NY State Senate Bill 2009-S1854

Senate Bill S1854

2009-2010 Legislative Session

Enacts New York State Internet Privacy Law to which operators of websites may voluntarily be subject; limits disclosure of personal information to those submitting

download bill text pdf

Archive: Last Bill Status - Stricken

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 11, 2010	recommit, enacting clause stricken
Jan 06, 2010	referred to consumer protection
Feb 09, 2009	referred to consumer protection

2009-S1854 (ACTIVE) - Details

See Assembly Version of this Bill:: A5152
Law Section:: General Business Law
Laws Affected:: Ren Art 40 §§900 & 901 to be Art 41 §§1000 & 1001, add Art 40 §§900 - 907, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2011-2012: A4985
2013-2014: A4939

2009-S1854 (ACTIVE) - Summary

Enacts New York State Internet Privacy Law to which operators of websites may voluntarily be subject; limits disclosure of personal information to those submitting to the law by publicizing that they comply with such law; provides for enforcement.

2009-S1854 (ACTIVE) - Sponsor Memo

                                 BILL NUMBER:  S1854

 TITLE OF BILL :

An act to amend the general business law, in relation to protecting
the privacy of internet users


 PURPOSE OR GENERAL IDEA OF BILL :

To create a New York State Internet Privacy Law with rigorous privacy
rules, which New York State could enforce against web site operators
who hold out to the public that they comply with the law.

 SUMMARY OF SPECIFIC PROVISIONS :

Section one is the bill's short title: the New York State Internet
Privacy Law. Section two contains legislative findings. Section three
continues the substance of the law, including definitions,
applicability, disclosure rules, third parties' obligations,
inspection rights, and enforcement provisions. Section four sets the
law's effective date.

 JUSTIFICATION :

Privacy is a major concern of Internet users. Surveys regularly report

that the lack of privacy is the most significant factor inhibiting
potential customers from engaging in on-line transactions. When
Internet use first took off, most users thought that their activity
could be done anonymously. At this point, most people are at least
somewhat aware that Internet use is not private. The typical Internet
user leaves detailed trail of personal information on what subjects
interest them, what they might buy, and who they correspond with.
That detailed personal information is bought and sold as commodity.
But, the specifics as to what information is collected, and who gets
the information, remain largely a mystery.

Most responsible companies doing business on the Internet recognize
the importance of privacy protection. Many have established privacy
policies, and some participate in self-regulatory schemes. The
difficulty with self-regulatory plans is that they are not
enforceable. Neither federal nor state law protects privacy of
Internet use. The borderless nature of the Internet, and concomitant
jurisdictional problems, have been problematic for states interested
in protecting Internet privacy.

The key element of the instant bill is that it applies only to a web
business that chooses to hold out to the public that it complies with
the privacy law. In doing so, the business would be effectively
submitting itself to New York State's jurisdiction, and the first
enforceable Internet privacy law in the United States. Internet users'
privacy would be protected by meaningful enforcement mechanisms. And,
businesses would benefit by potential customers feeling secure enough
to conduct business with them. Consumer choices would, for the first
time, include protecting their privacy with a clearly enforceable law.
The law's substantive privacy rules would be strong, and in line with
generally accepted principles of privacy protection, including notice,
and personal control of information.  Third parties which receive
information would also have to comply with this law. Enforcement would
be by Attorney General action, or by private lawsuits.

 PRIOR LEGISLATIVE HISTORY :
2000: A.9401-A (Parment) - Passed Assembly.
2001: A.5789 (Stringer)  - Held in Rules Committee.
2002: A.5789 (Stringer) - Referred to Consumers.
2004: A.4385 (Klein) - Referred to Consumers.
2006: S.4597 - Referred to Consumer Protection.
2008: S.2227 - Referred to Consumer Protection.

 FISCAL IMPLICATIONS :

None.

 EFFECTIVE DATE :
180 days succeeding enactment.

