NY State Senate Bill 2017-S5603B

Senate Bill S5603B

2017-2018 Legislative Session

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer

download bill text pdf

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 03, 2018	referred to consumer protection
Jun 16, 2017	print number 5603b
Jun 16, 2017	amend and recommit to rules
Jun 06, 2017	reported and committed to rules
May 25, 2017	print number 5603a
May 25, 2017	amend (t) and recommit to consumer protection
Apr 19, 2017	referred to consumer protection

Votes

- Jun 6, 2017 - Consumer Protection Committee Vote
  S5603B
  
  9
  
  Aye
  
  2
  
  Nay
  
  0
  
  Aye with Reservations
  
  0
  
  Absent
  
  0
  
  Excused
  
  0
  
  Abstained
  - - Consumer Protection Committee Vote: Jun 6, 2017
      
      aye (9)
      
      Boyle
      
      Brooks
      
      Carlucci
      
      Comrie
      
      Hamilton
      
      Helming
      
      Latimer
      
      Robach
      
      Serrano
      
      nay (2)
      
      Amedore
      
      Funke

Bill Amendments

Original

B (Active)

co-Sponsors

View additional co-sponsors

2017-S5603 - Details

See Assembly Version of this Bill:: A7191
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: S518, A2420
2021-2022: S4830, A674
2023-2024: S4367, A1484

2017-S5603 - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-S5603 - Sponsor Memo

                                 BILL NUMBER:  S5603

 TITLE OF BILL :  An act to amend the general business law, in
relation to prohibiting the disclosure of personally identifiable
information by an internet service provider without the express
written approval of the customer

 PURPOSE OF GENERAL IDEA OF BILL :

The bill provides protections to New Yorkers by requiring that
Internet Service Providers not sell consumer information, unless
authorization is conspicuously requested and expressly given.

 SUMMARY OF SPECIFIC PROVISIONS :

Section 1. Amends the general business law to:

Add 399-k(1), which defines the terms consumer, internet service
provider (ISP), ordinary course of business, and personally
identifiable information.

Add 399-k(2)to prohibit ISPs from disclosing a consumer's personal
information without express written consent.

Add 399-k(3) providing exceptions to the requirements of subsection 2
for the purpose of cooperating with law enforcement.

Add 399-k(4) providing exceptions to the requirements of subsection 2
for the disclosure of personal information in relation to the ordinary
course of business.

Add 399-k(5) which requires ISPs to obtain consumer authorization of
disclosure and requires the authorization be conspicuous.

Add 399-k(6) which requires the ISP to take reasonable steps to
protect a consumer's personal information.

Add 399-k(7) which excludes any information obtained in violation of
this section from being admissible as evidence in a civil action.

Add 399-k(8)which grants a right of action against an ISP where this
section is violated and excluding the right of action from any
mandatory arbitration clause that may exist in the contract between
the ISP and the consumer.

Add 399-k(9) to address other laws that may impact this section.

Add 399-k(10) to state the section applies to internet service
providers serving customers in New York State.

 JUSTIFICATION :

In response to Congress's decision to repeal internet privacy
protections for Americans, this legislation is being introduced to
ensure that the privacy rights of New Yorkers remain protected.
Modeled after legislation introduced in Minnesota, this legislation
would prevent all internet service providers (ISPs) who have contracts
with or use the facilities of the State of New York or any political
subdivisions thereof from disclosing a customer's personal information
without the express written approval from the customer.

Absent legislative action by our state, ISPs will be able to collect
and sell information about the web searches you preform, the websites
you visit, and the apps you use. We cannot allow ISPs to disclose such
deeply personal information for commercial gain without our consent.

 PRIOR LEGISLATIVE HISTORY :

New bill

 FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS :

None

 EFFECTIVE DATE :
This act shall take effect immediately.

