STATE OF NEW YORK ________________________________________________________________________ 8327 IN SENATE May 11, 2020 ___________ Introduced by Sen. JACOBS -- read twice and ordered printed, and when printed to be committed to the Committee on Codes AN ACT to amend the penal law, the state technology law, the general business law and the civil rights law, in relation to protecting people's privacy during contact tracing The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The penal law is amended by adding a new section 250.70 to 2 read as follows: 3 § 250.70 Unlawful dissemination of contact tracing information. 4 A person is guilty of unlawful dissemination of contact tracing infor- 5 mation when he or she: 6 1. knowingly uses, causes to be used, or accesses a computer, computer 7 service, or computer network without authorization and he or she thereby 8 knowingly gains access to contact tracing information; or 9 2. knowingly disseminates contact tracing information to any person 10 not authorized by the governor or the commissioner of the department of 11 health to receive such information. For the purposes of this section, 12 the term "contact tracing information" shall mean any information 13 collected for the purposes of performing the process of identification 14 of persons who may have come into contact with or into close proximity 15 to an infected person and any subsequent collection of additional infor- 16 mation about these persons and contacts. 17 Unlawful dissemination of contact tracing information is a class E 18 felony. 19 § 2. The penal law is amended by adding a new section 250.75 to read 20 as follows: 21 § 250.75 Unlawful use of a surveillance drone. 22 A person is guilty of unlawful use of a surveillance drone when he or 23 she knowingly uses or causes to be used a drone for the purposes of 24 surveillance without the consent of all persons within the area surv- 25 eilled by such drone for the purposes of collecting contact tracing 26 information or for monitoring the vital signs or social distancing prac- 27 tices of individuals. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD16269-02-0

S. 8327 2 1 For the purposes of this section, the term "contact tracing informa- 2 tion" shall mean any information collected for the purposes of perform- 3 ing the process of identification of persons who may have come into 4 contact with or into close proximity to an infected person and any 5 subsequent collection of further information about these persons and 6 contacts. 7 Unlawful use of a surveillance drone is a class E felony. 8 § 3. The state technology law is amended by adding a new section 209 9 to read as follows: 10 § 209. Contact tracing application privacy. 1. For the purposes of 11 this section, the term: 12 (a) "contact tracing information" shall mean any information collected 13 for the purposes of performing the process of identification of persons 14 who may have come into contact with or into close proximity to an 15 infected person and any subsequent collection of additional information 16 about these persons and contacts. 17 (b) "application" shall mean computer software, applications and other 18 forms of technology created and used for the purposes of collecting 19 contact tracing information. 20 2. The use of applications created for the purpose of collecting 21 contact tracing information shall be voluntary. The user of any applica- 22 tion shall be required to give explicit consent to the application being 23 downloaded, to the application being used, and to the application 24 providing any information collected to any person. The user shall be 25 provided with a conspicuous, plain language explanation of the applica- 26 tion, the application's functions and any information that the applica- 27 tion will collect prior to the user being able to give consent to the 28 download of the application. Such consent shall be revocable at anytime 29 at which point the application shall terminate the functionality to 30 which the user is no longer consenting. If consent to having the appli- 31 cation downloaded is revoked, the application shall fully remove itself 32 or enable the user to easily remove the application from the device it 33 is downloaded onto. 34 3. Any information stored or transmitted by an application shall be 35 stored or transmitted in an encrypted manner as to prevent access by an 36 unauthorized person. 37 4. Any information collected by an application shall be completely 38 deleted, destroyed and erased and no further information shall be 39 collected upon the end of the state public emergency requiring the 40 creation of the application. 41 5. Notwithstanding any other provision of law to the contrary, any 42 person, business or governmental entity in violation of this section 43 shall be liable to any person who used an application involuntarily or 44 without giving properly informed consent or whose contact tracing infor- 45 mation was disclosed or used improperly. Liability under this section is 46 in addition to any other applicable penalties and causes of action. An 47 action to recover damages under this section may be maintained as a 48 class action, notwithstanding subdivision b of section nine hundred one 49 of the civil practice law and rules. 50 § 4. The general business law is amended by adding a new section 899- 51 cc to read as follows: 52 § 899-cc. Contact tracing application privacy. 1. For the purposes of 53 this section, the term: 54 (a) "contact tracing information" shall mean any information collected 55 for the purposes of performing the process of identification of persons 56 who may have come into contact with or into close proximity to an

