The New York State Senate

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  10583

                          I N  A S S E M B L Y

                              June 4, 2020
                               ___________

Introduced  by  COMMITTEE  ON RULES -- (at request of M. of A. L. Rosen-
  thal) -- read once and referred to the Committee on Health

AN ACT in relation to the collection of emergency health  data  and  the
  use of technology to aid during COVID-19; and providing for the repeal
  of such provision upon the expiration thereof

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Covered entity" means any person, including a government entity:
  (a) that collects,  uses,  or  discloses  emergency  health  data,  as
defined  in this act, electronically or through communication by wire or
radio; or
  (b) that develops or  operates  a  website,  web  application,  mobile
application,  mobile  operating system feature, or smart device applica-
tion for the purpose of tracking, screening, monitoring,  contact  trac-
ing,  or  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency.
  2. "De-identified information" means information that  cannot  reason-
ably identify, relate to, describe, be capable of being associated with,
or  be  linked,  directly  or  indirectly, to a particular individual. A
covered entity that uses de-identified information:
  (a) has implemented technical safeguards that prohibit  re-identifica-
tion of the individual to whom the information may pertain;
  (b)  has  implemented  business  processes  that specifically prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  3. "Emergency health data" means data linked or reasonably linkable to
an  individual  or  device, including data inferred or derived about the
individual or device from other collected data  provided  such  data  is
still  linked  or  reasonably linkable to the individual or device, that
concerns the public COVID-19 health emergency. Such data includes:

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.

                                                           LBD16478-02-0

A. 10583                            2

  (a) Information that reveals the past, present, or future physical  or
behavioral  health  or  condition  of, or provision of healthcare to, an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data that can be used to infer health status, health  history,  location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the  past  or  present  precise  physical location of an individual at a
specific point in time, taking account of population densities,  includ-
ing  cell-site  location  information,  triangulation  data derived from
nearby wireless or  radio  frequency  networks  and  global  positioning
system data;
  (ii)  proximity data, when such term means information that identifies
or estimates the past or present physical proximity of one individual or
device to another, including information derived from  Bluetooth,  audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv)  contact information for identifiable individuals or a history of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  4.  "Individual" means a natural person whom the covered entity  knows
or has reason to know is located in New York state.
  5.  "Personal  information" means information that identifies, relates
to, describes, is capable of being associated with, or could  reasonably
be  linked,  directly  or  indirectly,  with  a particular individual or
household, or device.
  6. "Process" means  any  operation  or  set  of  operations  that  are
performed on personal data by either automated or not automated means.
  § 2. All covered entities must disclose the following information at a
fourth grade reading level or below and in the language the entity regu-
larly uses to communicate with the individual:
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's emergency health data; and
  (ii)  make any changes in the processing of the individual's emergency
health data.
  (b) It shall be unlawful for a covered  entity  to  collect,  use,  or
disclose emergency health data unless:
  (i) the individual to whom the data pertains has freely given, specif-
ic,  informed,  and  unambiguous  consent  to  such  collection, use, or
disclosure; or
  (ii) such collection, use, or disclosure is necessary and for the sole
purpose of:
  (A) protecting against malicious, deceptive,  fraudulent,  or  illegal
activity; or
  (B)  detecting,  responding  to,  or  preventing security incidents or
threats; or
  (iii) the covered entity is compelled to do so by  a  court  order  or
other legal obligation.

A. 10583                            3

  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld or withdrawn.
  2. The individual's right to privacy. (a) All  emergency  health  data
and  personal information shall be collected at a minimum level of iden-
tifiability reasonably needed for tracking COVID-19. For a covered enti-
ty using proximity tracing or exposure notification this includes chang-
ing temporary anonymous identifiers at least once in a 10 minute period.
  (b) A covered entity shall not  process  personal  information  beyond
what  is  adequate,  relevant,  and  necessary for the completion of the
transaction disclosed to, affirmatively consented to, and  requested  by
the individual.
  (c)  A  covered entity shall not process emergency health data for any
purpose not authorized under this act, including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or education; or
  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual  a  privacy  policy,  prior  to  or  at the point of
collection of emergency health data:
  (i) detailing how and for what purpose the  covered  entity  collects,
uses, and discloses emergency health data;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data; and
  (iii) describing how an individual  may  exercise  rights  under  this
section.
  (b)  A covered entity shall create transparency reports, at least once
every 90 days, that include:
  (i) the number of individuals whose emergency health data the  covered
entity collected or used;
  (ii)  the  categories  of  emergency  health  data collected, used, or
disclosed;
  (iii) the purposes for which each category of  emergency  health  data
was collected, used, or disclosed;
  (iv)  the  number  of  requests for individuals emergency health data,
including information on who the emergency health data was disclosed to;
and

