S T A T E O F N E W Y O R K
________________________________________________________________________
9480--A
I N A S S E M B L Y
May 1, 2014
___________
Introduced by M. of A. DINOWITZ, GOTTFRIED, ROSENTHAL, GALEF, MILLMAN,
CRESPO, CAHILL, JAFFEE, BRAUNSTEIN, ROBINSON, CLARK, COOK, MAYER,
OTIS, ABINANTI, COLTON, GUNTHER, STECK, RAIA, LUPINACCI, SKOUFIS --
Multi-Sponsored by -- M. of A. ARROYO, BRENNAN, CAMARA, CROUCH,
DUPREY, HIKIND, MAGEE, McLAUGHLIN, RIVERA, SCHIMEL, SKARTADOS, TITONE,
WEISENBERG, WRIGHT -- read once and referred to the Committee on
Consumer Affairs and Protection -- reported and referred to the
Committee on Codes -- committee discharged, bill amended, ordered
reprinted as amended and recommitted to said committee
AN ACT to amend the general business law, in relation to providing
consumers with certain information disclosed by businesses
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Legislative intent. The legislature hereby finds and
declares that technological advances have allowed businesses of all
sizes and varieties to collect and maintain customer data with increas-
ing ease. The legislature further finds that the data being collected
and maintained is often personal in nature, and can be used by busi-
nesses for direct marketing purposes or for gaining an understanding of
consumer behavior. The legislature further finds that some businesses,
unbeknownst to their customers, sell or have sold their customers'
personal information to third party entities, including data brokers.
The legislature finds this type of information sharing to be a potential
invasion of privacy and a tool that may be used by the unscrupulous to
commit fraud and identity theft crimes, which are plaguing our state.
Further, the legislature finds that the issues surrounding the sharing
of personal information are compounded by the absence of a mechanism
whereby consumers can discover if and what personal information is being
sold.
Therefore, it is the intent of the legislature to provide consumers
with the "right to know" whether a business with which they have an
established business relationship is sharing their personal information,
the nature of the information that is being shared, and with whom the
information is being shared. By providing consumers with the ability to
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD13351-07-4
A. 9480--A 2
know if a business is sharing their information and with whom their
information is being shared, New Yorkers will be afforded the opportu-
nity to make more informed and educated marketplace decisions.
S 2. Short title. This act shall be known and may be cited as the "New
York state consumers' right to know law".
S 3. The general business law is amended by adding a new section 391-t
to read as follows:
S 391-T. CONSUMER PRIVACY DISCLOSURE. 1. FOR THE PURPOSES OF THIS
SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
(A) "BUSINESS" MEANS ANY PERSON, FIRM, CORPORATION, LIMITED LIABILITY
COMPANY, PARTNERSHIP OR ASSOCIATION, PROVIDED, HOWEVER, THAT "BUSINESS"
DOES NOT MEAN OR INCLUDE:
(I) ANY CHARITABLE ORGANIZATION REGISTERED PURSUANT TO SECTION ONE
HUNDRED SEVENTY-TWO OF THE EXECUTIVE LAW;
(II) ANY RELIGIOUS CORPORATION AS DEFINED IN SECTION TWO OF THE RELI-
GIOUS CORPORATIONS LAW;
(III) ANY PARTY AS DEFINED IN SUBDIVISION THREE OF SECTION 1-104 OF
THE ELECTION LAW;
(IV) ANY POLITICAL COMMITTEE AS DEFINED IN SUBDIVISION ONE OF SECTION
14-100 OF THE ELECTION LAW;
(V) ORGANIZATIONS THAT ARE CLASSIFIED AS CHARITABLE ORGANIZATIONS
UNDER SECTION 501 (C) (3) OF THE U.S. INTERNAL REVENUE CODE.