2017-S5603 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   5603
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                              April 19, 2017
                                ___________
 
 Introduced  by Sen. CARLUCCI -- read twice and ordered printed, and when
   printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure of  personally  identifiable  information  by  an  internet
   service provider without the express written approval of the customer

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   § 399-K. DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION  BY  AN
 INTERNET  SERVICE  PROVIDER;  PROHIBITED.  1.  FOR  THE PURPOSES OF THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A) "CONSUMER" MEANS A PERSON WHO AGREES TO PAY A FEE TO  AN  INTERNET
 SERVICE  PROVIDER  FOR  ACCESS  TO THE INTERNET FOR PERSONAL, FAMILY, OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET  SERVICE  PROVIDER"  MEANS  A  BUSINESS  OR  PERSON  WHO
 PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR PRESENCE ON, THE INTERNET
 BY  MEANS  OF  A  SWITCHED  OR DEDICATED TELECOMMUNICATIONS CHANNEL UPON
 WHICH THE PROVIDER PROVIDES TRANSIT ROUTING OF  INTERNET  PROTOCOL  (IP)
 PACKETS  FOR  AND  ON  BEHALF OF THE CONSUMER. INTERNET SERVICE PROVIDER
 DOES NOT INCLUDE THE OFFERING, ON A COMMON CARRIER BASIS, OF  TELECOMMU-
 NICATIONS  FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE FACILI-
 TIES.
   (C) "ORDINARY COURSE OF BUSINESS"  MEANS  DEBT-COLLECTION  ACTIVITIES,
 ORDER FULFILLMENT, REQUEST PROCESSING, OR THE TRANSFER OF OWNERSHIP.
   (D) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II)  A CONSUMER AS HAVING REQUESTED OR OBTAINED SPECIFIC MATERIALS OR
 SERVICES FROM AN INTERNET SERVICE PROVIDER;
   (III) INTERNET OR ONLINE SITES VISITED BY A CONSUMER; OR
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD10928-02-7

