Senate Bill S4778A

                                 BILL NUMBER:  S4778A

 TITLE OF BILL :  An act to amend the general business law, in
relation to prohibiting issuers from accepting nonpublic personal
information of holders from a third-party

 PURPOSE :

This bill would prohibit card issuers from accepting or soliciting
nonpublic personal information about a cardholder from a person other
than the card holder.

 SUMMARY OF PROVISIONS :

Section one of this bill adds a new Section 518-b to the General
Business Law, which would prohibit issuers of credit cards and debit
cards from accepting or soliciting the nonpublic personal information
of a cardholder from a person other than the card holder, while
allowing for the transmission of this information between these
companies to facilitate services authorized by the cardholder. A
violation of these provisions would be punishable by a civil penalty
not to exceed two thousand dollars for each such violation.

Section two of the bill provides that the bill takes effect on the
first of September next succeeding the date on which this bill becomes
law.
              

 JUSTIFICATION :

Third-parties should not be permitted to give personal information
about a credit or debit cardholder to the issuer of the card. The
cardholder is ultimately responsible for the use of the card, and
their credit history is effected by any use of or changes to the
account. Any errors in the information provided by a third-party might
be recorded on a consumer credit report, where even providing a
different street address can affect a consumer's credit history.
Also, if a third party were permitted to give the address of the
cardholder to the issuer, they might be able to divert monthly
statements to another address or raise the limit of the line of credit
attached to the card. Likewise, in the case of a divorced spouse or
when a child is a third-party user of their parent's card, such a user
might be able to cause harm to the cardholder or the cardholder's
credit by giving inaccurate or misleading information to the issuer.

In recognition of the fact that the cardholder is ultimately
responsible for the use of their card, this legislation would make
them the sole source of personal information about themselves. At the
same time, this bill would not limit the transmittal of financial or
transaction information by merchants or businesses, in recognition of
the fact that the transmittal of these types of information is
necessary for the use of credit and debit cards. Finally, this bill
also conforms with current federal legislation (the Gramm-Leach-Bliley
Act) on this issue.

 PRIOR LEGISLATIVE HISTORY :

2005-2006: Consumer Protection Committee (S.4687/A.9321)
2007-2008: Consumer Protection Committee (S.4308/A/6852)
2011-2012: Consumer Protection Committee (S.5061)
2013: Rules Committee (S.760)
2014: Consumer Protection Committee (S.6280).

 FISCAL IMPACT :

None to the state.

 EFFECTIVE DATE :
On the first of September next succeeding the date on which it shall
have become a law.