(B) (I) "CATEGORIES OF PERSONAL INFORMATION" SHALL INCLUDE:
(1) NAME AND ADDRESS;
(2) ELECTRONIC MAIL OR INTERNET PROTOCOL ADDRESS;
(3) AGE OR DATE OF BIRTH;
(4) NAMES OF CHILDREN;
(5) ELECTRONIC MAIL OR OTHER ADDRESSES OF CHILDREN;
(6) NUMBER OF CHILDREN;
(7) THE AGE OR GENDER OF CHILDREN;
(8) HEIGHT;
(9) WEIGHT;
(10) RACE;
(11) RELIGION;
(12) OCCUPATION;
(13) SEXUAL ORIENTATION OR GENDER IDENTITY INFORMATION;
(14) TELEPHONE NUMBER;
(15) EDUCATION;
(16) POLITICAL PARTY AFFILIATION;
(17) MEDICAL CONDITION;
(18) DRUGS, THERAPIES, OR MEDICAL PRODUCTS OR EQUIPMENT USED;
(19) THE KIND OF PRODUCT THE CUSTOMER PURCHASED, LEASED, OR RENTED;
(20) REAL PROPERTY PURCHASED, LEASED, RENTED, OR SOLD;
(21) THE KIND OF SERVICE PROVIDED;
(22) SOCIAL SECURITY NUMBER OR OTHER GOVERNMENT-ISSUED IDENTIFICATION
NUMBER;
(23) DRIVER'S LICENSE NUMBER;
(24) BANK ACCOUNT NUMBER;
(25) CREDIT CARD NUMBER;
(26) DEBIT CARD NUMBER;
(27) BANK OR INVESTMENT ACCOUNT, DEBIT CARD, OR CREDIT CARD BALANCE;
(28) PAYMENT HISTORY;
(29) INFORMATION PERTAINING TO THE CONSUMER'S CREDITWORTHINESS,
ASSETS, INCOME, OR LIABILITIES.
(II) IF A LIST, DESCRIPTION, OR GROUPING OF CONSUMER NAMES OR
ADDRESSES IS DERIVED USING ANY OF THESE CATEGORIES, AND IS DISCLOSED TO
A. 9480--A 3
A THIRD PARTY FOR DIRECT MARKETING PURPOSES IN A MANNER THAT ALLOWS THE
THIRD PARTY TO IDENTIFY, DETERMINE, OR EXTRAPOLATE ANY OTHER PERSONAL
INFORMATION FROM WHICH THE LIST WAS DERIVED, AND THAT PERSONAL INFORMA-
TION WHEN IT WAS DISCLOSED IDENTIFIED, DESCRIBED, OR WAS ASSOCIATED WITH
AN INDIVIDUAL, THE CATEGORIES SET FORTH IN THIS PARAGRAPH THAT CORRE-
SPOND TO THE PERSONAL INFORMATION USED TO DERIVE THE LIST, DESCRIPTION,
OR GROUPING SHALL BE CONSIDERED PERSONAL INFORMATION FOR PURPOSES OF
THIS SECTION.
(C) "CONSUMER" MEANS AN INDIVIDUAL WHO PROVIDES PERSONAL INFORMATION
TO A BUSINESS, WITH OR WITHOUT AN EXCHANGE OF CONSIDERATION, IN THE
COURSE OF PURCHASING, VIEWING, ACCESSING, RENTING, LEASING, OR OTHERWISE
USING REAL OR PERSONAL PROPERTY, OR ANY INTEREST THEREIN, OR OBTAINING A
PRODUCT OR SERVICE FROM A BUSINESS INCLUDING, BUT NOT LIMITED TO, ADVER-
TISING OR ANY OTHER CONTENT.
(D) "DEPARTMENT" MEANS THE DEPARTMENT OF STATE.
(E) "SECRETARY" MEANS THE SECRETARY OF STATE.
(F) "DESIGNATED REQUEST ADDRESS" MEANS A MAILING ADDRESS, EMAIL
ADDRESS, WEB PAGE, TOLL-FREE TELEPHONE NUMBER, OR OTHER APPLICABLE
CONTACT INFORMATION, WHEREBY CONSUMERS MAY REQUEST AND OBTAIN THE INFOR-
MATION REQUIRED TO BE PROVIDED UNDER SUBDIVISION TWO OF THIS SECTION. A
BUSINESS MAY DEVELOP PROCEDURES INVOLVING OTHER SECURE METHODS OF COMMU-
NICATION, INCLUDING THE USE OF THE INTERNET, OR OTHER ELECTRONIC MEDIA
TO RECEIVE AND PROCESS A REQUEST FROM A CONSUMER.
(G) "DIRECT MARKETING PURPOSE" MEANS THE USE OF PERSONAL INFORMATION
TO SOLICIT OR INDUCE A PURCHASE, RENTAL, LEASE, OR EXCHANGE OF PRODUCTS,
GOODS, PROPERTY, OR SERVICES DIRECTLY TO INDIVIDUALS BY MEANS OF THE
MAIL, TELEPHONE, OR ELECTRONIC MAIL FOR THEIR PERSONAL, FAMILY, OR
HOUSEHOLD PURPOSES. THE SALE, RENTAL, EXCHANGE, OR LEASE OF PERSONAL
INFORMATION FOR CONSIDERATION TO BUSINESSES IS A DIRECT MARKETING
PURPOSE OF THE BUSINESS THAT SELLS, RENTS, EXCHANGES, OR OBTAINS CONSID-
ERATION FOR THE PERSONAL INFORMATION.
