkers' Data
In Assembly Committee · Consumer Affairs And Protection · Sponsor Linda Rosenthal
Full text
10 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
5642
2019-2020 Regular Sessions
IN SENATE
May 9, 2019
Introduced by Sens. THOMAS, CARLUCCI, MYRIE -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to the management and oversight of personal data
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act may be known and cited as the "New York privacy act".
§ 2. The general business law is amended by adding a new article 42 to read as follows:
ARTICLE 42
NEW YORK PRIVACY ACT Section 1100. Definitions.
1101. Jurisdictional scope.
1102. Data fiduciary.
1103. Consumer rights.
1104. Transparency.
1105. Responsibility according to role.
1106. De-identified data.
1107. Exemptions.
1108. Liability.
1109. Enforcement.
1110. Preemption.
§ 1100. Definitions. The definitions in this article apply unless the context clearly requires otherwise:
1. "Affiliate" means a legal entity that controls, is controlled by, or is under common control with, another legal entity, where the entity holds itself out as affiliated or under common ownership such that a consumer acting reasonably under the circumstances would anticipate their personal data being provided to an affiliate.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD10868-05-9
S. 5642 2
2. "Consent" means a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of a consumer's agreement to the processing of personal data relating to the consumer, such as by a written statement or other clear affirmative action.
3. "Consumer" means a natural person who is a New York resident. It does not include an employee or contractor of a business acting in their role as an employee or contractor.
4. "Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
5. "Data broker" means a business, or unit or units of a business, separately or together, that earns its primary revenue from supplying data or inferences about people gathered mainly from sources other than the data sources themselves.
6. "De-identified data" means:
(a) data that cannot be linked to a known natural person without additional information not available to the controller; or
(b) data (i) that has been modified to a degree that the risk of re-identification is small as determined by a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for de-identifying data, (ii) that is subject to a public commitment by the controller not to attempt to re-identify the data, and (iii) to which one or more enforceable controls to prevent re-identification has been applied. Enforceable controls to prevent re-identification may include legal, administrative, technical, or contractual controls.
7. "Developer" means a person who creates or modifies the set of instructions or programs instructing a computer or device to perform tasks.
8. "Identified or identifiable natural person" means a person who can be identified, directly or indirectly, in particular by reference to specific information including, but not limited to, a name, an identification number, specific geolocation data, or an online identifier.
9. "Minor" means any person under eighteen years of age.
10. "Personal data" means information relating to an identified or identifiable natural person.
(a) "Personal data" includes:
(i) an identifier such as a real name, alias, signature, date of birth, gender identity, sexual orientation, marital status, physical characteristic or description, postal address, telephone number, unique personal identifier, military identification number, online identifier, Internet Protocol address, email address, account name, mother's maiden name, social security number, driver's license number, passport number, or other similar identifier;
(ii) information such as employment, employment history, bank account number, credit card number, debit card number, insurance policy number, or any other financial information, medical information, mental health information, or health insurance information;
(iii) commercial information, including a record of personal property, income, assets, leases, rentals, products or services purchased, obtained, or considered, or other purchasing or consuming history;
(iv) biometric information, including a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry;
(v) internet or other electronic network activity information, including browsing history, search history, content, including text, photographs, audio or video recordings, or other user generated-content,
S. 5642 3
non-public communications, and information regarding an individual's interaction with an internet website, mobile application, or advertisement;
(vi) historical or real-time geolocation data;
(vii) audio, electronic, visual, thermal, olfactory, or similar information;
(viii) education records, as defined in section thirty-three hundred two of the education law;
(ix) political information or information on criminal convictions or arrests;
(x) any required security code, access code, password, or username necessary to permit access to the account of an individual;
(xi) characteristics of protected classes under the human rights law, including race, color, national origin, religion, sex, age, or disability; or
(xii) an inference drawn from any of the information described in this paragraph to create a profile about an individual reflecting the individual's preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.