 S. 5603                             2
 
   (IV) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2.  EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS SECTION,
 AN INTERNET SERVICE PROVIDER SHALL  NOT  KNOWINGLY  DISCLOSE  PERSONALLY
 IDENTIFIABLE  INFORMATION RESULTING FROM THE CUSTOMER'S USE OF THE TELE-
 COMMUNICATIONS OR INTERNET  SERVICE  PROVIDER  WITHOUT  EXPRESS  WRITTEN
 APPROVAL FROM THE CUSTOMER.
   (A) A TELECOMMUNICATIONS OR INTERNET SERVICE PROVIDER ("ISP") THAT HAS
 ENTERED  INTO  A  FRANCHISE  AGREEMENT, RIGHT-OF-WAY AGREEMENT, OR OTHER
 CONTRACT WITH THE STATE OF NEW YORK OR ANY POLITICAL SUBDIVISION  THERE-
 OF, OR THAT USES FACILITIES THAT ARE SUBJECT TO SUCH AGREEMENTS, EVEN IF
 IT  IS  NOT  A  PARTY  TO  THE AGREEMENT, SHALL NOT COLLECT NOR DISCLOSE
 PERSONAL INFORMATION FROM A CUSTOMER RESULTING FROM THE  CUSTOMER'S  USE
 OF  THE  TELECOMMUNICATIONS OR INTERNET SERVICE PROVIDER WITHOUT EXPRESS
 WRITTEN APPROVAL FROM THE CUSTOMER; AND
   (B) NO SUCH  TELECOMMUNICATION  OR  INTERNET  SERVICE  PROVIDER  SHALL
 REFUSE  TO  PROVIDE  ITS  SERVICES TO A CUSTOMER ON THE GROUNDS THAT THE
 CUSTOMER HAS NOT APPROVED THE COLLECTION OR DISCLOSURE OF THE CUSTOMER'S
 PERSONAL INFORMATION.
   3. AN INTERNET SERVICE PROVIDER SHALL DISCLOSE PERSONALLY IDENTIFIABLE
 INFORMATION CONCERNING A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA;
   (B) TO AN INVESTIGATIVE OR LAW ENFORCEMENT  OFFICER  WHILE  ACTING  AS
 AUTHORIZED BY LAW;
   (C)  PURSUANT TO A COURT ORDER IN A CIVIL PROCEEDING UPON A SHOWING OF
 COMPELLING NEED FOR THE INFORMATION THAT CANNOT BE ACCOMMODATED BY OTHER
 MEANS;
   (D) TO A COURT IN A CIVIL  ACTION  FOR  CONVERSION  COMMENCED  BY  THE
 INTERNET  SERVICE PROVIDER OR IN A CIVIL ACTION TO ENFORCE COLLECTION OF
 UNPAID SUBSCRIPTION FEES OR PURCHASE  AMOUNTS,  AND  THEN  ONLY  TO  THE
 EXTENT  NECESSARY  TO ESTABLISH THE FACT OF THE SUBSCRIPTION DELINQUENCY
 OR PURCHASE AGREEMENT, AND WITH APPROPRIATE SAFEGUARDS AGAINST UNAUTHOR-
 IZED DISCLOSURE;
   (E) TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON  WRIT-
 TEN  OR  ELECTRONIC  REQUEST AND UPON PAYMENT OF A FEE NOT TO EXCEED THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (F) PURSUANT TO SUBPOENA, INCLUDING AN ADMINISTRATIVE SUBPOENA, ISSUED
 UNDER AUTHORITY OF A LAW OF THIS STATE OR ANOTHER STATE  OR  THE  UNITED
 STATES; OR
   (G) PURSUANT TO A WARRANT OR COURT ORDER.
   4.  AN  INTERNET SERVICE PROVIDER MAY DISCLOSE PERSONALLY IDENTIFIABLE
 INFORMATION CONCERNING A CONSUMER TO:
   (A) ANY PERSON IF THE DISCLOSURE IS INCIDENT TO THE ORDINARY COURSE OF
 BUSINESS OF THE INTERNET SERVICE PROVIDER;
   (B) ANOTHER INTERNET SERVICE PROVIDER FOR  PURPOSES  OF  REPORTING  OR
 PREVENTING  VIOLATIONS  OF THE PUBLISH ACCEPTABLE USE POLICY OR CUSTOMER
 SERVICE AGREEMENT OF THE INTERNET  SERVICE  PROVIDER;  EXCEPT  THAT  THE
 RECIPIENT  MAY  FURTHER DISCLOSE THE PERSONALLY IDENTIFIABLE INFORMATION
 ONLY AS PROVIDED BY THIS CHAPTER;
   (C) ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER; OR
   (D) AS REQUIRED BY SUBDIVISION THREE OF THIS SECTION.
   5. (A) THE INTERNET  SERVICE  PROVIDER  SHALL  OBTAIN  THE  CONSUMER'S
 AUTHORIZATION  OF  THE DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION
 IN WRITING OR BY ELECTRONIC MEANS.
   (B) THE REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE  THE  TYPES
 OF  PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.

 S. 5603                             3
 
   (C) IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT  BETWEEN
 AN  INTERNET  SERVICE  PROVIDER  AND  THE  CONSUMER  MUST STATE THAT THE
 AUTHORIZATION WILL BE OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E)  AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH SELF-
 REGULATING GUIDELINES ISSUED BY REPRESENTATIVES OF THE INTERNET  SERVICE
 PROVIDER  OR  ONLINE  INDUSTRIES,  OR  IN  ANY  OTHER  MANNER REASONABLY
 DESIGNED TO COMPLY WITH THIS SECTION.
   6. THE INTERNET SERVICE PROVIDER SHALL TAKE REASONABLE STEPS TO  MAIN-
 TAIN  THE  SECURITY  AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE
 INFORMATION.
   7. EXCEPT FOR PURPOSES OF ESTABLISHING A VIOLATION  OF  THIS  CHAPTER,
 PERSONALLY IDENTIFIABLE INFORMATION OBTAINED IN ANY MANNER OTHER THAN AS
 PROVIDED  IN  THIS  CHAPTER SHALL NOT BE RECEIVED IN EVIDENCE IN A CIVIL
 ACTION.
   8. A CONSUMER WHO PREVAILS OR  SUBSTANTIALLY  PREVAILS  IN  AN  ACTION
 BROUGHT  UNDER  THIS  SECTION IS ENTITLED TO THE GREATER OF FIVE HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES MAY BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION  OF  THIS
 SECTION.  THE DAMAGES AVAILABLE UNDER THIS SECTION ARE EXEMPTED FROM ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 INTERNET SERVICE PROVIDER AND THE CONSUMER.  IN  AN  ACTION  UNDER  THIS
 SECTION,  IT  IS A DEFENSE THAT THE DEFENDANT HAS ESTABLISHED AND IMPLE-
 MENTED REASONABLE PRACTICES AND PROCEDURES TO PREVENT VIOLATIONS OF THIS
 SECTION.
   9. THIS SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF  THE  PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A)  NOTHING IN THIS CHAPTER LIMITS THE AUTHORITY UNDER OTHER STATE OR
 FEDERAL LAW OF LAW ENFORCEMENT  OR  PROSECUTING  AUTHORITIES  TO  OBTAIN
 INFORMATION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE  INFORMATION  BY  INTERNET  SERVICE  PROVIDERS BUT DOES NOT
 PREEMPT STATE LAW ON THE SUBJECT, STATE LAW PREVAILS.
   10. THIS SECTION SHALL APPLY TO  INTERNET  SERVICE  PROVIDERS  IN  THE
 PROVISION OF SERVICES TO CONSUMERS IN THIS STATE.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.