(H) "DISCLOSE" MEANS TO DISCLOSE, RELEASE, SHARE, TRANSFER, DISSEM-
INATE, MAKE AVAILABLE, OR OTHERWISE COMMUNICATE ORALLY, IN WRITING, OR
BY ELECTRONIC OR ANY OTHER MEANS TO ANY THIRD PARTY, PROVIDED, HOWEVER,
THAT "DISCLOSE" DOES NOT MEAN OR INCLUDE:
(I) DISCLOSURES BETWEEN A BUSINESS AND A THIRD PARTY PURSUANT TO
CONTRACTS OR ARRANGEMENTS PERTAINING TO ANY OF THE FOLLOWING:
(1) THE PROCESSING, STORAGE, MANAGEMENT, OR ORGANIZATION OF PERSONAL
INFORMATION, OR THE PERFORMANCE OF SERVICES ON BEHALF OF THE BUSINESS
DURING WHICH PERSONAL INFORMATION IS DISCLOSED, IF THE THIRD PARTY THAT
PROCESSES, STORES, MANAGES, OR ORGANIZES THE PERSONAL INFORMATION DOES
NOT USE THE INFORMATION FOR A THIRD PARTY'S DIRECT MARKETING PURPOSES
AND DOES NOT DISCLOSE THE INFORMATION TO ADDITIONAL THIRD PARTIES FOR
THEIR DIRECT MARKETING PURPOSES;
(2) MARKETING PRODUCTS OR SERVICES TO CONSUMERS WITH WHOM THE BUSINESS
HAS AN ESTABLISHED BUSINESS RELATIONSHIP WHERE, AS PART OF MARKETING,
THE BUSINESS DOES NOT DISCLOSE PERSONAL INFORMATION TO THIRD PARTIES FOR
THE THIRD PARTIES' DIRECT MARKETING PURPOSES;
(3) MAINTAINING OR SERVICING OF ACCOUNTS, INCLUDING CREDIT ACCOUNTS
AND DISCLOSURES PERTAINING TO THE DENIAL OF APPLICATIONS FOR CREDIT OR
THE STATUS OF APPLICATIONS FOR CREDIT AND PROCESSING BILLS OR INSURANCE
CLAIMS FOR PAYMENT;
(4) PUBLIC RECORD INFORMATION RELATING TO THE RIGHT, TITLE, OR INTER-
EST IN REAL PROPERTY OR INFORMATION RELATING TO PROPERTY CHARACTERISTICS
OBTAINED FROM A GOVERNMENT AGENCY OR ENTITY FROM A MULTIPLE LISTING
A. 9480--A 4
SERVICE AND NOT PROVIDED DIRECTLY BY THE CONSUMER TO A BUSINESS IN THE
COURSE OF AN ESTABLISHED BUSINESS RELATIONSHIP;
(5) JOINTLY OFFERING A PRODUCT OR SERVICE PURSUANT TO A WRITTEN AGREE-
MENT WITH THE THIRD PARTY THAT RECEIVES THE PERSONAL INFORMATION,
PROVIDED THAT ALL OF THE FOLLOWING REQUIREMENTS ARE MET:
(I) THE PRODUCT OR SERVICE OFFERED IS A PRODUCT OR SERVICE OF, AND IS
PROVIDED BY, AT LEAST ONE OF THE BUSINESSES THAT IS PARTY TO THE WRITTEN
AGREEMENT;
(II) THE PRODUCT OR SERVICE IS JOINTLY OFFERED, ENDORSED, SPONSORED
BY, AND CLEARLY AND CONSPICUOUSLY IDENTIFIES FOR THE CONSUMER, THE BUSI-
NESSES THAT DISCLOSE AND RECEIVE THE DISCLOSED PERSONAL INFORMATION;
(III) THE WRITTEN AGREEMENT PROVIDES THAT THE THIRD PARTY THAT
RECEIVES THE PERSONAL INFORMATION IS REQUIRED TO MAINTAIN THE CONFIDEN-
TIALITY OF THE INFORMATION AND IS PROHIBITED FROM DISCLOSING OR USING
THE INFORMATION OTHER THAN TO CARRY OUT THE JOINT OFFERING OR SERVICING
OF A PRODUCT OR SERVICE THAT IS SUBJECT TO THE WRITTEN AGREEMENT.