(b) The term personal data does not include publicly available information. "Publicly available information":
(i) means information that is lawfully made available from federal, state, or local government records; and
(ii) does not include biometric information collected by a covered entity about an individual without the individual's knowledge, or information used for a purpose that is not compatible with the purpose for which the information is maintained and made available in government records.
(c) Personal data does not include de-identified data.
11. "Process" or "processing" means any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, deletion, or destruction.
12. "Processor" means a natural or legal person who processes personal data on behalf of the controller.
13. "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
14. "Restriction of processing" means the marking of stored personal data with the aim of limiting the processing of such personal data in the future.
15.(a) "Sale", "sell" or "sold" means the exchange of personal data for consideration by the controller to a third party.
(b) "Sale" does not include the following: (i) the disclosure of personal data to a processor who processes the personal data on behalf of the controller; (ii) the disclosure of personal data to a third party with whom the consumer has a direct relationship for purposes of providing a product or service requested by the consumer or otherwise in a manner that is consistent with a consumer's reasonable expectations
S. 5642 4
considering the context in which the consumer provided the personal data to the controller; (iii) the disclosure or transfer of personal data to an affiliate of the controller; or (iv) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets, if consumers are notified of the transfer of their data and of their rights under this article and affirmatively consent to the disclosure and transfer of data.
16. "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred over time from a consumer's activities across web sites, applications or online services. It does not include advertising to a consumer based upon the consumer's current visit to a web site, application, or online service, or in response to the consumer's request for information or feedback.
17. "Opt-in" means affirmative, express consent of an individual for a covered entity to use, disclose, or permit access to the individual's personal data after the individual has received explicit notification of the request of the covered entity with respect to that data.
§ 1101. Jurisdictional scope. 1. This article applies to legal entities that conduct business in New York state or produce products or services that are intentionally targeted to residents of New York state.
2. This article does not apply to:
(a) state and local governments;
(b) personal data sets to the extent that they are regulated by the federal health insurance portability and accountability act of 1996, the federal health information technology for economic and clinical health act, or the Gramm-Leach-Bliley act of 1999; or
(c) data sets maintained for employment records purposes.
§ 1102. Data fiduciary. 1. Personal data of consumers shall not be used, processed or transferred to a third party, unless the consumer provides express and documented consent. Every legal entity, or any affiliate of such entity, and every controller and data broker, which collects, sells or licenses personal information of consumers, shall exercise the duty of care, loyalty and confidentiality expected of a fiduciary with respect to securing the personal data of a consumer against a privacy risk; and shall act in the best interests of the consumer, without regard to the interests of the entity, controller or data broker, in a manner expected by a reasonable consumer under the circumstances.
(a) Every legal entity, or affiliate of such entity, and every controller and data broker to which this article applies shall:
(i) reasonably secure personal data from unauthorized access; and
(ii) promptly inform a consumer of any breach of the duty described in this paragraph with respect to personal data of such consumer.
(b) A legal entity, an affiliate of such entity, controller or data broker may not use personal data, or data derived from personal data, in any way that:
(i) will benefit the online service provider to the detriment of an end user; and
(ii) (A) will result in reasonably foreseeable and material physical or financial harm to a consumer; or
(B) would be unexpected and highly offensive to a reasonable consumer.
(c) A legal entity, or affiliate of such entity, controller or data broker:
S. 5642 5
(i) may not disclose or sell personal data to, or share personal data with, any other person except as consistent with the duties of care and loyalty under paragraphs (a) and (b) of this subdivision;
(ii) may not disclose or sell personal data to, or share personal data with, any other person unless that person enters into a contract that imposes the same duties of care, loyalty, and confidentially toward the consumer as are imposed under this section; and
(iii) shall take reasonable steps to ensure that the practices of any person to whom the entity, or affiliate of such entity, controller or data broker discloses or sells, or with whom the entity, or affiliate of such entity, controller or data broker shares. Personal data fulfills the duties of care, loyalty, and confidentiality assumed by the person under the contract described in subparagraph (ii) of this paragraph, including by auditing, on a regular basis, the data security and data information practices of any such entity, or affiliate of such entity, controller or data broker.