co-Sponsors

View additional co-sponsors

2017-S5603A - Details

See Assembly Version of this Bill:: A7191
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: S518, A2420
2021-2022: S4830, A674
2023-2024: S4367, A1484

2017-S5603A - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-S5603A - Sponsor Memo

                                 BILL NUMBER:  S5603A

 TITLE OF BILL :  An act to amend the general business law, in
relation to prohibiting the disclosure of personally identifiable
information by an internet service provider without the express
written approval of the consumer

 PURPOSE OF GENERAL IDEA OF BILL :

The bill provides protections to New Yorkers by requiring that ISPs
not sell consumer information, unless authorization is conspicuously
requested and expressly given; nor may an ISP refuse to provide
service for failure to give consent.

 SUMMARY OF SPECIFIC PROVISIONS :

Section 1. Amends the general business law as follows:

Add 399-k (1) defines the terms consumer, internet service provider
(ISP) and personally identifiable information.

Add 399-k(2) prohibits ISPs from disclosing a consumer's personal
information without express written consent.

Add 399-k(3) provides exceptions to the requirements of subsection 2
for the purpose  of cooperating with law enforcement.

Add 399- k(4) requires ISPs to obtain consumer authorization for
disclosure and requires the authorization request to be conspicuous.

Add 399- k(5) requires the ISP to take reasonable steps to protect a
consumer's personal information.

Add 399-k(6) grants a right of action is against an ISP where this
section is violated and excluding the right of action from any
 mandatory clause that may exist in the contract between the ISP and
the consumer.

Add 399-k(7)to address other laws that may impact this section.

 JUSTIFICATION :

This legislation is being introduced in response to Congress's
decision to repeal internet privacy regulations set to take effect
earlier this year. This legislation requires ISPo to obtain the
consent  of their customers before disclosing any personally
identifiable information of the customer, hind prohibits an ISP from
refusing service if a customer does not want to give consent to
disclosure.

This legislation gives customers control over whether their personal
data disclosed and shared. ISP providers have access to "an
unprecedented breath" of electronic personal information, including a
customer's name, address, financial information, every website
visited, the links clicked on in those websites, geo-location
information, and the content of our electronic communications. ISPs
should not be permit- ted to disclose such deeply personal information
for commercial gain without customer consent. This legislation places
control over disclo- sure in the hands of the customer, where it
belongs, and prohibits an ISP from refusing to provide service unless
consent is given.

 PRIOR LEGISLATIVE HISTORY :

New bill

 FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS :

None

 EFFECTIVE DATE :
This act shall take effect immediately.