(II) DISCLOSURES TO OR FROM A CONSUMER REPORTING AGENCY OF A CONSUM-
ER'S PAYMENT HISTORY OR OTHER INFORMATION PERTAINING TO TRANSACTIONS OR
EXPERIENCES BETWEEN THE BUSINESS AND A CONSUMER IF THAT INFORMATION IS
TO BE REPORTED IN, OR USED TO GENERATE, A CONSUMER REPORT, AND USE OF
THAT INFORMATION IS LIMITED BY THE FEDERAL FAIR CREDIT REPORTING ACT (15
U.S.C. SEC 1681 ET SEQ.) AS MAY BE AMENDED FROM TIME TO TIME;
(III) DISCLOSURES OF PERSONAL INFORMATION BY A BUSINESS TO A THIRD
PARTY FINANCIAL INSTITUTION SOLELY FOR THE PURPOSE OF THE BUSINESS
OBTAINING PAYMENT FOR A TRANSACTION IN WHICH THE CONSUMER PAID THE BUSI-
NESS FOR GOODS OR SERVICES WITH A CHECK, CREDIT CARD, CHARGE CARD, OR
DEBIT CARD WHETHER OR NOT THE BUSINESS OBTAINING PAYMENT KNOWS OR
REASONABLY SHOULD KNOW THAT THE THIRD PARTY FINANCIAL INSTITUTION HAS
USED THE PERSONAL INFORMATION FOR ITS DIRECT MARKETING PURPOSES;
(IV) DISCLOSURES OF PERSONAL INFORMATION BETWEEN A LICENSED AGENT AND
ITS PRINCIPAL, IF THE PERSONAL INFORMATION DISCLOSED IS NECESSARY TO
COMPLETE, EFFECTUATE, ADMINISTER, OR ENFORCE TRANSACTIONS BETWEEN THE
PRINCIPAL AND THE AGENT, WHETHER OR NOT THE LICENSED AGENT OR PRINCIPAL
ALSO USES THE PERSONAL INFORMATION FOR DIRECT MARKETING PURPOSES, IF
THAT PERSONAL INFORMATION IS USED BY EACH OF THEM SOLELY TO MARKET
PRODUCTS AND SERVICES DIRECTLY TO CONSUMERS WITH WHOM BOTH HAVE ESTAB-
LISHED BUSINESS RELATIONSHIPS AS A RESULT OF THE PRINCIPAL AND AGENT
RELATIONSHIP; OR
(V) DISCLOSURES OF PERSONAL INFORMATION BETWEEN A FINANCIAL INSTITU-
TION AND A BUSINESS THAT HAS A PRIVATE LABEL CREDIT CARD, AFFINITY CARD,
RETAIL INSTALLMENT CONTRACT, OR COBRANDED CARD PROGRAM WITH THE FINAN-
CIAL INSTITUTION, IF THE PERSONAL INFORMATION DISCLOSED IS NECESSARY FOR
THE FINANCIAL INSTITUTION TO MAINTAIN OR SERVICE ACCOUNTS ON BEHALF OF
THE BUSINESS WITH WHICH IT HAS A PRIVATE LABEL CREDIT CARD, AFFINITY
CARD, RETAIL INSTALLMENT CONTRACT, OR COBRANDED CARD PROGRAM, OR TO
COMPLETE, EFFECTUATE, ADMINISTER, OR ENFORCE CONSUMER TRANSACTIONS OR
TRANSACTIONS BETWEEN THE INSTITUTION AND THE BUSINESS, WHETHER OR NOT
THE INSTITUTION OR THE BUSINESS ALSO USES THE PERSONAL INFORMATION FOR
DIRECT MARKETING PURPOSES, IF THAT PERSONAL INFORMATION IS USED SOLELY
TO MARKET PRODUCTS AND SERVICES DIRECTLY TO CONSUMERS WITH WHOM BOTH THE
BUSINESS AND THE FINANCIAL INSTITUTION HAVE ESTABLISHED BUSINESS
RELATIONSHIPS AS A RESULT OF THE PRIVATE LABEL CREDIT CARD, AFFINITY
CARD, RETAIL INSTALLMENT CONTRACT, OR COBRANDED CARD PROGRAM.
(I) "ESTABLISHED BUSINESS RELATIONSHIP" MEANS A RELATIONSHIP FORMED BY
A VOLUNTARY, TWO-WAY COMMUNICATION BETWEEN A BUSINESS AND A CONSUMER,
WITH OR WITHOUT AN EXCHANGE OF CONSIDERATION, FOR THE PURPOSE OF
A. 9480--A 5
PURCHASING, RENTING, LEASING OR SELLING REAL OR PERSONAL PROPERTY, OR
ANY INTEREST THEREIN, OR OBTAINING A PRODUCT OR SERVICE FROM THE BUSI-
NESS, IF THE RELATIONSHIP IS ONGOING AND HAS NOT BEEN EXPRESSLY TERMI-
NATED BY THE BUSINESS OR THE CONSUMER, OR IF THE RELATIONSHIP IS NOT
ONGOING, BUT IS SOLELY ESTABLISHED BY THE PURCHASE, RENTAL, LEASE OR
SALE OF REAL OR PERSONAL PROPERTY FROM A BUSINESS, OR THE PURCHASE OF A
PRODUCT OR SERVICE, AND NO MORE THAN EIGHTEEN MONTHS HAVE ELAPSED FROM
THE DATE OF THE PURCHASE, RENTAL, LEASE OR SALE.