A. 10583                            4

  (v) the number of instances where emergency health data was  produced,
in whole or in part, without prior, explicit consents by the individuals
specified in the request.
  4.  Time  limitation  on  retention.  (a)  Emergency  health  data and
personal information shall be  deleted  when  the  initial  purpose  for
collecting  or obtaining such data has been satisfied or within 30 days,
whichever occurs  first,  except  that  proximity  tracing  or  exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5. Access rights. (a) Emergency health data shall be disclosed only as
necessary to provide the service requested by an individual.
  (b)  A  covered  entity  may  share aggregate, de-identified data with
public health authorities.
  (c) A covered entity shall not disclose emergency  health  data  to  a
third  party  unless  that  third  party  is  contractually bound to the
covered entity to meet the same privacy and security obligations as  the
covered entity.
  (d)  No  covered  entity  in  possession  of emergency health data may
disclose, redisclose, or otherwise disseminate an individual's emergency
health data unless:
  (i) the subject of the personal information or the  subject's  legally
authorized  representative  consents  in  writing  to  the disclosure or
redisclosure; or
  (ii) the disclosure or redisclosure is required by  state  or  federal
law.
  (e)  Individuals  shall  have the right to access the emergency health
data collected on them and correct any inaccuracies.
  (i) A covered entity must  comply  with  an  individual's  request  to
correct  emergency  health data not later than 30 days after receiving a
verifiable request from the individual or, in the case of a  minor,  the
individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data shall implement and maintain  reasonable  security  procedures  and
practices, including administrative, physical, and technical safeguards,
appropriate  to the nature of the information and the purposes for which
that information will be used, to protect that  information  from  unau-
thorized use, disclosure, access, destruction, or modification.
  3.  A  covered  entity  shall limit access to emergency health data to
authorized essential personnel whose  use  of  the  data  is  reasonably
necessary  to  operate the program and record who has accessed emergency
health data, the date of access, and for what purposes.
  § 4. 1. All covered entities  shall  be  subject  to  data  protection
audits  evaluating the technology utilized and the development processes
for statistical impacts on classes protected under section 296 of  arti-
cle  15  of  the  executive  law, as well as for impacts on privacy, and
security that includes at a minimum:

A. 10583                            5

  (a) a detailed description of the  technology,  its  design,  and  its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in  light of its purpose, taking into account relevant factors including
data minimization practices; the duration for which personal information
and the results of the data analysis are stored; what information  about
the  technology  is  available  to the public; and the recipients of the
results of the technology;
  (c) an assessment of the risk of harm posed  by  the  technology;  the
risk  that  the  technology  may  result in or contribute to inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy may dissuade New Yorkers from participating  in  contact  tracing  or
obtaining  medical  testing  or  treatment;  and  the risk that personal
information or emergency health data can be accessed by  third  parties,
including,  but  not  limited to law enforcement agencies and U.S. Immi-
gration and Customs Enforcement; and
  (d) the measures the covered entity will employ to minimize the  risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e)  an  assessment of whether the covered entity has followed through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2. The audits required by this subdivision shall be made fully  avail-
able to the public.
  §  5.  1. An individual may bring a private right of action in a court
of competent jurisdiction to enforce any right  under  this  act  or  to
enjoin any violation of this act.
  (a)  Any  individual  alleging a violation of this act or a regulation
promulgated under this act may bring a civil  action  in  any  court  of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with  respect to the personal information of an individual constitutes a
rebuttable presumption of harm to that individual.
  (c) In a civil action in which the plaintiff prevails, the  court  may
award:
  (i)  liquidated  damages  of  ten  thousand dollars or actual damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d) In addition to any relief awarded pursuant  to  paragraph  (c)  of
this  subdivision,  the court shall award reasonable attorney's fees and
costs to any prevailing plaintiff.
  2. The attorney general may bring an action in the name of the  state,
or  as  parens  patriae  on  behalf of persons residing in the state, to
enforce the provisions of this act. In an action brought by the attorney
general, the court may award injunctive  relief,  including  preliminary
injunctions, to prevent further violations of and compel compliance with
this  act;  civil  penalties  up  to  twenty-five  thousand  dollars per
violation or up to four percent of  annual  revenue;  other  appropriate
relief,  including  restitution,  to  redress harms to individuals or to
mitigate all substantial risk of harm; and any other  relief  the  court
determines.