2009-S1854 (ACTIVE) - Bill Text download pdf

                            
                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  1854

                       2009-2010 Regular Sessions

                            I N  S E N A T E

                            February 9, 2009
                               ___________

Introduced  by  Sen.  KLEIN  -- read twice and ordered printed, and when
  printed to be committed to the Committee on Consumer Protection

AN ACT to amend the general business law, in relation to protecting  the
  privacy of internet users

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. Short title. This act shall be known and may  be  cited  as
"New York state internet privacy law".
  S 2. Legislative intent. 1. The legislature finds that the internet is
becoming a major part of the personal and commercial lives of Americans.
The  internet brings with it much good, such as increased personal know-
ledge and communications, and increased and  more  efficient  commercial
opportunities.
  2. The privacy of personal information flowing over the internet is of
concern.  Vast amounts of personal information about individual internet
users are collected on the internet and sold or otherwise transferred to
third parties. Polls consistently show that  individual  internet  users
are  highly  troubled  over  their  lack  of control over their personal
information. In fact, concern  over  personal  privacy  is  one  of  the
biggest  factors holding back even greater commercial development of the
internet.
  3. The right to privacy is a personal and fundamental right worthy  of
protection  through  appropriate  legislation.    Industry has developed
several self-policing schemes, but none of them  are  enforceable  in  a
meaningful  way.    Meaningful, enforceable internet privacy rules would
protect New York citizens and would  foster  the  growth  of  electronic
commerce in New York.
  4.  The legislature intends to establish strong privacy rules to which
an operator of a website or online service  may  voluntarily  choose  to
submit.    The  incentive for the operator to submit will be that it may
publicize that it complies with the New York state internet privacy law.

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD02645-01-9

S. 1854                             2

Any operator who does so advertise may  be  subject  to  an  enforcement
action.
  S  3. Article 40 and sections 900 and 901 of the general business law,
as renumbered by chapter 407 of the laws of 1973, are renumbered article
41 and sections 1000 and 1001 and a new article 40 is added to  read  as
follows:
                                ARTICLE 40