(J) "EMPLOYEES WHO REGULARLY HAVE CONTACT WITH CONSUMERS" MEANS
EMPLOYEES WHOSE CONTACT WITH CONSUMERS IS NOT INCIDENTAL TO THEIR PRIMA-
RY EMPLOYMENT DUTIES, AND WHOSE DUTIES DO NOT PREDOMINANTLY INVOLVE
INSURING THE SAFETY OR HEALTH OF THE BUSINESS'S CONSUMERS INCLUDING, BUT
NOT LIMITED TO, EMPLOYEES WHOSE PRIMARY EMPLOYMENT DUTIES ARE AS CASH-
IER, CLERK, CUSTOMER SERVICE, SALES, OR PROMOTION. PROVIDED, HOWEVER,
"EMPLOYEES WHO REGULARLY HAVE CONTACT WITH CONSUMERS" DOES NOT INCLUDE
EMPLOYEES WHOSE PRIMARY EMPLOYMENT DUTIES CONSIST OF FOOD OR BEVERAGE
PREPARATION OR SERVICE, MAINTENANCE AND REPAIR OF THE BUSINESS'S FACILI-
TIES OR EQUIPMENT, DIRECT INVOLVEMENT IN THE OPERATION OF A MOTOR VEHI-
CLE, AIRCRAFT, WATERCRAFT, AMUSEMENT RIDE, HEAVY MACHINERY OR SIMILAR
EQUIPMENT, SECURITY, OR PARTICIPATION IN A THEATRICAL, LITERARY,
MUSICAL, ARTISTIC, OR ATHLETIC PERFORMANCE.
(K) "PERSONAL INFORMATION" MEANS:
(I) ANY INFORMATION THAT IDENTIFIES OR REFERENCES A PARTICULAR INDI-
VIDUAL INCLUDING ANY AND ALL OF THOSE DESCRIBED IN CLAUSES ONE THROUGH
TWENTY-NINE OF SUBPARAGRAPH (I) OF PARAGRAPH (B) OF THIS SUBDIVISION OR
ANY OTHER IDENTIFIER INTENDED OR ABLE TO BE UNIQUELY ASSOCIATED WITH A
PARTICULAR INDIVIDUAL;
(II) ANY INFORMATION THAT RELATES TO OR DESCRIBES AN INDIVIDUAL,
INCLUDING, BUT NOT LIMITED TO ANY AND ALL IN CLAUSES ONE THROUGH TWEN-
TY-NINE OF SUBPARAGRAPH (I) OF PARAGRAPH (B) OF THIS SUBDIVISION,
PROVIDED THAT SUCH INFORMATION DOES NOT INCLUDE PUBLICLY AVAILABLE
INFORMATION THAT IS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC FROM
FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS.
(L) "THIRD PARTY" OR "THIRD PARTIES" MEANS ONE OR MORE OF THE FOLLOW-
ING:
(I) A BUSINESS THAT IS A SEPARATE LEGAL ENTITY FROM THE BUSINESS THAT
HAS AN ESTABLISHED BUSINESS RELATIONSHIP WITH A CONSUMER;
(II) A BUSINESS NOT AFFILIATED BY A COMMON OWNERSHIP OR COMMON CORPO-
RATE CONTROL WITH THE BUSINESS THAT HAS DISCLOSED PERSONAL INFORMATION;
OR
(III) A BUSINESS THAT HAS ACCESS TO A DATABASE THAT IS SHARED AMONG
BUSINESSES, IF THE BUSINESS IS AUTHORIZED TO USE THE DATABASE FOR DIRECT
MARKETING PURPOSES, UNLESS THE USE OF THE DATABASE IS EXEMPT FROM BEING
CONSIDERED A DISCLOSURE FOR DIRECT MARKETING PURPOSES PURSUANT TO SUBDI-
VISION (H) OF THIS SECTION.