2017-S5603A - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  5603--A
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                              April 19, 2017
                                ___________
 
 Introduced  by  Sens.  CARLUCCI, ALCANTARA, HAMILTON, KAMINSKY, PERALTA,
   RANZENHOFER, SAVINO -- read twice and ordered printed, and when print-
   ed to be committed to the Committee on Consumer Protection --  commit-
   tee  discharged, bill amended, ordered reprinted as amended and recom-
   mitted to said committee

 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure of  personally  identifiable  information  by  an  internet
   service provider without the express written approval of the consumer
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   § 399-K. DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION  BY  AN
 INTERNET  SERVICE  PROVIDER;  PROHIBITED.  1.  FOR  THE PURPOSES OF THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A) "CONSUMER" MEANS A PERSON WHO AGREES TO PAY A FEE TO  AN  INTERNET
 SERVICE  PROVIDER  FOR  ACCESS  TO THE INTERNET FOR PERSONAL, FAMILY, OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET SERVICE PROVIDER" (ISP) MEANS A BUSINESS ENTITY OR INDI-
 VIDUAL WHO PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR  PRESENCE  ON,
 THE  INTERNET  BY  MEANS  OF  A SWITCHED OR DEDICATED TELECOMMUNICATIONS
 CHANNEL UPON WHICH THE PROVIDER PROVIDES  TRANSIT  ROUTING  OF  INTERNET
 PROTOCOL  PACKETS  FOR  AND  ON BEHALF OF THE CONSUMER. INTERNET SERVICE
 PROVIDER DOES NOT INCLUDE THE OFFERING, ON A COMMON  CARRIER  BASIS,  OF
 TELECOMMUNICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE
 FACILITIES.
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II)  A  CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET USAGE HISTORY;
 OR
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD10928-06-7

 S. 5603--A                          2
 
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2.  EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS SECTION,
 AN ISP SHALL NOT KNOWINGLY DISCLOSE PERSONALLY IDENTIFIABLE  INFORMATION
 RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR ISP WITH-
 OUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER.
   (A)  A  TELECOMMUNICATIONS  OR  ISP  THAT HAS ENTERED INTO A FRANCHISE
 AGREEMENT, RIGHT-OF-WAY AGREEMENT, OR OTHER CONTRACT WITH THE  STATE  OF
 NEW  YORK  OR ANY POLITICAL SUBDIVISION THEREOF, OR THAT USES FACILITIES
 THAT ARE SUBJECT TO SUCH AGREEMENTS, EVEN IF IT IS NOT A  PARTY  TO  THE
 AGREEMENT,  SHALL  NOT  COLLECT NOR DISCLOSE PERSONAL INFORMATION FROM A
 CONSUMER RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS  OR
 ISP WITHOUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER; AND
   (B)  NO  SUCH  TELECOMMUNICATION  OR  ISP  SHALL REFUSE TO PROVIDE ITS
 SERVICES TO A CONSUMER ON THE GROUNDS THAT THE CONSUMER HAS NOT APPROVED
 THE COLLECTION OR DISCLOSURE OF THE CONSUMER'S PERSONAL INFORMATION.
   3. AN ISP MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION  CONCERNING
 A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA;
   (B)  TO  AN  INVESTIGATIVE  OR LAW ENFORCEMENT OFFICER WHILE ACTING AS
 AUTHORIZED BY LAW;
   (C) PURSUANT TO A COURT ORDER IN A CIVIL PROCEEDING UPON A SHOWING  OF
 COMPELLING NEED FOR THE INFORMATION THAT CANNOT BE ACCOMMODATED BY OTHER
 MEANS;
   (D)  TO  A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY THE ISP
 OR IN A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID  SUBSCRIPTION  FEES
 OR  PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST UNAUTHORIZED DISCLOSURE;
   (E) TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON  WRIT-
 TEN  OR  ELECTRONIC  REQUEST AND UPON PAYMENT OF A FEE NOT TO EXCEED THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (F) PURSUANT TO SUBPOENA, INCLUDING AN ADMINISTRATIVE SUBPOENA, ISSUED
 UNDER AUTHORITY OF A LAW OF THIS STATE OR ANOTHER STATE  OR  THE  UNITED
 STATES;
   (G)  ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING VIOLATIONS OF
 THE PUBLISH ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT  OF  THE
 ISP; EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE THE PERSONALLY IDEN-
 TIFIABLE INFORMATION ONLY AS PROVIDED BY THIS CHAPTER;
   (H) ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER; OR
   (I) AS REQUIRED BY THIS SUBDIVISION.
   4.  (A)  THE  ISP  SHALL  OBTAIN  THE  CONSUMER'S AUTHORIZATION OF THE
 DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION IN WRITING OR BY ELEC-
 TRONIC MEANS.
   (B) THE REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE  THE  TYPES
 OF  PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C) IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT  BETWEEN
 AN  ISP  AND  THE  CONSUMER  MUST  STATE  THAT THE AUTHORIZATION WILL BE
 OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E) AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH GUIDE-
 LINES ISSUED BY REPRESENTATIVES OF THE ISP OR ONLINE INDUSTRIES,  OR  IN
 ANY OTHER MANNER REASONABLY DESIGNED TO COMPLY WITH THIS SECTION.
   5.  THE  ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS TO MAINTAIN
 THE SECURITY AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE  INFOR-
 MATION.