                   NEW YORK STATE INTERNET PRIVACY LAW
SECTION 900. DEFINITIONS.
        901. APPLICABILITY OF ARTICLE.
        902. DISCLOSURE OF PERSONAL INFORMATION.
        903. THIRD PARTIES.
        904. USER'S RIGHT TO INSPECT AND CORRECT INFORMATION.
        905. DURATION OF OPERATOR'S RESPONSIBILITY.
        906. ENFORCEMENT.
        907. SEPARABILITY CLAUSE.
  S 900. DEFINITIONS. AS USED IN THIS ARTICLE:
  1.  THE  TERM "INTERNET" MEANS COLLECTIVELY THE MYRIAD OF COMPUTER AND
TELECOMMUNICATIONS FACILITIES, INCLUDING EQUIPMENT AND  OPERATING  SOFT-
WARE,  WHICH  COMPRISE THE INTERCONNECTED WORLD-WIDE NETWORK OF NETWORKS
THAT EMPLOY THE TRANSMISSION CONTROL PROTOCOL/INTERNET PROTOCOL, OR  ANY
PREDECESSOR  OR  SUCCESSOR  PROTOCOLS  TO  SUCH PROTOCOL, TO COMMUNICATE
INFORMATION OF ALL KINDS BY WIRE OR RADIO.
  2. THE TERM "OPERATOR" MEANS ANY PERSON WHO OPERATES A WEBSITE LOCATED
ON THE INTERNET OR AN ONLINE  SERVICE  AND  WHO  COLLECTS  OR  MAINTAINS
PERSONAL  INFORMATION  FROM  OR  ABOUT  THE USERS OF OR VISITORS TO SUCH
WEBSITE OR ONLINE SERVICE,  OR  ON  WHOSE  BEHALF  SUCH  INFORMATION  IS
COLLECTED  OR  MAINTAINED, WHERE SUCH WEBSITE OR ONLINE SERVICE IS OPER-
ATED FOR COMMERCIAL PURPOSES, INCLUDING ANY PERSON OFFERING PRODUCTS  OR
SERVICES  FOR  SALE  THROUGH  THAT  WEBSITE OR ONLINE SERVICE, INVOLVING
COMMERCE.
  3. THE TERM "USER" MEANS A PERSON WHO USES AN ONLINE SERVICE OR VISITS
A WEBSITE.
  4. THE TERM "PERSONAL  INFORMATION"  MEANS  INDIVIDUALLY  IDENTIFIABLE
INFORMATION ABOUT AN INDIVIDUAL COLLECTED ONLINE, INCLUDING:
  (A) A FIRST AND LAST NAME;
  (B) A HOME OR OTHER PHYSICAL ADDRESS INCLUDING STREET NAME AND NAME OF
A CITY OR TOWN;
  (C) AN E-MAIL ADDRESS;
  (D) A TELEPHONE NUMBER;
  (E) A SOCIAL SECURITY NUMBER;
  (F)  ANY OTHER IDENTIFIER THAT PERMITS THE PHYSICAL OR ONLINE CONTACT-
ING OF A SPECIFIC INDIVIDUAL; OR
  (G) INFORMATION CONCERNING A CHILD OR THE PARENTS OF THAT  CHILD  THAT
THE  OPERATOR  COLLECTS  ONLINE FROM THE CHILD AND COMBINES WITH ANOTHER
IDENTIFIER SET FORTH IN THIS SUBDIVISION.
  5. THE TERM "DISCLOSURE" MEANS, WITH RESPECT TO PERSONAL INFORMATION:
  (A) THE RELEASE OF PERSONAL INFORMATION COLLECTED IN IDENTIFIABLE FORM
BY AN OPERATOR  FOR  ANY  PURPOSE,  EXCEPT  WHERE  SUCH  INFORMATION  IS
PROVIDED  TO  A  PERSON OTHER THAN THE OPERATOR WHO PROVIDES SUPPORT FOR
THE INTERNAL OPERATIONS OF THE WEBSITE AND DOES NOT DISCLOSE OR USE THAT
INFORMATION FOR ANY OTHER PURPOSE; AND
  (B) MAKING PERSONAL INFORMATION COLLECTED FROM A CHILD BY A WEBSITE OR
ONLINE SERVICE DIRECTED TO CHILDREN OR WITH ACTUAL KNOWLEDGE  THAT  SUCH
INFORMATION  WAS COLLECTED FROM A CHILD, PUBLICLY AVAILABLE IN IDENTIFI-