A. 10583                            6

  §  6.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                10583--A

                          I N  A S S E M B L Y

                              June 4, 2020
                               ___________

Introduced  by  COMMITTEE  ON RULES -- (at request of M. of A. L. Rosen-
  thal) -- read once and referred to the Committee on Health --  commit-
  tee  discharged, bill amended, ordered reprinted as amended and recom-
  mitted to said committee

AN ACT in relation to the collection of emergency health  data  and  the
  use of technology to aid during COVID-19; and providing for the repeal
  of such provision upon the expiration thereof

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Covered entity" means any person, including a government entity:
  (a) that collects,  uses,  or  discloses  emergency  health  data,  as
defined  in this act, electronically or through communication by wire or
radio; or
  (b) that develops or  operates  a  website,  web  application,  mobile
application,  mobile  operating system feature, or smart device applica-
tion for the purpose of tracking, screening, monitoring,  contact  trac-
ing,  or  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency.
  2. "De-identified information" means information that  cannot  reason-
ably identify, relate to, describe, be capable of being associated with,
or be linked, directly or indirectly, to a particular individual, house-
hold, or device.  A covered entity that uses de-identified information:
  (a)  has implemented technical safeguards that prohibit re-identifica-
tion of the individual to whom the information may pertain;
  (b) has implemented  business  processes  that  specifically  prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  3. "Emergency health data" means data linked or reasonably linkable to
an individual or device, including data inferred or  derived  about  the
individual, household, or device from other collected data provided such
data  is  still  linked or reasonably linkable to the individual, house-

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets

                      [ ] is old law to be omitted.
                                                           LBD16478-05-0

A. 10583--A                         2

hold, or device, that concerns the  public  COVID-19  health  emergency.
Such data includes:
  (a)  Information that reveals the past, present, or future physical or
behavioral health or condition of, or provision  of  healthcare  to,  an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data that can be used to infer health status, health  history,  location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the  past  or  present  precise  physical location of an individual at a
specific point in time, taking account of population densities,  includ-
ing  cell-site  location  information,  triangulation  data derived from
nearby wireless or  radio  frequency  networks  and  global  positioning
system data;
  (ii)  proximity data, when such term means information that identifies
or estimates the past or present physical proximity of one individual or
device to another, including information derived from  Bluetooth,  audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv)  contact information for identifiable individuals or a history of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  4.  "Individual" means a natural person whom the covered entity  knows
or has reason to know is located in New York state.
  5.  "Personal  information" means information that identifies, relates
to, describes, is capable of being associated with, or could  reasonably
be  linked,  directly  or  indirectly,  with  a particular individual or
household, or device.
  6. "Process" means  any  operation  or  set  of  operations  that  are
performed on personal data by either automated or not automated means.
  7.  "Public  health  authority" means the New York state department of
health, a county health department or the New York  city  department  of
health and mental hygiene, or a person or entity acting under a grant of
authority  from  or  contract  with  such  public  agency, including the
employees or agents of such public agency or its contractors or  persons
to  entities  to  whom it has granted authority, that is responsible for
public health matters as part of its official mandate.
  § 2. All covered entities must disclose the following information at a
fourth grade reading level or below and in the language the entity regu-
larly uses to communicate with the individual:
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's personal information or emergency  health
data; and
  (ii)  make  any changes in the processing of the individual's personal
information or emergency health data.
  (b) It shall be unlawful for a covered  entity  to  collect,  use,  or
disclose emergency health data unless:

