Assembly Bill A845

                            
                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                   845

                       2011-2012 Regular Sessions

                          I N  A S S E M B L Y

                               (PREFILED)

                             January 5, 2011
                               ___________

Introduced by M. of A. PHEFFER, MAISEL, REILLY, M. MILLER, HIKIND, MILL-
  MAN,  DINOWITZ, ZEBROWSKI, P. RIVERA, GALEF, HOOPER -- Multi-Sponsored
  by -- M. of A. ABBATE, CRESPO, DESTITO,  GABRYSZAK,  GLICK,  V. LOPEZ,
  MAYERSOHN,  McENENY,  SCHIMEL,  SWEENEY,  WEISENBERG  -- read once and
  referred to the Committee on Consumer Affairs and Protection

AN ACT to amend the general business law  and  the  correction  law,  in
  relation to the processing of personal identifying information

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. The general business law is amended by adding a new section
392-j to read as follows:
  S 392-J. PROCESSING PERSONAL IDENTIFYING INFORMATION; PROHIBITIONS. 1.
DEFINITIONS. AS USED IN THIS SECTION:
  (A) "INMATE" MEANS AN OFFENDER WHO IS COMMITTED UNDER SENTENCE  TO  OR
CONFINED  IN  A  PENAL  OR  CORRECTIONAL  INSTITUTION, INCLUDING BUT NOT
LIMITED TO A FACILITY FOR THE MENTALLY ILL OR MENTALLY DEFECTIVE.
  (B) "DATA SUBJECT" SHALL MEAN A NATURAL PERSON RESIDING IN THIS STATE.
  (C) "PERSONAL INFORMATION" SHALL MEAN  ANY  INFORMATION  CONCERNING  A
NATURAL  PERSON  WHICH, BECAUSE OF NAME, NUMBER, PERSONAL MARK, OR OTHER
IDENTIFIER, CAN BE USED TO IDENTIFY SUCH NATURAL PERSON.
  (D) "PERSONAL IDENTIFYING INFORMATION" SHALL MEAN PERSONAL INFORMATION
CONSISTING OF ANY INFORMATION IN COMBINATION WITH ANY ONE OR MORE OF THE
FOLLOWING DATA ELEMENTS, WHEN EITHER THE  PERSONAL  INFORMATION  OR  THE
DATA  ELEMENT IS NOT ENCRYPTED, OR ENCRYPTED WITH AN ENCRYPTION KEY THAT
IS INCLUDED IN THE SAME RECORD AS THE ENCRYPTED PERSONAL INFORMATION  OR
DATA ELEMENT:
  (1) SOCIAL SECURITY NUMBER;
  (2)  DRIVER'S  REGISTRATION  NUMBER  OR NON-DRIVER IDENTIFICATION CARD
NUMBER; OR

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD01066-01-1
              

A. 845                              2

  (3) MOTHER'S MAIDEN NAME, FINANCIAL SERVICES ACCOUNT NUMBER  OR  CODE,
SAVINGS  ACCOUNT  NUMBER OR CODE, CHECKING ACCOUNT NUMBER OR CODE, DEBIT
CARD NUMBER OR CODE, AUTOMATED TELLER MACHINE NUMBER OR CODE, ELECTRONIC
SERIAL NUMBER OR PERSONAL IDENTIFICATION NUMBER.
  (E)  "PERSONAL  IDENTIFICATION  NUMBER"  SHALL MEAN ANY NUMBER OR CODE
WHICH MAY BE USED ALONE OR IN CONJUNCTION WITH ANY OTHER INFORMATION  TO
ASSUME  THE  IDENTITY OF ANOTHER PERSON OR ACCESS FINANCIAL RESOURCES OR
CREDIT OF ANOTHER PERSON.
  2. NOTWITHSTANDING ANY OTHER PROVISION OF LAW, NO PERSON, FIRM,  PART-
NERSHIP,  ASSOCIATION,  OR  CORPORATION SHALL KNOWINGLY USE THE LABOR OR
TIME OF ANY INMATE IN THIS STATE,  OR  IN  ANY  OTHER  JURISDICTION,  TO
ENGAGE  IN  WHOLE OR IN PART IN OBTAINING ACCESS TO, COLLECTING OR PROC-
ESSING PERSONAL IDENTIFYING INFORMATION PERTAINING TO A DATA SUBJECT  IN
THIS STATE.
  3.  A  VIOLATION OF THE PROVISIONS OF THIS SECTION SHALL BE PUNISHABLE
BY A CIVIL PENALTY OF NOT MORE THAN ONE THOUSAND  FIVE  HUNDRED  DOLLARS
FOR  THE  FIRST  VIOLATION  AND  NOT MORE THAN TWO THOUSAND FIVE HUNDRED
DOLLARS FOR A SECOND OR SUBSEQUENT VIOLATION.
  S 2. Subdivision 1 of section 170 of the correction law, as amended by
chapter 166 of the laws of 1991, is amended to read as follows:
  1. The commissioner [of correctional services] shall  not,  nor  shall
any  other authority whatsoever, make any contract by which the labor or
time of any inmate in any state or local correctional facility  in  this
state,  or  the product or profit of his work, shall be contracted, let,
farmed out, given or sold to any person,  firm,  association  or  corpo-
ration;  except  that  the inmates in said correctional institutions may
work for, and the products of their labor may be  disposed  of  to,  the
state or any political subdivision thereof, any public institution owned
or  managed  and  controlled  by the state, or any political subdivision
thereof, PROVIDED THAT NO INMATE IN  ANY  STATE  OR  LOCAL  CORRECTIONAL
FACILITY  SHALL  ENGAGE  IN  WHOLE  OR  IN  PART IN OBTAINING ACCESS TO,
COLLECTING OR PROCESSING PERSONAL IDENTIFYING INFORMATION, AS DEFINED IN
SECTION THREE HUNDRED NINETY-TWO-J OF THE GENERAL BUSINESS LAW, PERTAIN-
ING TO A NATURAL PERSON RESIDING IN THIS STATE.
  S 3. This act shall take effect on the ninetieth day  after  it  shall
have become a law.