 S. 5603--A                          3
 
   6.  A  CONSUMER  WHO  PREVAILS  OR SUBSTANTIALLY PREVAILS IN AN ACTION
 BROUGHT UNDER THIS SECTION IS ENTITLED TO THE GREATER  OF  FIVE  HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES  MAY  BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION OF THIS
 SECTION.  THE DAMAGES AVAILABLE UNDER THIS SECTION ARE EXEMPTED FROM ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP AND THE CONSUMER. IN AN ACTION UNDER THIS SECTION, IT IS  A  DEFENSE
 THAT  THE DEFENDANT HAS ESTABLISHED AND IMPLEMENTED REASONABLE PRACTICES
 AND PROCEDURES TO PREVENT VIOLATIONS OF THIS SECTION.
   7. THIS SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF  THE  PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A)  NOTHING  IN  THIS  SECTION SHALL BE DEEMED TO LIMIT THE AUTHORITY
 UNDER OTHER STATE OR FEDERAL LAW OF LAW ENFORCEMENT TO  OBTAIN  INFORMA-
 TION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE  INFORMATION  BY ISPS BUT DOES NOT PREEMPT STATE LAW ON THE
 SUBJECT, STATE LAW PREVAILS.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law.

co-Sponsors

View additional co-sponsors

2017-S5603B (ACTIVE) - Details

See Assembly Version of this Bill:: A7191
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: S518, A2420
2021-2022: S4830, A674
2023-2024: S4367, A1484

2017-S5603B (ACTIVE) - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-S5603B (ACTIVE) - Sponsor Memo

                                 BILL NUMBER:  S5603B

 TITLE OF BILL :  An act to amend the general business law, in
relation to prohibiting the disclosure of personally identifiable
information by an internet service provider without the express
written approval of the consumer

 PURPOSE OF GENERAL IDEA OF BILL :

The bill provides protections to New Yorkers by requiring that ISPs
not sell consumer information, unless authorization is conspicuously
requested and expressly given; nor may an ISP refuse to provide
service for failure to give consent.

 SUMMARY OF SPECIFIC PROVISIONS :

Section 1. Amends the general business law as follows:

Add 399-k (1) defines the terms consumer, internet service provider
(ISP) and personally identifiable information.

Add 399-k(2) prohibits ISPs from disclosing a consumer's personal
information without express written consent.

Add 399-k(3) provides exceptions to the requirements of subsection 2
for the purpose  of cooperating with law enforcement.

Add 399- k(4) requires ISPs to obtain consumer authorization for
disclosure and requires the authorization request to be conspicuous.

Add 399- k(5) requires the ISP to take reasonable steps to protect a
consumer's personal information.

Add 399-k(6) grants a right of action is against an ISP where this
section is violated and excluding the right of action from any
 mandatory clause that may exist in the contract between the ISP and
the consumer.

Add 399-k(7)to address other laws that may impact this section.

 JUSTIFICATION :

This legislation is being introduced in response to Congress's
decision to repeal internet privacy regulations set to take effect
earlier this year. This legislation requires ISPo to obtain the
consent  of their customers before disclosing any personally
identifiable information of the customer, hind prohibits an ISP from
refusing service if a customer does not want to give consent to
disclosure.