2. (A) EXCEPT AS OTHERWISE PROVIDED IN PARAGRAPH (B) OF THIS SUBDIVI-
SION, IF A BUSINESS HAS AN ESTABLISHED BUSINESS RELATIONSHIP WITH A
CONSUMER AND HAS WITHIN THE IMMEDIATELY PRECEDING CALENDAR YEAR
DISCLOSED PERSONAL INFORMATION THAT CORRESPONDS TO ANY OF THE CATEGORIES
OF PERSONAL INFORMATION SET FORTH IN SUBPARAGRAPH (I) OF PARAGRAPH (B)
OF SUBDIVISION ONE OF THIS SECTION TO THIRD PARTIES, AND IF THE BUSINESS
KNOWS OR REASONABLY SHOULD KNOW THAT THE THIRD PARTIES USED THE PERSONAL
INFORMATION FOR THE THIRD PARTIES' DIRECT MARKETING PURPOSES, THAT BUSI-
NESS SHALL, AFTER THE RECEIPT OF A WRITTEN OR ELECTRONIC MAIL REQUEST, A
TELEPHONE OR FACSIMILE REQUEST, OR BY ANOTHER SECURE METHOD OF COMMUNI-
A. 9480--A 6
CATION, INCLUDING THE USE OF THE INTERNET, FROM THE CONSUMER, PROVIDE
ALL OF THE FOLLOWING INFORMATION TO THE CONSUMER FREE OF CHARGE:
(I) IN WRITING OR BY ELECTRONIC MAIL OR BY ANOTHER SECURE METHOD OF
COMMUNICATION, INCLUDING THE USE OF THE INTERNET, A LIST OF ALL CATEGO-
RIES OF INFORMATION SET FORTH IN SUBPARAGRAPH (I) OF PARAGRAPH (B) OF
SUBDIVISION ONE OF THIS SECTION DISCLOSED BY THE BUSINESS TO THIRD
PARTIES FOR THE THIRD PARTIES' DIRECT MARKETING PURPOSES DURING THE
IMMEDIATELY PRECEDING CALENDAR YEAR.
(II) IN WRITING OR BY ELECTRONIC MAIL OR BY ANOTHER SECURE METHOD OF
COMMUNICATION, INCLUDING THE USE OF THE INTERNET, THE NAMES AND
ADDRESSES AT THE TIME OF DISCLOSURE OF ALL OF THE THIRD PARTIES THAT
RECEIVED PERSONAL INFORMATION FROM THE BUSINESS FOR THE THIRD PARTIES'
DIRECT MARKETING PURPOSES DURING THE PRECEDING CALENDAR YEAR AND, IF THE
NATURE OF THE THIRD PARTIES' BUSINESS CANNOT REASONABLY BE DETERMINED
FROM THE THIRD PARTIES' NAME, EXAMPLES OF THE PRODUCTS OR SERVICES
MARKETED, IF KNOWN TO THE BUSINESS, SUFFICIENT TO GIVE THE CONSUMER A
REASONABLE INDICATION OF THE NATURE OF THE THIRD PARTIES' BUSINESS.
(B)(I) A BUSINESS REQUIRED TO COMPLY WITH THIS SECTION SHALL DESIGNATE
A MINIMUM OF THREE POINTS OF CONTACT FROM THE FOLLOWING: A MAILING
ADDRESS, ELECTRONIC MAIL ADDRESS, A TOLL-FREE TELEPHONE OR FACSIMILE
NUMBER OR THE ADDRESS OF ANOTHER SECURE METHOD OF COMMUNICATION, INCLUD-
ING THE USE OF AN INTERNET ADDRESS, TO WHICH CONSUMERS MAY DELIVER
REQUESTS PURSUANT TO PARAGRAPH (A) OF THIS SUBDIVISION. A BUSINESS
REQUIRED TO COMPLY WITH THIS SECTION SHALL, AT ITS ELECTION, DO AT LEAST
ONE OF THE FOLLOWING:
(1) NOTIFY ALL AGENTS AND MANAGERS WHO DIRECTLY SUPERVISE EMPLOYEES
WHO REGULARLY HAVE CONTACT WITH CONSUMERS OF THE DESIGNATED ADDRESSES OR
NUMBERS OR THE MEANS TO OBTAIN THOSE ADDRESSES OR NUMBERS AND INSTRUCT
THOSE EMPLOYEES TO INFORM CONSUMERS, UPON REQUEST, OF SUCH ADDRESSES OR
NUMBERS OR THE MEANS TO OBTAIN SUCH ADDRESSES OR NUMBERS;
(2) ADD TO THE HOME PAGE OF ITS WEB SITE A LINK EITHER TO A PAGE
TITLED "YOUR PRIVACY RIGHTS" OR ADD THE WORDS "YOUR PRIVACY RIGHTS" TO