A. 10583--A                         3

  (i) the individual to whom the data pertains has freely given, specif-
ic,  informed,  and  unambiguous  consent  to  such  collection, use, or
disclosure; or
  (ii) such collection, use, or disclosure is necessary and for the sole
purpose of:
  (A)  protecting  against  malicious, deceptive, fraudulent, or illegal
activity; or
  (B) detecting, responding to,  or  preventing  security  incidents  or
threats.
  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld or withdrawn.
  2. The individual's right to privacy. (a) All  emergency  health  data
and  personal information shall be collected at a minimum level of iden-
tifiability reasonably needed for tracking COVID-19. For a covered enti-
ty using proximity tracing or exposure notification this includes chang-
ing temporary anonymous identifiers at least once in a 10 minute period.
  (b) A covered entity shall not  process  personal  information  beyond
what  is  adequate,  relevant,  and  necessary for the completion of the
transaction disclosed to, affirmatively consented to, and  requested  by
the individual.
  (c)  A  covered entity shall not process emergency health data for any
purpose not authorized under this act, including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or education; or
  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual  a  privacy  policy,  prior  to  or  at the point of
collection of emergency health data:
  (i) detailing how and for what purpose the  covered  entity  collects,
uses, and discloses emergency health data;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data; and
  (iii) describing how an individual  may  exercise  rights  under  this
section.
  (b)  A covered entity shall create transparency reports, at least once
every 90 days, that include:
  (i) the number of individuals whose emergency health data the  covered
entity collected or used;

A. 10583--A                         4

  (ii)  the  categories  of  emergency  health  data collected, used, or
disclosed;
  (iii)  the  purposes  for which each category of emergency health data
was collected, used, or disclosed;
  (iv) the number of requests for  individuals  emergency  health  data,
including information on who the emergency health data was disclosed to;
and
  (v)  the number of instances where emergency health data was produced,
in whole or in part, without prior, explicit consents by the individuals
specified in the request.
  4. Time  limitation  on  retention.  (a)  Emergency  health  data  and
personal  information  shall  be  deleted  when  the initial purpose for
collecting or obtaining such data has been satisfied or within 30  days,
whichever  occurs  first,  except  that  proximity  tracing  or exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5. Access rights. (a) Emergency health data shall be disclosed only as
necessary to provide the service requested by an individual.
  (b) A covered entity may  share  aggregate,  de-identified  data  with
public health authorities.
  (c)  A  covered  entity  shall not disclose emergency health data to a
third party unless that  third  party  is  contractually  bound  to  the
covered  entity to meet the same privacy and security obligations as the
covered entity.
  (d) No covered entity in  possession  of  emergency  health  data  may
disclose, redisclose, or otherwise disseminate an individual's emergency
health  data  unless  the  subject  of  the  personal information or the
subject's legally authorized representative consents in writing  to  the
disclosure or redisclosure.
  (e)  Individuals  shall  have the right to access the emergency health
data collected on them and correct any inaccuracies.
  (i) A covered entity must  comply  with  an  individual's  request  to
correct  emergency  health data not later than 30 days after receiving a
verifiable request from the individual or, in the case of a  minor,  the
individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data shall implement and maintain  reasonable  security  procedures  and
practices, including administrative, physical, and technical safeguards,
appropriate  to the nature of the information and the purposes for which
that information will be used, to protect that  information  from  unau-
thorized use, disclosure, access, destruction, or modification.
  3.  A  covered  entity  shall limit access to emergency health data to
authorized essential personnel whose  use  of  the  data  is  reasonably
necessary  to  operate the program and record who has accessed emergency
health data, the date of access, and for what purposes.

A. 10583--A                         5

  § 4. 1. All covered entities  shall  be  subject  to  data  protection
audits, conducted by a neutral third party auditor, evaluating the tech-
nology utilized and the development processes for statistical impacts on
classes  protected under section 296 of article 15 of the executive law,
as well as for impacts on privacy, and security that includes at a mini-
mum:
  (a)  a  detailed  description  of  the technology, its design, and its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in light of its purpose, taking into account relevant factors  including
data minimization practices; the duration for which personal information
and  the results of the data analysis are stored; what information about
the technology is available to the public; and  the  recipients  of  the
results of the technology;
  (c)  an  assessment  of  the risk of harm posed by the technology; the
risk that the technology may result  in  or  contribute  to  inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy  may  dissuade  New  Yorkers from participating in contact tracing or
obtaining medical testing or  treatment;  and  the  risk  that  personal
information  or  emergency health data can be accessed by third parties,
including, but not limited to law enforcement agencies  and  U.S.  Immi-
gration and Customs Enforcement; and
  (d)  the measures the covered entity will employ to minimize the risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e) an assessment of whether the covered entity has  followed  through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2.  The audits required by this subdivision shall be made fully avail-
able to the public.
  § 5. 1. Private right of action.
  (a) Any individual alleging a violation of this act  or  a  regulation
promulgated  under  this  act  may  bring a civil action in any court of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with respect to the personal information of an individual constitutes  a
rebuttable presumption of harm to that individual.
  (c)  In  a civil action in which the plaintiff prevails, the court may
award:
  (i) liquidated damages of ten  thousand  dollars  or  actual  damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d)  In  addition  to  any relief awarded pursuant to paragraph (c) of
this subdivision, the court shall award reasonable attorney's  fees  and
costs to any prevailing plaintiff.
  2.  The attorney general may bring an action in the name of the state,
or as parens patriae on behalf of persons  residing  in  the  state,  to
enforce the provisions of this act. In an action brought by the attorney
general,  the  court  may award injunctive relief, including preliminary
injunctions, to prevent further violations of and compel compliance with
this act;  civil  penalties  up  to  twenty-five  thousand  dollars  per
violation  or  up  to  four percent of annual revenue; other appropriate