S. 1854                             3

ABLE FORM, BY ANY MEANS INCLUDING  BY  A  PUBLIC  POSTING,  THROUGH  THE
INTERNET, OR THROUGH:
  (I) A HOME PAGE OF A WEBSITE;
  (II) A PEN PAL SERVICE;
  (III) AN ELECTRONIC MAIL SERVICE;
  (IV) A MESSAGE BOARD; OR
  (V) A CHAT ROOM.
  6.  THE  TERM  "THIRD PARTY" MEANS A PERSON OTHER THAN THE USER OR THE
OPERATOR, OR AN EMPLOYEE OF THE OPERATOR.
  S 901. APPLICABILITY OF ARTICLE. AN OPERATOR IS SUBJECT TO THIS  ARTI-
CLE  IF IT ADVERTISES OR OTHERWISE PUBLICLY STATES THAT IT COMPLIES WITH
THE "NEW YORK STATE INTERNET PRIVACY LAW".
  S 902. DISCLOSURE OF PERSONAL INFORMATION. 1. AN  OPERATOR  SHALL  NOT
DISCLOSE  TO  A  THIRD  PARTY  ANY  PERSONALLY  IDENTIFIABLE INFORMATION
OBTAINED FROM A USER WITHOUT  THE  USER'S  PRIOR  INFORMED,  AFFIRMATIVE
WRITTEN CONSENT.
  2.  INFORMED CONSENT REQUIRES THAT THE OPERATOR NOTIFY THE USER OF THE
IDENTITY OF ANY THIRD PARTY WHICH  WILL  RECEIVE  HIS  OR  HER  PERSONAL
INFORMATION, AND FOR WHAT PURPOSE THE INFORMATION WILL BE USED.
  3. INFORMED WRITTEN CONSENT MAY BE OBTAINED ONLY UPON NOTICE TO A USER
OF  HIS  OR  HER  RIGHTS UNDER THIS LAW. SUCH NOTICE MUST BE IN WRITING,
CLEAR AND CONSPICUOUS, AND IN PLAIN ENGLISH.
  4. AN OPERATOR SHALL PERMIT A PERSON TO  REVOKE  THE  CONSENT  GRANTED
UNDER SUBDIVISION ONE OF THIS SECTION AT ANY TIME, AND UPON SUCH REVOCA-
TION,  SUCH  OPERATOR SHALL CEASE DISCLOSING SUCH INFORMATION TO A THIRD
PARTY.
  5. AN OPERATOR OR AN EMPLOYEE OF SUCH  OPERATOR  SHALL  NOT  KNOWINGLY
DISCLOSE  TO  A  THIRD  PARTY  ANY  PERSONALLY  IDENTIFIABLE INFORMATION
PROVIDED BY A SUBSCRIBER TO SUCH SERVICE  THAT  SUCH  SERVICE,  OR  SUCH
EMPLOYEE, HAS KNOWINGLY FALSIFIED.
  6.  NOTWITHSTANDING THE PROVISIONS OF SUBDIVISION ONE OF THIS SECTION,
NEITHER AN OPERATOR NOR THE OPERATOR'S AGENT SHALL BE HELD TO BE  LIABLE
FOR  ANY  DISCLOSURE  MADE IN GOOD FAITH AND FOLLOWING REASONABLE PROCE-
DURES IN RESPONDING TO A REQUEST FOR DISCLOSURE OF PERSONAL  INFORMATION
UNDER THE FEDERAL CHILDREN'S ONLINE PRIVACY PROTECTION ACT TO THE PARENT
OF A CHILD.
  7.  NOTWITHSTANDING THE PROVISIONS OF SUBDIVISION ONE OF THIS SECTION,
AN OPERATOR MAY DISCLOSE PERSONAL INFORMATION,  WITHOUT  NOTICE  TO  THE
USER,  WHEN  NECESSARY  TO  RESPOND TO A COURT ORDER, SUBPOENA, OR OTHER
LEGAL PROCESS.
  S 903. THIRD PARTIES. 1. PRIOR TO DISCLOSING PERSONAL INFORMATION TO A
THIRD PARTY, AN OPERATOR SHALL INFORM THE THIRD PARTY OF THE  PROVISIONS
OF THIS ARTICLE, AND OBTAIN FROM THE THIRD PARTY A WRITTEN CERTIFICATION
THAT THE THIRD PARTY WILL COMPLY WITH THIS ARTICLE.
  2.  A THIRD PARTY WHICH RECEIVES PERSONAL INFORMATION PURSUANT TO THIS
ARTICLE MAY USE SUCH INFORMATION ONLY FOR THE PURPOSE OF WHICH THE  USER
HAS BEEN NOTIFIED.
  S  904.  USER'S  RIGHT  TO  INSPECT  AND  CORRECT INFORMATION. 1. UPON
REQUEST AN OPERATOR SHALL (A) PROVIDE A PERSON WITH HIS OR HER  PERSONAL
INFORMATION  MAINTAINED  BY  THE OPERATOR; (B) PERMIT THE USER TO VERIFY
SUCH INFORMATION MAINTAINED BY THE SERVICE; AND (C) PERMIT THE  USER  TO
CORRECT ANY ERROR IN SUCH INFORMATION.
  2. UPON REQUEST, AN OPERATOR SHALL PROVIDE TO THE USER THE IDENTITY OF
THE THIRD PARTY RECIPIENTS OF HIS OF HER PERSONAL INFORMATION.
  3.  AN  OPERATOR  SHALL NOT CHARGE A FEE FOR ONE ANNUAL REQUEST THAT A
PERSON MAKES FOR THE INFORMATION SET FORTH IN SUBDIVISION FOUR  OR  FIVE