S. 8327 3 1 infected person and any subsequent collection of additional information 2 about these persons and contacts. 3 (b) "application" shall mean computer software, applications and other 4 forms of technology created and used for the purposes of collecting 5 contact tracing information. 6 2. The use of applications created for the purpose of collecting 7 contact tracing information shall be voluntary. The user of any applica- 8 tion shall be required to give explicit consent to the application being 9 downloaded, to the application being used, and to the application 10 providing any information collected to any person. The user shall be 11 provided with a conspicuous, plain language explanation of the applica- 12 tion, the application's functions and any information that the applica- 13 tion will collect prior to the user being able to give consent to the 14 download of the application. Such consent shall be revocable at any 15 time at which point the application shall terminate the functionality to 16 which the user is no longer consenting. If consent to having the appli- 17 cation downloaded is revoked, the application shall fully remove itself 18 or enable the user to easily remove the application from the device it 19 is downloaded onto. 20 3. Any information stored or transmitted by an application shall be 21 stored or transmitted in an encrypted manner as to prevent access by an 22 unauthorized person. 23 4. Any information collected by an application shall be completely 24 deleted, destroyed and erased and no further information shall be 25 collected upon the end of the state public emergency requiring the 26 creation of the application. 27 5. Notwithstanding any other provision of law to the contrary, any 28 person, business or governmental entity in violation of this section 29 shall be liable to any person who used an application involuntarily or 30 without giving properly informed consent or whose contact tracing infor- 31 mation was disclosed or used improperly. Liability under this section is 32 in addition to any other applicable penalties and causes of action. An 33 action to recover damages under this section may be maintained as a 34 class action, notwithstanding subdivision b of section nine hundred one 35 of the civil practice law and rules. 36 § 5. The civil rights law is amended by adding a new section 79-p to 37 read as follows: 38 § 79-p. Right to privacy; contact tracing. 1. The following defi- 39 nitions are applicable to this section: 40 (a) "contact tracing information" shall mean any information collected 41 for the purposes of performing the process of identification of persons 42 who may have come into contact with or into close proximity to an 43 infected person and any subsequent collection of further additional 44 information about these persons and contacts. 45 (b) "application" shall mean computer software, or applications and 46 other forms of technology created and used for the purposes of collect- 47 ing contact tracing information. 48 2. (a) No person, business, or governmental entity shall require the 49 download, installation or use of an application of the purposes of 50 collecting contact tracing information for any reason and the use of 51 such applications shall be voluntary. 52 (b) No person, business, or governmental entity shall restrict the 53 rights and privileges of a person based on such persons refusal to down- 54 load, installation or use of an application for the purposes of collect- 55 ing contact tracing information.

S. 8327 4 1 (c) No person, business, or governmental entity shall collect, use, 2 or distribute contact tracing information in violation of section 250.70 3 or 250.75 of the penal law, section two hundred nine of the state tech- 4 nology law, or section eight hundred ninety-nine-cc of the general busi- 5 ness law. 6 3. Any person aggrieved by a violation of the protections created by 7 this section shall have the right to bring an action or special proceed- 8 ing in a court of appropriate jurisdiction to seek damages and/or 9 declaratory and injunctive relief or any other remedies as provided by 10 law with respect to such violation. The right to bring an action under 11 this section is in addition to any other applicable penalties and causes 12 of action. 13 4. An action to recover damages under this section may be maintained 14 as a class action, notwithstanding subdivision b of section nine hundred 15 one of the civil practice law and rules. 16 § 6. This act shall take effect immediately.

Relates to protecting people's privacy during contact tracing

What's Happening

Why It Matters