A. 10583--A                         6

relief, including restitution, to redress harms  to  individuals  or  to
mitigate  all  substantial  risk of harm; and any other relief the court
determines.
  §  6.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                10583--B

                          I N  A S S E M B L Y

                              June 4, 2020
                               ___________

Introduced  by  COMMITTEE  ON RULES -- (at request of M. of A. L. Rosen-
  thal) -- read once and referred to the Committee on Health --  commit-
  tee  discharged, bill amended, ordered reprinted as amended and recom-
  mitted to said committee -- again reported from  said  committee  with
  amendments,  ordered  reprinted  as  amended  and  recommitted to said
  committee

AN ACT in relation to  the  collection  of  emergency  health  data  and
  personal information and the use of technology to aid during COVID-19;
  and  providing  for  the  repeal of such provision upon the expiration
  thereof

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1.  "Collect"  means  to buy, rent, gather, obtain, receive, or access
any personal information pertaining  to  an  individual  by  any  means,
online  or  offline, including but not limited to, receiving information
from the individual or from a third party,  actively  or  passively,  or
obtaining information by observing an individual's behavior.
  2. "Covered entity" means any person, including a government entity:
  (a)  that  collects, processes, or discloses emergency health data, as
defined in this act, electronically or through communication by wire  or
radio; or
  (b)  that  develops  or  operates  a  website, web application, mobile
application, mobile operating system feature, or smart  device  applica-
tion  for  the purpose of tracking, screening, monitoring, contact trac-
ing, or mitigation, or  otherwise  responding  to  the  COVID-19  public
health emergency.
  3.  "De-identified  information" means information that cannot reason-
ably identify, relate to, describe, be capable of being associated with,
or be linked, directly or indirectly, to a particular individual, house-
hold, or device.  A covered entity that uses de-identified information:
  (a) has implemented technical safeguards that prohibit  re-identifica-
tion of the individual to whom the information may pertain;

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.

                                                           LBD16478-13-0

A. 10583--B                         2

  (b)  has  implemented  business  processes  that specifically prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  4. "Disclose" means any action, set of actions, or omission in which a
covered entity makes personal information available to  another  person,
intentionally or unintentionally, including but not limited to, sharing,
publishing,  releasing,  transferring,  disseminating, making available,
selling, leasing, providing access to, failing to restrict access to, or
otherwise communicating orally, in writing, electronically,  or  by  any
other means.
  5. "Emergency health data" means data linked or reasonably linkable to
an  individual, household, or device, including data inferred or derived
about the individual, household, or device  from  other  collected  data
provided  such  data is still linked or reasonably linkable to the indi-
vidual, household, or device, that concerns the public  COVID-19  health
emergency. Such data includes:
  (a)  Information that reveals the past, present, or future physical or
behavioral health or condition of, or provision  of  healthcare  to,  an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data that can be used to infer health status, health  history,  location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the  past  or  present  precise  physical location of an individual at a
specific point in time, taking account of population densities,  includ-
ing  cell-site  location  information,  triangulation  data derived from
nearby wireless or  radio  frequency  networks  and  global  positioning
system data;
  (ii)  proximity data, when such term means information that identifies
or estimates the past or present physical proximity of one individual or
device to another, including information derived from  Bluetooth,  audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv)  contact information for identifiable individuals or a history of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  6. "Individual" means a natural person whom the covered  entity  knows
or has reason to know is located in New York state.
  7.  "Personal  information" means information that identifies, relates
to, describes, is capable of being associated with, or could  reasonably
be  linked,  directly  or  indirectly,  with  a particular individual or
household, or device.
  8. "Process" means  any  operation  or  set  of  operations  that  are
performed on personal data by either automated or not automated means.
  9.  "Public  health  authority" means the New York state department of
health, a county health department or the New York  city  department  of
health and mental hygiene, or a person or entity acting under a grant of
authority  from  or  contract  with  such  public  agency, including the

