Assembly Bill A944

                            
                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                   944

                       2009-2010 Regular Sessions

                          I N  A S S E M B L Y

                               (PREFILED)

                             January 7, 2009
                               ___________

Introduced  by  M.  of  A.  McDONOUGH  -- Multi-Sponsored by -- M. of A.
  BUTLER -- read once and referred to the Committee on Banks

AN ACT to amend the banking law, in relation to regulating the  use  and
  dissemination of confidential customer information by financial insti-
  tutions

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. The banking law is amended by adding a new  article  17  to
read as follows:

                               ARTICLE 17
              PROTECTION OF CUSTOMER FINANCIAL INFORMATION

SECTION 9020. DEFINITIONS.
        9021. PRIVACY OF CONFIDENTIAL CUSTOMER INFORMATION.
        9022. LIMITATIONS.
        9023. RECORD RETENTION.
        9024. ENFORCEMENT BY THE ATTORNEY GENERAL.
        9025. PRIVATE RIGHT OF ACTION.
  S  9020.  DEFINITIONS.  AS  USED  IN THIS ARTICLE, THE FOLLOWING TERMS
SHALL HAVE THE FOLLOWING MEANINGS:
  1. "FINANCIAL INSTITUTION" MEANS ANY INSTITUTION THE BUSINESS OF WHICH
IS ENGAGING IN FINANCIAL ACTIVITIES AS DESCRIBED IN SECTION 4(K) OF  THE
FEDERAL BANK HOLDING COMPANY ACT OF 1956.
  2. "CONFIDENTIAL CUSTOMER INFORMATION" SHALL MEAN PERSONALLY IDENTIFI-
ABLE INFORMATION:
  (A) PROVIDED BY A CUSTOMER TO A FINANCIAL INSTITUTION;
  (B)  RESULTING  FROM  ANY TRANSACTION WITH THE CUSTOMER OR THE SERVICE
PERFORMED FOR THE CUSTOMER; OR
  (C) OTHERWISE OBTAINED BY THE FINANCIAL INSTITUTION.

