What's happening
This bill requires data brokers in New York to register annually with the Attorney General, who will maintain a public registry website.
Why it matters
Increases transparency and consumer awareness. By requiring data brokers to publicly disclose their data collection and sales practices—including opt-out options—New Yorkers can better understand which companies are trading their personal information and how to exercise their privacy rights.
Defines and limits the scope of “data broker”. The bill clearly outlines who qualifies as a data broker, excluding entities already regulated by certain federal financial and insurance laws, which helps focus regulatory efforts on previously unregulated actors.
Establishes accountability with penalties. Data brokers that fail to register face daily civil penalties and possible injunctions, incentivizing compliance and potentially deterring unlawful or irresponsible data trading.
Empowers the Attorney General and centralizes oversight. The law gives the Attorney General authority to manage the registry, set fees, and enforce penalties, creating a single point of oversight and potentially streamlining enforcement of data privacy standards in New York.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Data brokers
Businesses that collect and sell New Yorkers’ personal information without a direct relationship would have to register annually, pay a fee and disclose their opt-out practices, with failure to register carrying civil penalties of $100 per day.
New York attorney general’s office
The office would administer registration, set fees and maintain a public online registry of data brokers and their disclosures.
New York consumers
Residents could use the registry to find brokers’ contact information, available opt-out methods and data practices from which they cannot opt out.
Consumer reporting agencies, financial institutions and insurance entities
Entities covered by the specified federal credit-reporting, financial-privacy or insurance-privacy laws would be excluded from the bill’s definition of a data broker.
Headline styles
Register Data Brokers Publicly
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to rules
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
6848
2019-2020 Regular Sessions
IN SENATE
November 13, 2019
Introduced by Sen. THOMAS -- read twice and ordered printed, and when printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to requiring registration of data brokers and directing the attorney general to maintain a website of such registrations
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new article 44 to read as follows:
ARTICLE 44
DATA BROKER REGISTRY Section 1400. Definitions.
1401. Annual registration.
1402. Website.
1403. Penalties.
§ 1400. Definitions. For the purposes of this article, the following terms shall have the following meanings:
1. "Consumer" shall mean a natural person who is a New York resident. "Consumer" shall not include an employee or contractor of a business acting in their role as an employee or contractor.
2. "Data broker" shall mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. "Data broker" shall not include a consumer reporting agency covered by the federal Fair Credit Reporting Act or a financial institution covered by the Gramm- Leach-Bliley Act or an entity covered by the Insurance Information and Privacy Protection Act.
3. "Direct relationship" shall mean that the consumer is a past or present: (a) customer, client, subscriber or user of the business's goods or services; (b) employee, contractor or agent of the business; (c) investor in the business; or (d) donor to the business.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD14182-01-9
S. 6848 2
4. "Personal information" shall mean any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.
§ 1401. Annual registration. Annually, on or before January thirtyfirst, a data broker, as defined under this article, shall:
1. register with the attorney general in a manner provided for by the attorney general;
2. pay a registration fee in an amount determined by the attorney general not to exceed the reasonable cost of establishing and maintaining the informational website described in section fourteen hundred three of this article; and
3. provide the following information:
(a) the name of the data broker and its primary physical, email and internet website address;
(b) whether the data broker permits a consumer to: opt out of the data broker's collection of brokered personal information; opt out of its databases; or opt out of certain sales of data;
(c) the method for requesting an opt-out under paragraph (b) of this subdivision;
(d) a statement specifying the data collection, databases, or sales activities from which a consumer may not opt out; and
(e) any additional information or explanation the data broker chooses to provide concerning its data collection practices.
§ 1402. Website. The attorney general shall establish, manage and maintain a statewide registry on its internet website, which shall list all registered data brokers doing business in the state and make accessible to the public all the information provided by data brokers pursuant to this article. Printed hard copies of such registry shall be made available upon request and payment of a fee to be determined by the attorney general.
§ 1403. Penalties. A data broker that fails to register is subject to injunction and is liable for civil penalties of one hundred dollars for each day that such data broker fails to register, an amount equal to the fees due under this section during the period such data broker failed to register and expenses incurred by the attorney general in the investigation and prosecution of the action.
§ 2. This act shall take effect on the first of January next succeeding the date on which it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to requiring registration of data brokers and directing the attorney general to main- tain a website of such registrations
Purpose general idea of bill
The purpose of the bill is to create a registry of data brokers so that New York consumers may better know what businesses to contact in order to opt-out of the sale of their personal information.
Summary of provisions
Section 1 of the bill defines consumer, data broker, direct relation- ship, and personal information.
Section 2 of the bill requires data brokers to register with the attor- ney general and disclose information on how consumers may opt out of the data broker's collection of information, databases, or sale of data. Data brokers must also disclose any data collection, databases, or sales from which the consumer may not opt-out. Data brokers must pay a regis- tration fee determined by the attorney general.
Section 3 of the bill requires the attorney general to establish, manage and maintain a statewide registry website that makes public all the information provided by data brokers at registration. Printed hard copies of the registry must be made available upon request for a fee determined by the attorney general.
Section 4 of the bill describes penalties for failure to register with the attorney general. Data brokers who fail to register are subject to an injunction and civil penalties of $100 a day for each day the data broker fails to register and payment of the expense incurred by the AG's office to investigate/enforce the violation.
Justification
Companies regularly and systematically collect, analyze, share, and sell the personal information of consumers. While this data collection provides consumers various benefits, public fears about the widespread, unregulated amassing of personal information are growing. One partic- ularly troubling area of this systematic data collection is the emer- gence of data brokers that collect this data without having any direct relationship with the consumers whose information they amass.
In order to bring this industry into the light and more fully inform consumers about who is collecting their personal information and how, this bill establishes a data broker registry.
Vermont and California have already passed legislation requiring data brokers to register.
Prior legislative history
New bill.
Fiscal implications for state and local governments
EFFECTIVE DATE: This act shall take effect on the first of January next succeeding the date on which it shall have become law.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.