S. 1854                             4

OF  SECTION  NINE  HUNDRED  OF THIS ARTICLE. FOR ADDITIONAL REQUESTS, AN
OPERATOR MAY CHARGE A FEE CONSISTING OF THE OPERATOR'S  ACTUAL  COST  OF
PROVIDING  THE  INFORMATION.  AN OPERATOR SHALL PROVIDE AN ABILITY FOR A
USER  TO ELECTRONICALLY REQUEST AND RECEIVE THE INFORMATION SET FORTH IN
THIS SECTION.
  S 905. DURATION OF OPERATOR'S RESPONSIBILITY. ANY PERSONAL INFORMATION
WHICH AN OPERATOR OBTAINS WITHIN THIRTY  DAYS  OF  THE  OPERATOR'S  LAST
ADVERTISEMENT  OR  PUBLIC STATEMENT PURSUANT TO SECTION NINE HUNDRED ONE
OF THIS ARTICLE SHALL BE SUBJECT TO THIS ARTICLE.
  S 906. ENFORCEMENT. 1. ANY PERSON FOUND TO HAVE VIOLATED THIS ARTICLE,
KNOWINGLY OR RECKLESSLY, SHALL BE LIABLE TO THE AGGRIEVED USER  FOR  ALL
ACTUAL  DAMAGES  SUSTAINED  BY  SUCH  USER  AS  A  DIRECT  RESULT OF THE
VIOLATION, PROVIDED THAT ANY SUBSCRIBER WHO  PREVAILS  OR  SUBSTANTIALLY
PREVAILS IN ANY ACTION BROUGHT UNDER THIS SECTION SHALL RECEIVE NOT LESS
THAN FIVE HUNDRED DOLLARS IN DAMAGES, REGARDLESS OF THE AMOUNT OF ACTUAL
DAMAGE PROVED, PLUS COSTS, DISBURSEMENTS AND REASONABLE ATTORNEY'S FEES.
AN  ACTION BROUGHT PURSUANT TO THIS SECTION MAY BE MAINTAINED AS A CLASS
ACTION.
  2. WHENEVER THERE SHALL BE A VIOLATION OF THIS ARTICLE, AN APPLICATION
MAY BE MADE BY THE ATTORNEY GENERAL IN THE NAME OF  THE  PEOPLE  OF  THE
STATE OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION BY A SPECIAL
PROCEEDING  TO  ISSUE AN INJUNCTION, AND UPON NOTICE TO THE DEFENDANT OF
NOT LESS THAN FIVE DAYS, TO ENJOIN AND RESTRAIN THE CONTINUATION OF SUCH
VIOLATION; AND IF IT SHALL APPEAR TO THE SATISFACTION OF  THE  COURT  OR
JUSTICE  THAT  THE  DEFENDANT  HAS,  IN  FACT, VIOLATED THIS ARTICLE, AN
INJUNCTION MAY BE  ISSUED  BY  SUCH  COURT  OR  JUSTICE,  ENJOINING  AND
RESTRAINING  ANY  FURTHER  VIOLATION,  WITHOUT  REQUIRING PROOF THAT ANY
PERSON HAS, IN FACT, BEEN  INJURED  OR  DAMAGED  THEREBY.  IN  ANY  SUCH
PROCEEDING,  THE  COURT  MAY  MAKE ALLOWANCES TO THE ATTORNEY GENERAL AS
PROVIDED IN PARAGRAPH SIX OF SUBDIVISION  (A)  OF  SECTION  EIGHTY-THREE
HUNDRED  THREE  OF  THE CIVIL PRACTICE LAW AND RULES AND DIRECT RESTITU-
TION. WHENEVER THE  COURT  SHALL  DETERMINE  THAT  A  GROSSLY  NEGLIGENT
VIOLATION  OF  THIS  ARTICLE  HAS OCCURRED, THE COURT MAY IMPOSE A CIVIL
PENALTY OF NOT MORE THAN ONE THOUSAND DOLLARS  FOR  SUCH  VIOLATION.  IN
CONNECTION  WITH  ANY SUCH PROPOSED APPLICATION, THE ATTORNEY GENERAL IS
AUTHORIZED TO TAKE PROOF AND MAKE A DETERMINATION OF THE RELEVANT  FACTS
AND  TO  ISSUE  SUBPOENAS  IN ACCORDANCE WITH THE CIVIL PRACTICE LAW AND
RULES.
  3. THE REMEDIES PROVIDED BY THIS ARTICLE SHALL BE IN ADDITION  TO  ANY
OTHER LAWFUL REMEDY AVAILABLE TO A SUBSCRIBER.
  4.  NO  ACTION  MAY  BE  BROUGHT  UNDER THE PROVISIONS OF THIS SECTION
UNLESS SUCH ACTION IS COMMENCED WITHIN THE TWO YEARS FROM  THE  DATE  OF
THE ACT COMPLAINED OF OR THE DATE OF DISCOVERY OF SUCH ACT.
  S  907. SEPARABILITY CLAUSE. IF ANY CLAUSE, PARAGRAPH, SECTION OR PART
OF THIS ARTICLE SHALL BE ADJUDGED BY ANY COURT OF COMPETENT JURISDICTION
TO BE INVALID OR  UNCONSTITUTIONAL,  SUCH  JUDGMENT  SHALL  NOT  AFFECT,
IMPAIR OR INVALIDATE THE REMAINDER THEREOF, BUT SHALL BE CONFINED IN ITS
OPERATION  TO  THE  CLAUSE, SENTENCE, PARAGRAPH, SECTION OR PART THEREOF
DIRECTLY INVOLVED IN THE CONTROVERSY IN WHICH SUCH JUDGMENT  SHALL  HAVE
BEEN RENDERED.
  S 4. This act shall take effect on the one hundred eightieth day after
it shall have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.