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
              

                                                           LBD01380-01-9

A. 944                              2

  3. "CUSTOMER" SHALL MEAN ANY INDIVIDUAL WHO OBTAINS, FROM A  FINANCIAL
INSTITUTION, A PRODUCT OR SERVICE WHICH IS INTENDED TO BE USED PRIMARILY
FOR  PERSONAL,  FAMILY  OR  HOUSEHOLD PURPOSES, AND ALSO MEANS THE LEGAL
REPRESENTATIVE OF SUCH AN INDIVIDUAL, AND SHALL  INCLUDE  AN  INDIVIDUAL
WHOSE APPLICATION FOR SUCH PRODUCT OR SERVICE HAS BEEN DENIED.
  4.  "UNAFFILIATED THIRD PARTY" SHALL MEAN ANY ENTITY OR PERSON THAT IS
NOT AN AFFILIATE OF, OR RELATED BY COMMON  OWNERSHIP  OR  AFFILIATED  BY
CORPORATE  CONTROL WITH, THE FINANCIAL INSTITUTION, BUT DOES NOT INCLUDE
A JOINT EMPLOYEE OF SUCH INSTITUTION.
  5. "AFFILIATE" SHALL MEAN ANY COMPANY THAT CONTROLS, IS CONTROLLED BY,
OR IS UNDER COMMON CONTROL WITH ANOTHER COMPANY.
  S 9021. PRIVACY OF CONFIDENTIAL CUSTOMER  INFORMATION.  1.  EXCEPT  AS
OTHERWISE  EXPRESSLY  PROVIDED  IN THIS ARTICLE, A FINANCIAL INSTITUTION
SHALL NOT DIRECTLY OR THROUGH AN AFFILIATE DISCLOSE CONFIDENTIAL CUSTOM-
ER INFORMATION TO AN  UNAFFILIATED  THIRD  PARTY  UNLESS  THE  FINANCIAL
INSTITUTION  HAS  FIRST GIVEN WRITTEN NOTICE MEETING THE REQUIREMENTS OF
THIS SECTION TO THE CUSTOMER TO WHOM THE INFORMATION  RELATES,  AND  HAS
OBTAINED THE INFORMED WRITTEN OR ELECTRONIC CONSENT OF THAT CUSTOMER FOR
SUCH DISCLOSURE, AND SUCH CONSENT HAS NOT BEEN  WITHDRAWN.
  2.  ANY  FINANCIAL  INSTITUTION  THAT  SEEKS  TO DISCLOSE CONFIDENTIAL
CUSTOMER INFORMATION SHALL FIRST  PROVIDE  A  WRITTEN  NOTICE,  ENTITLED
"FINANCIAL  PRIVACY NOTICE," WRITTEN IN ACCORDANCE WITH SECTION 5-702 OF
THE GENERAL OBLIGATIONS LAW, TO EACH OF ITS CUSTOMERS  AT  THE  TIME  AT
WHICH A FINANCIAL RELATIONSHIP IS INITIATED AND AT LEAST ANNUALLY THERE-
AFTER.  SUCH  NOTICE SHALL BE GIVEN AT THE TIME AN ACCOUNT IS OPENED, AT
THE TIME A LOAN OR MORTGAGE APPLICATION IS MADE, AT THE TIME A  LOAN  OR
MORTGAGE  IS  GRANTED,  OR  AT THE TIME THE CUSTOMER ENTERS INTO ANOTHER
FORM OF FINANCIAL TRANSACTION WITH THE FINANCIAL INSTITUTION.
  3. THE NOTICE SHALL CLEARLY AND CONSPICUOUSLY STATE OR DESCRIBE:
  (A) THE SPECIFIC TYPES OF CONFIDENTIAL CUSTOMER INFORMATION  THAT  THE
FINANCIAL INSTITUTION SEEKS TO DISCLOSE;
  (B) THE CIRCUMSTANCES UNDER WHICH DISCLOSURE WILL BE MADE;
  (C)  THE SPECIFIC TYPES OF UNAFFILIATED THIRD PARTIES TO WHICH DISCLO-
SURE WILL BE MADE;
  (D) THE SPECIFIC USES THAT WILL BE MADE OF THE INFORMATION AFTER IT IS
DISCLOSED;
  (E) ALL DISCLOSURES REQUIRED UNDER SECTION  603(D)(2)(A)(III)  OF  THE
FEDERAL FAIR CREDIT REPORTING ACT AND COMPARABLE DISCLOSURES UNDER ARTI-
CLE TWENTY-FIVE OF THE GENERAL BUSINESS LAW;
  (F) THAT DISCLOSURE WILL BE LIMITED TO THE CONDITIONS SET FORTH IN THE
NOTICE;
  (G) THAT THE CUSTOMER HAS THE RIGHT TO REVOKE THE CONSENT AT ANY TIME;
  (H) THAT A NEW AUTHORIZATION WILL BE SOUGHT FROM THE CUSTOMER PRIOR TO
THE DISCLOSURE OF ANY CONFIDENTIAL CUSTOMER INFORMATION OTHER THAN UNDER
THE  CONDITIONS  SET  FORTH IN THE NOTICE OR FOLLOWING REVOCATION OF THE
CONSENT;
  (I) WHETHER THE FINANCIAL INSTITUTION WILL  RECEIVE  COMPENSATION  FOR
THE DISCLOSURE;
  (J) THAT A DENIAL OF APPROVAL WILL NOT ADVERSELY AFFECT THE CUSTOMER'S
FINANCIAL RELATIONSHIP WITH THE INSTITUTION;
  (K)  AN  EXPIRATION  DATE  OF  NO MORE THAN TWO YEARS FROM THE DATE OF
EXECUTION OF THE FORM; AND
  (L) A SPACE FOR THE CUSTOMER'S SIGNATURE AND THE DATE OF EXECUTION  OF
THE FORM.
  4.  NO  DISCLOSURE  OF CONFIDENTIAL CUSTOMER INFORMATION SHALL BE MADE
PRIOR TO RECEIPT BY THE FINANCIAL INSTITUTION  OF  A  SIGNED  AND  DATED