This legislation gives customers control over whether their personal
data disclosed and shared. ISP providers have access to "an
unprecedented breath" of electronic personal information, including a
customer's name, address, financial information, every website
visited, the links clicked on in those websites, geo-location
information, and the content of our electronic communications. ISPs
should not be permit- ted to disclose such deeply personal information
for commercial gain without customer consent. This legislation places
control over disclo- sure in the hands of the customer, where it
belongs, and prohibits an ISP from refusing to provide service unless
consent is given.

 PRIOR LEGISLATIVE HISTORY :

New bill

 FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS :

None

 EFFECTIVE DATE :
This act shall take effect immediately.

2017-S5603B (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  5603--B
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                              April 19, 2017
                                ___________
 
 Introduced  by  Sens.  CARLUCCI,  ALCANTARA,  BROOKS,  COMRIE, HAMILTON,
   KAMINSKY, PERALTA, SAVINO -- read twice and ordered printed, and  when
   printed  to  be  committed  to the Committee on Consumer Protection --
   committee discharged, bill amended, ordered reprinted as  amended  and
   recommitted  to said committee -- reported favorably from said commit-
   tee and committed to the Committee on Rules --  committee  discharged,
   bill  amended,  ordered  reprinted  as amended and recommitted to said
   committee
 
 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure of  personally  identifiable  information  by  an  internet
   service provider without the express written approval of the consumer
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   § 399-K. DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION  BY  AN
 INTERNET  SERVICE  PROVIDER;  PROHIBITED.  1.  FOR  THE PURPOSES OF THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A) "CONSUMER" MEANS A PERSON WHO AGREES TO PAY A FEE TO  AN  INTERNET
 SERVICE  PROVIDER  FOR  ACCESS  TO THE INTERNET FOR PERSONAL, FAMILY, OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET SERVICE PROVIDER" (ISP) MEANS A BUSINESS ENTITY OR INDI-
 VIDUAL WHO PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR  PRESENCE  ON,
 THE  INTERNET  BY  MEANS  OF  A SWITCHED OR DEDICATED TELECOMMUNICATIONS
 CHANNEL UPON WHICH THE PROVIDER PROVIDES  TRANSIT  ROUTING  OF  INTERNET
 PROTOCOL  PACKETS  FOR  AND  ON BEHALF OF THE CONSUMER. INTERNET SERVICE
 PROVIDER DOES NOT INCLUDE THE OFFERING, ON A COMMON  CARRIER  BASIS,  OF
 TELECOMMUNICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE
 FACILITIES.
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD10928-08-7