A. 10583--B                         3

employees or agents of such public agency or its contractors or  persons
to  entities  to  whom it has granted authority, that is responsible for
public health matters as part of its official mandate.
  § 2. Individual rights.
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i)  process the individual's personal information or emergency health
data; and
  (ii) make any changes in the processing of the  individual's  personal
information or emergency health data.
  (b)  It shall be unlawful for a covered entity to collect, process, or
disclose emergency health data or personal information unless:
  (i) the individual to whom the data pertains has freely given, specif-
ic, informed, and unambiguous consent to such collection, processing, or
disclosure; or
  (ii) such collection, processing, or disclosure is necessary  and  for
the sole purpose of:
  (A)  protecting  against  malicious, deceptive, fraudulent, or illegal
activity; or
  (B) detecting, responding to,  or  preventing  security  incidents  or
threats.
  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld or withdrawn.
  2. The individual's right to privacy. (a) All  emergency  health  data
and  personal information shall be collected at a minimum level of iden-
tifiability reasonably needed for  the  completion  of  the  transaction
disclosed  to, affirmatively consented to, and requested by the individ-
ual. For a covered entity using proximity tracing or exposure  notifica-
tion  this  includes  changing  temporary anonymous identifiers at least
once in a 20 minute period.
  (b) A covered entity shall not process personal information  or  emer-
gency  health  data beyond what is adequate, relevant, and necessary for
the completion of the transaction disclosed to, affirmatively  consented
to, and requested by the individual.
  (c)  A  covered  entity  shall  not  process  emergency health data or
personal information for any purpose  not  authorized  under  this  act,
including:
  (i)  commercial  advertising,  recommendation  for  e-commerce, or the
training of machine learning algorithms related to, or subsequently  for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,  marketing,  or  otherwise  commercially  contracting   for
employment, finance, credit, insurance, housing, or education; or
  (iii)  segregating, discriminating in, or otherwise making unavailable
the goods, services, facilities,  privileges,  advantages,  or  accommo-
dations of any place of public accommodation (as such term is defined in

A. 10583--B                         4

section  301  of the Americans with Disabilities Act of 1990), except as
authorized by a state or federal government entity for a  public  health
purpose;  provided  that  a  covered  entity shall not process emergency
health  data or personal information to make categorical decisions about
the allocation of care based on disability.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual a privacy policy, at a fourth grade reading level or
below and in the language the entity regularly uses to communicate  with
the  individual,  prior  to  or  at the point of collection of emergency
health data or personal information:
  (i) detailing how and for what purpose the  covered  entity  collects,
processes, and discloses emergency health data and personal information;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data and  personal  informa-
tion; and
  (iii)  describing  how  an  individual  may exercise rights under this
section.
  (b) A covered entity shall create transparency reports, at least  once
every 90 days, that include:
  (i)  the number of individuals whose emergency health data or personal
information the covered entity collected or processed;
  (ii) the categories of emergency health data and personal  information
collected, processed, or disclosed;
  (iii) the purposes for which each category of emergency health data or
personal information was collected, processed, or disclosed;
  (iv)  the number of requests for individuals' emergency health data or
personal information, including information on who the emergency  health
data or personal information was disclosed to; and
  (v)  the  number  of instances where emergency health data or personal
information was produced, in whole or in part, without  prior,  explicit
consents by the individuals specified in the request.
  (c) The covered entity shall make each transparency report persistent-
ly available and readily accessible on such entity's website.
  4.  Time  limitation  on  retention.  (a)  Emergency  health  data and
personal information shall be  deleted  when  the  initial  purpose  for
collecting  or obtaining such data has been satisfied or within 30 days,
whichever occurs  first,  except  that  proximity  tracing  or  exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5.  Access  rights. (a) Emergency health data and personal information
shall be disclosed only as necessary to provide the service requested by
an individual.
  (b) A covered entity may  share  aggregate,  de-identified  data  with
public health authorities.
  (c)  A  covered  entity  shall  not  disclose emergency health data or
personal information to  a  third  party  unless  that  third  party  is
contractually  bound  to the covered entity to meet the same privacy and
security obligations as the covered entity.
  (d) No covered entity  in  possession  of  emergency  health  data  or
personal  information may disclose, redisclose, or otherwise disseminate
an individual's emergency health data or personal information unless the
subject of the emergency health data  or  personal  information  or  the
subject's  legally  authorized representative consents in writing to the
disclosure or redisclosure.
  (e) Without consent under subdivision one of this  section,  emergency
health  data,  personal  information, and any evidence derived therefrom