A. 944                              3

CONSENT  FORM FROM THE CUSTOMER. IN ADDITION, NO DISCLOSURE OF CONFIDEN-
TIAL CUSTOMER INFORMATION SHALL BE MADE AFTER RECEIPT BY  THE  FINANCIAL
INSTITUTION  OF A REVOCATION OF ANY CONSENT PREVIOUSLY GIVEN, UNLESS AND
UNTIL THE CUSTOMER EXECUTES A NEW INFORMED CONSENT FORM.
  5. EVERY FINANCIAL INSTITUTION SHALL ESTABLISH APPROPRIATE ADMINISTRA-
TIVE,  TECHNICAL  AND  PHYSICAL  SAFEGUARDS  TO  ENSURE THE SECURITY AND
CONFIDENTIALITY OF RECORDS CONTAINING CONFIDENTIAL CONSUMER  INFORMATION
AND TO PROTECT AGAINST ANY ANTICIPATED THREATS OR HAZARDS TO THEIR SECU-
RITY  OR INTEGRITY THAT COULD RESULT IN SUBSTANTIAL HARM, EMBARRASSMENT,
INCONVENIENCE OR UNFAIRNESS TO ANY DATA SUBJECT ABOUT  WHOM  INFORMATION
IS MAINTAINED.
  S  9022. LIMITATIONS. 1. NOTWITHSTANDING SECTION NINE THOUSAND TWENTY-
ONE OF THIS ARTICLE, A FINANCIAL INSTITUTION  SHALL  NOT  BE  PROHIBITED
FROM  DISCLOSING  CONFIDENTIAL  CUSTOMER INFORMATION UNDER THE FOLLOWING
CIRCUMSTANCES:
  (A) WHEN SPECIFICALLY AUTHORIZED BY THE CUSTOMER;
  (B) WHEN NECESSARY TO MAINTAIN OR SERVICE THE CUSTOMER'S ACCOUNT  WITH
THE FINANCIAL INSTITUTION;
  (C)  TO  ANY PERSON OR ORGANIZATION PROVIDING PROFESSIONAL SERVICES TO
THE FINANCIAL INSTITUTION, INCLUDING, BUT NOT LIMITED TO, AN  ACCOUNTANT
ENGAGED BY THE FINANCIAL INSTITUTION TO PREPARE AN INDEPENDENT AUDIT, AN
ATTORNEY PERFORMING A SERVICE ON BEHALF OF THE FINANCIAL INSTITUTION, OR
AN  AGENT  OR  OTHER  PERSON  REPRESENTING  THE FINANCIAL INSTITUTION IN
COLLECTING A DEBT OR OTHERWISE SECURING PAYMENT OF A LOAN OR ADVANCE;
  (D) TO PROTECT THE CONFIDENTIALITY OR SECURITY OF ITS RECORDS PERTAIN-
ING TO THE CUSTOMER, THE SERVICE OR PRODUCT, OR THE TRANSACTION THEREIN,
OR TO PROTECT AGAINST OR PREVENT ACTUAL OR POTENTIAL FRAUD, UNAUTHORIZED
TRANSACTIONS, CLAIMS OR OTHER LIABILITY;
  (E) TO PROVIDE INFORMATION TO APPLICABLE RATING AGENCIES OF THE FINAN-
CIAL INSTITUTION AND PERSONS ASSESSING THE INSTITUTION'S COMPLIANCE WITH
INDUSTRY STANDARDS;
  (F) WHEN THE  FINANCIAL  INSTITUTION  IS  COMPELLED  TO  DISCLOSE  THE
CONTENTS  OF  THE  INFORMATION  PURSUANT  TO A LAWFUL SUBPOENA, SUMMONS,
WARRANT, OR COURT ORDER;
  (G) WHEN DISCLOSURE IS REQUIRED BY FEDERAL OR STATE LAW OR REGULATION;
  (H) TO A CREDIT-REPORTING AGENCY AS DEFINED  BY  SECTION  SIX  HUNDRED
THREE  OF  THE  FEDERAL  FAIR  CREDIT  REPORTING  ACT FOR INCLUSION IN A
CONSUMER REPORT THAT MAY BE RELEASED TO A  THIRD  PARTY  FOR  A  PURPOSE
PERMISSIBLE UNDER SECTION SIX HUNDRED FOUR OF SUCH ACT;
  (I) TO GOVERNMENT ENTITIES;
  (J)  TO  THE  FINANCIAL INSTITUTION'S BOND OR INSURANCE COMPANIES WHEN
THE FINANCIAL INSTITUTION HAS INFORMATION RELATIVE TO A  CLAIM  PURSUANT
TO  ITS  BOND  OR DIRECTOR'S AND OFFICER'S LIABILITY INSURANCE POLICY OR
OTHER INSURANCE COVERAGE; OR
  (K) IN CONNECTION WITH AN ACTUAL SALE, MERGER, TRANSFER OR EXCHANGE OF
ALL OR A PORTION OR UNIT OF THE FINANCIAL INSTITUTION IF THE  DISCLOSURE
CONCERNS  SOLELY  CUSTOMERS  OF SUCH FINANCIAL INSTITUTION OR PORTION OR
UNIT.
  2. PRIOR TO RELEASE OF CONFIDENTIAL CUSTOMER INFORMATION AUTHORIZED BY
SUBDIVISION ONE OF SECTION NINE THOUSAND TWENTY-ONE OF THIS ARTICLE,  OR
AUTHORIZED  BY  PARAGRAPHS (B), (C), (D), (E) AND (J) OF SUBDIVISION ONE
OF THIS SECTION, THE FINANCIAL INSTITUTION SHALL ENTER INTO A CONTRACTU-
AL AGREEMENT WITH ANY THIRD PARTY RECEIVING SUCH  CONFIDENTIAL  CUSTOMER
INFORMATION,  PROHIBITING SUCH THIRD PARTY FROM DISCLOSING SUCH INFORMA-
TION.