 S. 5603--B                          2
 
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II)  A  CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET USAGE HISTORY;
 OR
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2. EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS  SECTION,
 AN  ISP SHALL NOT KNOWINGLY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION
 RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR ISP WITH-
 OUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER.
   (A) A TELECOMMUNICATIONS OR ISP THAT  HAS  ENTERED  INTO  A  FRANCHISE
 AGREEMENT,  RIGHT-OF-WAY  AGREEMENT, OR OTHER CONTRACT WITH THE STATE OF
 NEW YORK OR ANY POLITICAL SUBDIVISION THEREOF, OR THAT  USES  FACILITIES
 THAT  ARE  SUBJECT  TO SUCH AGREEMENTS, EVEN IF IT IS NOT A PARTY TO THE
 AGREEMENT, SHALL NOT COLLECT NOR DISCLOSE PERSONAL  INFORMATION  FROM  A
 CONSUMER  RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR
 ISP WITHOUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER; AND
   (B) NO SUCH TELECOMMUNICATION OR  ISP  SHALL  REFUSE  TO  PROVIDE  ITS
 SERVICES TO A CONSUMER ON THE GROUNDS THAT THE CONSUMER HAS NOT APPROVED
 THE COLLECTION OR DISCLOSURE OF THE CONSUMER'S PERSONAL INFORMATION.
   3.  AN ISP MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION CONCERNING
 A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA, IN ACCORDANCE WITH  SUBDIVISION
 EIGHT OF SECTION 190.30 OF THE CRIMINAL PROCEDURE LAW;
   (B)  PURSUANT  TO  A  WARRANT  ISSUED  IN  ACCORDANCE WITH ARTICLE SIX
 HUNDRED NINETY OR ARTICLE SEVEN HUNDRED OF THE CRIMINAL PROCEDURE LAW;
   (C) PURSUANT TO A COURT ORDER IN A PENDING CRIMINAL PROCEEDING UPON  A
 SHOWING  THAT  SUCH  PERSONALLY IDENTIFIABLE INFORMATION IS RELEVANT AND
 MATERIAL TO SUCH CRIMINAL ACTION OR PROCEEDING;
   (D) PURSUANT TO A COURT ORDER IN A PENDING  CIVIL  PROCEEDING  UPON  A
 SHOWING  OF COMPELLING NEED FOR SUCH INFORMATION THAT CANNOT BE ACCOMMO-
 DATED BY OTHER MEANS;
   (E) TO A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY  THE  ISP
 OR  IN  A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID SUBSCRIPTION FEES
 OR PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO  ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST UNAUTHORIZED DISCLOSURE;
   (F)  TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON WRIT-
 TEN OR ELECTRONIC REQUEST AND UPON PAYMENT OF ANY FEE NOT TO EXCEED  THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (G)  TO ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING VIOLATIONS
 OF THE PUBLISHED ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT  OF
 THE  ISP;  EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE THE PERSONALLY
 IDENTIFIABLE INFORMATION ONLY AS PROVIDED BY THIS CHAPTER; OR
   (H) TO ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER.
   4. (A) THE ISP SHALL  OBTAIN  THE  CONSUMER'S  AUTHORIZATION  FOR  THE
 DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION IN WRITING OR BY ELEC-
 TRONIC MEANS.
   (B)  THE  REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE THE TYPES
 OF PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE  DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C)  IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT BETWEEN
 AN ISP AND THE CONSUMER  MUST  STATE  THAT  THE  AUTHORIZATION  WILL  BE
 OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E) AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH GUIDE-
 LINES  ISSUED  BY REPRESENTATIVES OF THE ISP OR ONLINE INDUSTRIES, OR IN
 ANY OTHER MANNER REASONABLY DESIGNED TO COMPLY WITH THIS SECTION.

 S. 5603--B                          3
 
   5. THE ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS  TO  MAINTAIN
 THE  SECURITY AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE INFOR-
 MATION.
   6.  A  CONSUMER  WHO  PREVAILS  OR SUBSTANTIALLY PREVAILS IN AN ACTION
 BROUGHT UNDER THIS SECTION IS ENTITLED TO THE GREATER  OF  FIVE  HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES  MAY  BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION OF THIS
 SECTION. THE ACTION AVAILABLE UNDER THIS SECTION IS  EXEMPTED  FROM  ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP  AND  THE  CONSUMER.  IN A CIVIL ACTION UNDER THIS SECTION, IT IS AN
 AFFIRMATIVE DEFENSE THAT SUCH  INFORMATION  WAS  RELEASED  OR  OTHERWISE
 AVAILABLE  IN VIOLATION OF THIS SECTION NOTWITHSTANDING REASONABLE PRAC-
 TICES ESTABLISHED AND IMPLEMENTED BY THE DEFENDANT TO PREVENT VIOLATIONS
 OF THIS SECTION.
   7. THIS SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF  THE  PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A)  NOTHING  IN  THIS  SECTION SHALL BE DEEMED TO LIMIT THE AUTHORITY
 UNDER OTHER STATE OR FEDERAL LAW OF LAW ENFORCEMENT TO  OBTAIN  INFORMA-
 TION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE  INFORMATION  BY ISPS BUT DOES NOT PREEMPT STATE LAW ON THE
 SUBJECT, STATE LAW PREVAILS.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S5603B

Share this bill

Sponsored By

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Bill Amendments

co-Sponsors

2017-S5603 - Details

2017-S5603 - Summary

2017-S5603 - Sponsor Memo

2017-S5603 - Bill Text download pdf

co-Sponsors

2017-S5603A - Details

2017-S5603A - Summary

2017-S5603A - Sponsor Memo

2017-S5603A - Bill Text download pdf

co-Sponsors

2017-S5603B (ACTIVE) - Details

2017-S5603B (ACTIVE) - Summary

2017-S5603B (ACTIVE) - Sponsor Memo

2017-S5603B (ACTIVE) - Bill Text download pdf

Comments