THE HOME PAGE'S LINK TO THE BUSINESS'S PRIVACY POLICY. IF THE BUSINESS
ELECTS TO ADD THE WORDS "YOUR PRIVACY RIGHTS" TO THE LINK TO THE BUSI-
NESS'S PRIVACY POLICY, THE WORDS "YOUR PRIVACY RIGHTS" SHALL BE IN THE
SAME STYLE AND SIZE AS THE LINK TO THE BUSINESS'S PRIVACY POLICY. IF THE
BUSINESS DOES NOT DISPLAY A LINK TO ITS PRIVACY POLICY ON THE HOME PAGE
OF ITS WEB SITE, OR DOES NOT HAVE A PRIVACY POLICY, THE WORDS "YOUR
PRIVACY RIGHTS" SHALL BE WRITTEN IN LARGER TYPE THAN THE SURROUNDING
TEXT, OR IN CONTRASTING TYPE, FONT, OR COLOR TO THE SURROUNDING TEXT OF
THE SAME SIZE, OR SET OFF FROM THE SURROUNDING TEXT OF THE SAME SIZE BY
SYMBOLS OR OTHER MARKS THAT CALL ATTENTION TO THE LANGUAGE. THE FIRST
PAGE OF THE LINK SHALL DESCRIBE A CONSUMER'S RIGHTS PURSUANT TO THIS
SECTION AND SHALL PROVIDE THE DESIGNATED MAILING ADDRESS, E-MAIL
ADDRESS, TOLL-FREE TELEPHONE NUMBER, FACSIMILE NUMBER OR THE ADDRESS OF
ANOTHER SECURE METHOD OF COMMUNICATION, INCLUDING THE USE OF AN INTERNET
ADDRESS, AS APPROPRIATE. IF THE BUSINESS ELECTS TO ADD THE WORDS "YOUR
NEW YORK PRIVACY RIGHTS" TO THE HOME PAGE'S LINK TO THE BUSINESS'S
PRIVACY POLICY IN A MANNER THAT COMPLIES WITH THIS SUBDIVISION, AND THE
FIRST PAGE OF THE LINK DESCRIBES A CONSUMER'S RIGHTS PURSUANT TO THIS
SECTION, AND PROVIDES THE DESIGNATED MAILING ADDRESS, ELECTRONIC MAILING
ADDRESS, TOLL-FREE TELEPHONE, FACSIMILE NUMBER OR THE ADDRESS OF ANOTHER
SECURE METHOD OF COMMUNICATION, INCLUDING THE USE OF AN INTERNET
ADDRESS, AS APPROPRIATE, THE BUSINESS NEED NOT RESPOND TO REQUESTS THAT
ARE NOT RECEIVED AT ONE OF THE DESIGNATED ADDRESSES OR NUMBERS;
A. 9480--A 7
(3) MAKE THE DESIGNATED ADDRESSES OR NUMBERS, OR MEANS TO OBTAIN THE
DESIGNATED ADDRESSES OR NUMBERS, READILY AVAILABLE UPON REQUEST OF A
CONSUMER AT EVERY PLACE OF BUSINESS IN NEW YORK WHERE THE BUSINESS OR
ITS AGENTS REGULARLY HAVE CONTACT WITH CONSUMERS. THE RESPONSE TO A
REQUEST PURSUANT TO THIS SECTION RECEIVED AT ONE OF THE DESIGNATED
ADDRESSES OR NUMBERS SHALL BE PROVIDED WITHIN THIRTY DAYS.
(II) A BUSINESS THAT IS REQUIRED TO COMPLY WITH THIS SECTION AND
SECTION 6803 OF TITLE 15 OF THE UNITED STATES CODE, AS AMENDED FROM TIME
TO TIME, MAY COMPLY WITH THIS SECTION BY PROVIDING THE CONSUMER THE
DISCLOSURE REQUIRED BY SECTION 6803 OF TITLE 15 OF THE UNITED STATES
CODE, AS AMENDED FROM TIME TO TIME, BUT ONLY IF THE DISCLOSURE ALSO
COMPLIES WITH THIS SECTION.
(III) A BUSINESS THAT IS REQUIRED TO COMPLY WITH THIS SECTION IS NOT
OBLIGATED TO PROVIDE INFORMATION ASSOCIATED WITH SPECIFIC INDIVIDUALS
AND MAY PROVIDE THE INFORMATION REQUIRED BY THIS SECTION IN STANDARDIZED
FORMAT.
(C)(I) A BUSINESS THAT IS REQUIRED TO COMPLY WITH THIS SECTION IS NOT
OBLIGATED TO DO SO IN RESPONSE TO A REQUEST FROM A CONSUMER MORE THAN
ONCE DURING THE COURSE OF ANY CALENDAR YEAR.