A. 944                              4

  S 9023. RECORD RETENTION. 1. A FINANCIAL  INSTITUTION  SHALL  MAINTAIN
RECORDS  OF FINANCIAL PRIVACY NOTIFICATION, AS REQUIRED IN THIS ARTICLE,
AND RETAIN COPIES OF EACH CUSTOMER'S APPROVAL OF DISCLOSURE OF CONFIDEN-
TIAL CUSTOMER INFORMATION OR WITHDRAWAL OF SUCH APPROVAL  FOR  AT  LEAST
FIVE YEARS.
  2.  A  FINANCIAL  INSTITUTION SHALL MAINTAIN RECORDS OF ALL COMPLAINTS
UNDER THIS ARTICLE AND THEIR DISPOSITION,  IF  ANY,  FOR  AT  LEAST  TEN
YEARS.
  S  9024. ENFORCEMENT BY THE ATTORNEY GENERAL. IN ADDITION TO THE OTHER
REMEDIES PROVIDED, WHENEVER THERE SHALL BE A VIOLATION OF THIS  ARTICLE,
APPLICATION  MAY  BE  MADE  BY  THE  ATTORNEY GENERAL IN THE NAME OF THE
PEOPLE OF THE STATE OF NEW YORK TO A COURT OR JUSTICE  HAVING  JURISDIC-
TION  BY A SPECIAL PROCEEDING TO ISSUE AN INJUNCTION, AND UPON NOTICE TO
THE DEFENDANT OF NOT LESS THAN FIVE DAYS, TO  ENJOIN  AND  RESTRAIN  THE
CONTINUANCE  OF SUCH VIOLATIONS; AND IF IT SHALL APPEAR TO THE SATISFAC-
TION OF THE COURT OR JUSTICE THAT THE DEFENDANT HAS, IN  FACT,  VIOLATED
THIS  ARTICLE,  AN  INJUNCTION  MAY  BE ISSUED BY SUCH COURT OR JUSTICE,
ENJOINING THE RESTRAINING OF ANY FURTHER  VIOLATION,  WITHOUT  REQUIRING
PROOF  THAT ANY PERSON HAS, IN FACT, BEEN INJURED OR DAMAGED THEREBY. IN
ANY SUCH PROCEEDINGS, THE COURT MAY  MAKE  ALLOWANCES  TO  THE  ATTORNEY
GENERAL  AS  PROVIDED  IN  PARAGRAPH  SIX  OF SUBDIVISION (A) OF SECTION
EIGHTY-THREE HUNDRED THREE OF THE CIVIL  PRACTICE  LAW  AND  RULES,  AND
DIRECT  RESTITUTION. WHENEVER THE COURT SHALL DETERMINE THAT A VIOLATION
OF THIS ARTICLE HAS OCCURRED, THE COURT MAY IMPOSE A  CIVIL  PENALTY  OF
NOT  MORE  THAN  TWO  THOUSAND DOLLARS FOR EACH VIOLATION. IN CONNECTION
WITH ANY SUCH PROPOSED APPLICATION, THE ATTORNEY GENERAL  IS  AUTHORIZED
TO  TAKE  PROOF  AND  MAKE  A DETERMINATION OF THE RELEVANT FACTS AND TO
ISSUE SUBPOENAS IN ACCORDANCE WITH THE CIVIL PRACTICE LAW AND RULES.
  S 9025. PRIVATE RIGHT  OF  ACTION.  IN  THE  EVENT  THAT  CONFIDENTIAL
CUSTOMER  INFORMATION  IS DISCLOSED BY A FINANCIAL INSTITUTION ABOUT ANY
CUSTOMER IN VIOLATION OF THIS ARTICLE, SUCH CUSTOMER MAY BRING AN ACTION
FOR RECOVERY OF DAMAGES. JUDGMENT SHALL BE ENTERED IN FAVOR OF A CONSUM-
ER IN AN AMOUNT NOT TO EXCEED THREE TIMES  THE  ACTUAL  DAMAGES  OR  ONE
THOUSAND  DOLLARS,  WHICHEVER IS GREATER. THE COURT MAY AWARD REASONABLE
ATTORNEY'S FEES TO A PREVAILING PLAINTIFF.
  S 2. Severability. If any clause, sentence, paragraph, section or part
of this act shall be adjudged by any court of competent jurisdiction  to
be  invalid,  such  judgment  shall not affect, impair or invalidate the
remainder thereof, but shall be confined in its operation to the clause,
sentence, paragraph, section or part thereof directly  involved  in  the
controversy in which such judgment shall have been rendered.
  S  3.  This  act shall take effect on the ninetieth day after it shall
have become a law.