2. For the purposes of this section the term "privacy risk" means potential adverse consequences to consumers and society arising from the processing of personal data, including, but not limited to:
(a) direct or indirect financial loss or economic harm;
(b) physical harm;
(c) psychological harm, including anxiety, embarrassment, fear, and other demonstrable mental trauma;
(d) significant inconvenience or expenditure of time;
(e) adverse outcomes or decisions with respect to an individual's eligibility for rights, benefits or privileges in employment (including, but not limited to, hiring, firing, promotion, demotion, compensation), credit and insurance (including, but not limited to, denial of an application or obtaining less favorable terms), housing, education, professional certification, or the provision of health care and related services;
(f) stigmatization or reputational harm;
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to the management and oversight of personal data
Purpose general idea of bill
The purpose of the bill is to address how online platform/social media firms process personal data. The bill, cited as NY Privacy Act, will require the companies to attain consent from consumers before they share and/or sell their information by acting as fiduciary entities.
Summary of provisions
Section 1 of the bill defines the act as the "New York Privacy Act".
Read the full memo (779 words)
Section 2 of the general business law is amended by adding a new article 42.
Section 1100 of the new article 42 provides definitions of relevant terms to be used in this act.
Section 1101 of the new article 42 defines jurisdictional scope as it applies to legal entities that conduct business in New York State or produce products or services intentionally targeted to residents in New York State.
Section 1102 of the new article 42 defines data fiduciary stating that personal data of consumers shall not be used, processed or transferred to a third party, unless the consumer provides express and documented consent.
Section 1103 of the new article 42 defines consumer rights stating that any entity subject to the provisions of this article shall provide notice to consumers of their rights.
Section 1104 of the new article 42 defines transparency stating that controllers shall be transparent and accountable for their personal data by making it available in a form that is reasonably accessible to consumers.
Section 1105 of the new article 42 defines responsibility according to role stating controllers and brokers to be responsible for meeting obli- gations.
Section 1106 of the new article 42 defines de-identified data stating controller or processor shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the de-identified data is subject.
Section 1107 of the new article 42 defines exemptions stating the obli- gations imposed on controllers or processors.
Section 1108 of the new article 42 defines liability stating that it shall be allocated among the parties according to principles of compar- ative fault, unless such liability is otherwise allocated by contract among the parties.
Section 1109 of the new article 42 defines enforcement providing consum- er protection from deceptive acts and practices under article twenty-two of this chapter.
Section 1110 of the new article 42 defines preemption stating this arti- cle supersedes and preempts laws adopted by any local entity regarding the processing of personal data by controllers and processors.
Justification
According to a Pew survey from 2018, 69% of American Adults use at least one social media platform, up from 5% in 2005. Americans use these plat- forms to engage with friends and family, to connect with social and political organizations, and to follow news and current events. Despite the platforms' usefulness, however, many social media users have reser- vations about how their personal information is used. A 2014 Pew survey found that 91% of Americans believe that people have lost control over how their personal information is collected and used. Some 80% of social media users said they were concerned about advertisers and businesses accessing and using data that they share on social media platforms. Around 64% of people surveyed in this survey also said that government should do more to address this issue.
Social media companies' revenues are obtained through targeted advertis- ing based on users' likes, shares, searches, phone numbers, emails, and other information provided while they use these platforms. According to The New York Times, some of the largest social media companies fail to inform or obtain consent from users regarding the sharing of their personal data. It found that in some instances these social media compa- nies share the information of hundreds of millions of users without notifying their consumers. If a user were to choose the most restrictive privacy settings made available, that user's personal data could still be shared with certain external companies or affiliates. What's more, according to these large social media companies, any information shared with others on these platforms could be provided to other companies without any additional consent. Currently, there are no federal regu- lations addressing this privacy issue, and few attempts of self-regula- tion by these companies have been frail and falls well short of address- ing consumers' concerns. Hence, it is imperative that New York joins the increasing number of other states to fill this void.
Prior legislative history
New bill.
Fiscal implications for state and local governments
None to the state.
Effective date
This act shall take effect on the one hundred eightieth day after it shall have become law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.