(II) IF A BUSINESS THAT IS REQUIRED TO COMPLY WITH THIS SECTION ADOPTS
AND DISCLOSES TO THE PUBLIC, IN ITS PRIVACY POLICY, A POLICY OF NOT
DISCLOSING PERSONAL INFORMATION OF CONSUMERS TO THIRD PARTIES FOR THE
THIRD PARTIES' DIRECT MARKETING PURPOSES UNLESS THE CONSUMER FIRST
AFFIRMATIVELY AGREES TO THAT DISCLOSURE, OR OF NOT DISCLOSING THE
PERSONAL INFORMATION OF CONSUMERS TO THIRD PARTIES FOR THE THIRD
PARTIES' DIRECT MARKETING PURPOSES IF THE CONSUMER HAS EXERCISED AN
OPTION THAT PREVENTS THAT INFORMATION FROM BEING DISCLOSED TO THIRD
PARTIES FOR THOSE PURPOSES, AS LONG AS THE BUSINESS MAINTAINS AND
DISCLOSES THE POLICIES, THE BUSINESS MAY COMPLY WITH PARAGRAPH (A) OF
THIS SUBDIVISION BY NOTIFYING THE CONSUMER OF HIS OR HER RIGHT TO
PREVENT DISCLOSURE OF PERSONAL INFORMATION, AND PROVIDING THE CONSUMER
WITH A COST-FREE MEANS TO EXERCISE THAT RIGHT.
(D) NO BUSINESS SHALL BE DEEMED TO HAVE VIOLATED THE PROVISIONS OF
THIS SECTION IF SUCH PERSON SHOWS, BY A PREPONDERANCE OF THE EVIDENCE,
THAT THE VIOLATION WAS NOT KNOWING, INTENTIONAL, OR WILLFUL AND RESULTED
FROM A BONA FIDE ERROR MADE NOTWITHSTANDING THE MAINTENANCE OF PROCE-
DURES REASONABLY ADOPTED TO AVOID SUCH ERROR.
3. WHENEVER THERE SHALL BE A VIOLATION OF THIS SECTION AN APPLICATION
MAY BE MADE BY THE ATTORNEY GENERAL IN THE NAME OF THE PEOPLE OF THE
STATE OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION BY A SPECIAL
PROCEEDING TO ISSUE AN INJUNCTION, AND UPON NOTICE TO THE DEFENDANT OF
NOT LESS THAN FIVE DAYS, TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH
VIOLATIONS; AND IF IT SHALL APPEAR TO THE SATISFACTION OF THE COURT OR
JUSTICE THAT THE DEFENDANT HAS, IN FACT, VIOLATED THIS SECTION, AN
INJUNCTION MAY BE ISSUED BY THE COURT OR JUSTICE, ENJOINING AND
RESTRAINING ANY FURTHER VIOLATIONS, WITHOUT REQUIRING PROOF THAT ANY
PERSON HAS, IN FACT, BEEN INJURED OR DAMAGED THEREBY. IN ANY SUCH
PROCEEDING, THE COURT MAY MAKE ALLOWANCES TO THE ATTORNEY GENERAL AS
PROVIDED IN PARAGRAPH SIX OF SUBDIVISION (A) OF SECTION EIGHTY-THREE
HUNDRED THREE OF THE CIVIL PRACTICE LAW AND RULES, AND DIRECT RESTITU-
TION. WHENEVER THE COURT SHALL DETERMINE THAT A VIOLATION OF THIS
SECTION HAS OCCURRED, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT MORE
THAN FIVE HUNDRED DOLLARS FOR EACH VIOLATION. EACH FAILURE TO RESPOND TO
A CONSUMER'S REQUEST FOR INFORMATION PURSUANT TO THIS SECTION SHALL
CONSTITUTE A SEPARATE VIOLATION. IN CONNECTION WITH ANY SUCH PROPOSED
APPLICATION, THE ATTORNEY GENERAL IS AUTHORIZED TO TAKE PROOF AND MAKE A
A. 9480--A 8
DETERMINATION OF THE RELEVANT FACTS AND TO ISSUE SUBPOENAS IN ACCORDANCE
WITH THE CIVIL PRACTICE LAW AND RULES.
S 4. If any clause, sentence, paragraph or part of this section shall
be adjudged by any court of competent jurisdiction to be invalid, such
judgment shall not affect, impair or invalidate the remainder thereof,
but shall be confined in its operation to the clause, sentence, para-
graph or part thereof directly involved in the controversy in which such
judgment shall have been rendered.
S 5. This act shall take effect one year after it shall have become a
law and shall apply to any disclosures on and after such effective date;
provided, however, that effective immediately, the addition, amendment,
and/or repeal of any rule or regulation necessary for the implementation
of this act on its effective date are authorized and directed to be made
and completed on or before such effective date.