S T A T E O F N E W Y O R K
________________________________________________________________________
11113
I N A S S E M B L Y
May 17, 2010
___________
Introduced by M. of A. PHEFFER, MAISEL, REILLY, DelMONTE, STIRPE, CHRIS-
TENSEN, M. MILLER, HIKIND, MILLMAN, KOON, DINOWITZ, ZEBROWSKI,
P. RIVERA, GALEF -- Multi-Sponsored by -- M. of A. ABBATE, CRESPO,
GABRYSZAK, GIBSON, GLICK, JOHN, V. LOPEZ, McENENY, SCHIMEL, SWEENEY,
WEISENBERG -- read once and referred to the Committee on Consumer
Affairs and Protection
AN ACT to amend the general business law and the correction law, in
relation to the processing of personal identifying information
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. The general business law is amended by adding a new section
392-j to read as follows:
S 392-J. PROCESSING PERSONAL IDENTIFYING INFORMATION; PROHIBITIONS. 1.
DEFINITIONS. AS USED IN THIS SECTION:
(A) "INMATE" MEANS AN OFFENDER WHO IS COMMITTED UNDER SENTENCE TO OR
CONFINED IN A PENAL OR CORRECTIONAL INSTITUTION, INCLUDING BUT NOT
LIMITED TO A FACILITY FOR THE MENTALLY ILL OR MENTALLY DEFECTIVE.
(B) "DATA SUBJECT" SHALL MEAN A NATURAL PERSON RESIDING IN THIS STATE.
(C) "PERSONAL INFORMATION" SHALL MEAN ANY INFORMATION CONCERNING A
NATURAL PERSON WHICH, BECAUSE OF NAME, NUMBER, PERSONAL MARK, OR OTHER
IDENTIFIER, CAN BE USED TO IDENTIFY SUCH NATURAL PERSON.
(D) "PERSONAL IDENTIFYING INFORMATION" SHALL MEAN PERSONAL INFORMATION
CONSISTING OF ANY INFORMATION IN COMBINATION WITH ANY ONE OR MORE OF THE
FOLLOWING DATA ELEMENTS, WHEN EITHER THE PERSONAL INFORMATION OR THE
DATA ELEMENT IS NOT ENCRYPTED, OR ENCRYPTED WITH AN ENCRYPTION KEY THAT
IS INCLUDED IN THE SAME RECORD AS THE ENCRYPTED PERSONAL INFORMATION OR
DATA ELEMENT:
(1) SOCIAL SECURITY NUMBER;
(2) DRIVER'S REGISTRATION NUMBER OR NON-DRIVER IDENTIFICATION CARD
NUMBER; OR
(3) MOTHER'S MAIDEN NAME, FINANCIAL SERVICES ACCOUNT NUMBER OR CODE,
SAVINGS ACCOUNT NUMBER OR CODE, CHECKING ACCOUNT NUMBER OR CODE, DEBIT
CARD NUMBER OR CODE, AUTOMATED TELLER MACHINE NUMBER OR CODE, ELECTRONIC
SERIAL NUMBER OR PERSONAL IDENTIFICATION NUMBER.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD17109-01-0
A. 11113 2
(E) "PERSONAL IDENTIFICATION NUMBER" SHALL MEAN ANY NUMBER OR CODE
WHICH MAY BE USED ALONE OR IN CONJUNCTION WITH ANY OTHER INFORMATION TO
ASSUME THE IDENTITY OF ANOTHER PERSON OR ACCESS FINANCIAL RESOURCES OR
CREDIT OF ANOTHER PERSON.
2. NOTWITHSTANDING ANY OTHER PROVISION OF LAW, NO PERSON, FIRM, PART-
NERSHIP, ASSOCIATION, OR CORPORATION SHALL KNOWINGLY USE THE LABOR OR
TIME OF ANY INMATE IN THIS STATE, OR IN ANY OTHER JURISDICTION, TO
ENGAGE IN WHOLE OR IN PART IN OBTAINING ACCESS TO, COLLECTING OR PROC-
ESSING PERSONAL IDENTIFYING INFORMATION PERTAINING TO A DATA SUBJECT IN
THIS STATE.
3. A VIOLATION OF THE PROVISIONS OF THIS SECTION SHALL BE PUNISHABLE
BY A CIVIL PENALTY OF NOT MORE THAN ONE THOUSAND FIVE HUNDRED DOLLARS
FOR THE FIRST VIOLATION AND NOT MORE THAN TWO THOUSAND FIVE HUNDRED
DOLLARS FOR A SECOND OR SUBSEQUENT VIOLATION.
S 2. Subdivision 1 of section 170 of the correction law, as amended by
chapter 166 of the laws of 1991, is amended to read as follows:
1. The commissioner [of correctional services] shall not, nor shall
any other authority whatsoever, make any contract by which the labor or
time of any inmate in any state or local correctional facility in this
state, or the product or profit of his work, shall be contracted, let,
farmed out, given or sold to any person, firm, association or corpo-
ration; except that the inmates in said correctional institutions may
work for, and the products of their labor may be disposed of to, the
state or any political subdivision thereof, any public institution owned
or managed and controlled by the state, or any political subdivision
thereof, PROVIDED THAT NO INMATE IN ANY STATE OR LOCAL CORRECTIONAL
FACILITY SHALL ENGAGE IN WHOLE OR IN PART IN OBTAINING ACCESS TO,
COLLECTING OR PROCESSING PERSONAL IDENTIFYING INFORMATION, AS DEFINED IN
SECTION THREE HUNDRED NINETY-TWO-J OF THE GENERAL BUSINESS LAW, PERTAIN-
ING TO A NATURAL PERSON RESIDING IN THIS STATE.
S 3. This act shall take effect on the ninetieth day after it shall
have become a law.