S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8161
 
                             I N  S E N A T E
 
                              April 11, 2018
                                ___________
 
 Introduced  by Sen. CARLUCCI -- read twice and ordered printed, and when
   printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general business law,  in  relation  to  prohibiting
   internet  service  providers  from  disclosing personally identifiable
   information in the event that a consumer  requests  that  his  or  her
   information not be disseminated

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   § 399-K. PERSONALLY IDENTIFIABLE INFORMATION; NON-DISCLOSURE.  1.  FOR
 THE PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
 ING MEANINGS:
   (A)  "INTERNET  SERVICE  PROVIDER"  (ISP) MEANS ANY BUSINESS ENTITY OR
 INDIVIDUAL THAT PROVIDES CONSUMERS,  BUSINESSES  OR  ORGANIZATIONS  WITH
 AUTHENTICATED ACCESS TO THE INTERNET AS PART OF A SERVICE.
   (B)  "CONSUMER" MEANS ANY PERSON WHO AGREES TO PAY A FEE TO AN ISP FOR
 ACCESS TO THE INTERNET AND WHO DOES NOT RESELL ACCESS.
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL, ELECTRONIC MAIL ADDRESS, INTERNET PROTOCOL
   (IP) ADDRESS OR TELEPHONE NUMBER;
   (II) A CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET  USAGE  HISTORY;
 OR
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2. (A) AN ISP OPERATING IN THE STATE OF NEW YORK SHALL HONOR A CONSUM-
 ER'S REQUEST THAT THE ISP REFRAIN FROM SHARING, SELLING, PROVIDING OR IN
 ANY  WAY  DISCLOSING TO A THIRD PARTY ANY OF HIS OR HER PERSONALLY IDEN-
 TIFIABLE INFORMATION, WHETHER SUCH A REQUEST IS  MADE  BY  POSTAL  MAIL,
 ELECTRONIC  MAIL, TELEPHONE OR IN PERSON. SUCH A REQUEST SHALL BE DEEMED
 TO APPLY TO THE PERSONALLY IDENTIFIABLE INFORMATION FOR ALL  INDIVIDUALS
 THAT  ACCESS  THE  INTERNET  THROUGH  USAGE  OF THAT CONSUMER'S INTERNET
 SERVICE ACCOUNT.
   (B) NO ISP SHALL REFUSE TO PROVIDE ITS SERVICES TO A CONSUMER  BECAUSE
 THE  CONSUMER REQUESTED THAT HIS OR HER PERSONALLY IDENTIFIABLE INFORMA-
 TION NOT BE DISCLOSED OR DISSEMINATED TO A THIRD PARTY. NO ISP SHALL  IN
              

 ANY  WAY  DISRUPT,  BLOCK OR SLOW DOWN THE INTERNET ACCESS OF A CONSUMER
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD15376-01-8

 S. 8161                             2

 BECAUSE THE CONSUMER HAS REQUESTED THAT HIS OR HER PERSONALLY  IDENTIFI-
 ABLE INFORMATION NOT BE DISCLOSED OR DISSEMINATED TO A THIRD PARTY.
   3.  ISPS  SHALL PROVIDE CONSUMERS WITH A COPY, EITHER IN ELECTRONIC OR
 WRITTEN FORM, OF THEIR  PRIVACY  POLICY  THAT  SHALL  INCLUDE  ITS  DATA
 COLLECTION  AND  USE  PRACTICES,  THIRD PARTY RELATIONSHIPS, PURPOSES OF
 DATA COLLECTION AND PROCESS BY WHICH CONSUMERS CAN EXERCISE CONTROL OVER
 PERSONALLY IDENTIFIABLE INFORMATION AS PROVIDED  IN  THIS  SECTION.  THE
 PRIVACY  POLICY  SHALL  BE  PROVIDED  TO  CONSUMERS UPON ENTERING INTO A
 CONTRACT OR AGREEMENT WITH THE ISP AND SUBSEQUENTLY UPON ANY SIGNIFICANT
 CHANGES MADE TO SUCH POLICY.
   4. AN ISP  MAY  DISCLOSE  PERSONALLY  IDENTIFIABLE  INFORMATION  OF  A
 CONSUMER  WHO  REQUESTED  THAT  HIS  OR HER INFORMATION NOT BE DISCLOSED
 UNDER THE FOLLOWING CIRCUMSTANCE:
   (A) PURSUANT TO A GRAND JURY SUBPOENA, IN ACCORDANCE WITH  SUBDIVISION
 EIGHT OF SECTION 190.30 OF THE CRIMINAL PROCEDURE LAW;
   (B)  PURSUANT  TO  A  WARRANT  ISSUED  IN  ACCORDANCE WITH ARTICLE SIX
 HUNDRED NINETY OR SEVEN HUNDRED OF THE CRIMINAL PROCEDURE LAW;
   (C) PURSUANT TO A COURT ORDER IN A PENDING CRIMINAL PROCEEDING UPON  A
 SHOWING  THAT  SUCH  PERSONALLY IDENTIFIABLE INFORMATION IS RELEVANT AND
 MATERIAL TO SUCH CRIMINAL ACTION OR PROCEEDING;
   (D) PURSUANT TO A COURT ORDER IN A PENDING  CIVIL  PROCEEDING  UPON  A
 SHOWING  OF COMPELLING NEED FOR SUCH INFORMATION THAT CANNOT BE ACCOMMO-
 DATED BY OTHER MEANS;
   (E) TO A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY  THE  ISP
 OR  IN  A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID SUBSCRIPTION FEES
 OR PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO  ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST AUTHORIZED DISCLOSURE;
   (F)  TO  THE  CONSUMER  WHO  IS  THE  SUBJECT OF THE INFORMATION, UPON
 REQUEST AND UPON PAYMENT OF ANY FEE NOT TO EXCEED  THE  ACTUAL  COST  OF
 RETRIEVING THE INFORMATION;
   (G)  TO ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING VIOLATIONS
 OF THE PUBLISHED ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT  OF
 THE  ISP;  EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE THE PERSONALLY
 IDENTIFIABLE INFORMATION ONLY AS PROVIDED IN THIS CHAPTER; OR
   (H) TO ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER.
   5. THE ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS  TO  MAINTAIN
 THE SECURITY AND PRIVACY OF THE PERSONALLY IDENTIFIABLE INFORMATION OF A
 CONSUMER  WHO HAS REQUESTED THAT HIS OR HER INFORMATION NOT BE DISCLOSED
 OR DISSEMINATED.
   6. A CONSUMER WHO PREVAILS OR  SUBSTANTIALLY  PREVAILS  IN  AN  ACTION
 BROUGHT  UNDER  THIS  SECTION IS ENTITLED TO THE GREATER OF FIVE HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES MAY BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION  OF  THIS
 SECTION.  THE  ACTION  AVAILABLE UNDER THIS SECTION IS EXEMPTED FROM ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP AND CONSUMER. IN A CIVIL ACTION UNDER THIS SECTION, IT IS AN  AFFIR-
 MATIVE DEFENSE THAT SUCH INFORMATION WAS RELEASED OR OTHERWISE AVAILABLE
 IN VIOLATION OF THIS SECTION NOTWITHSTANDING REASONABLE PRACTICES ESTAB-
 LISHED  AND  IMPLEMENTED  BY THE DEFENDANT TO PREVENT VIOLATIONS OF THIS
 SECTION.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law.