A. 10583--B                         5

shall not be subject to or provided in response to any legal process  or
be  admissible  for any purpose in any judicial or administrative action
or proceeding.
  (f)  Individuals  shall  have the right to access the emergency health
data and personal information collected on them and correct any  inaccu-
racies.
  (i)  A  covered  entity  must  comply  with an individual's request to
correct emergency health data or personal information not later than  30
days after receiving a verifiable request from the individual or, in the
case of a minor, the individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data or personal information shall  implement  and  maintain  reasonable
security  procedures  and practices, including administrative, physical,
and technical safeguards, appropriate to the nature of  the  information
and  the  purposes  for  which  that  information  will be processed, to
protect  that  information  from  unauthorized  processing,  disclosure,
access, destruction, or modification.
  3.  A  covered  entity shall limit access to emergency health data and
personal information to authorized essential personnel whose use of  the
data  is  reasonably necessary to operate the program and record who has
accessed emergency health data or  personal  information,  the  date  of
access, and for what purposes.
  §  4.  1.  All  covered  entities  shall  be  subject  to  annual data
protection audits, conducted by a neutral third party auditor,  evaluat-
ing  the  technology  utilized and the development processes for statis-
tical impacts on classes protected under section 296 of  article  15  of
the  executive law, as well as for impacts on privacy and security, that
includes at a minimum:
  (a) a detailed description of the  technology,  its  design,  and  its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in  light of its purpose, taking into account relevant factors including
data minimization practices; the duration for which personal information
and emergency health data and the  results  of  the  data  analysis  are
stored;  what  information  about  the  technology  is  available to the
public; and the recipients of the results of the technology;
  (c) an assessment of the risk of harm posed  by  the  technology;  the
risk  that  the  technology  may  result in or contribute to inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy may dissuade New Yorkers from participating  in  contact  tracing  or
obtaining  medical  testing  or  treatment;  and  the risk that personal
information or emergency health data can be accessed by  third  parties,
including,  but  not  limited to law enforcement agencies and U.S. Immi-
gration and Customs Enforcement; and

A. 10583--B                         6

  (d) the measures the covered entity will employ to minimize the  risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e)  an  assessment of whether the covered entity has followed through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2. The covered entity shall make the audit persistently available  and
readily accessible on such entity's website.
  3. The cost of the audit shall be paid by the covered entity.
  § 5. 1. Private right of action.
  (a)  Any  individual  alleging a violation of this act or a regulation
promulgated under this act may bring a civil  action  in  any  court  of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with  respect to the personal information of an individual constitutes a
rebuttable presumption of harm to that individual.
  (c) In a civil action in which the plaintiff prevails, the  court  may
award:
  (i)  liquidated  damages  of  ten  thousand dollars or actual damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d) In addition to any relief awarded pursuant  to  paragraph  (c)  of
this  subdivision,  the court shall award reasonable attorney's fees and
costs to any prevailing plaintiff.
  2. The attorney general may bring an action in the name of the  state,
or  as  parens  patriae  on  behalf of persons residing in the state, to
enforce the provisions of this act. In an action brought by the attorney
general, the court may award injunctive  relief,  including  preliminary
injunctions, to prevent further violations of and compel compliance with
this  act;  civil  penalties  up  to  twenty-five  thousand  dollars per
violation or up to four percent of  annual  revenue;  other  appropriate
relief,  including  restitution,  to  redress harms to individuals or to
mitigate all substantial risk of harm; and any other  relief  the  court
determines.
  §  6.  Severability.  If any clause, sentence, paragraph, subdivision,
section or part of this act shall be adjudged by any court of  competent
jurisdiction  to  be invalid, such judgment shall not affect, impair, or
invalidate the remainder thereof, but shall be confined in its operation
to the clause, sentence, paragraph, subdivision, section or part thereof
directly involved in the controversy in which such judgment  shall  have
been rendered. It is hereby declared to be the intent of the legislature
that  this  act  would have been enacted even if such invalid provisions
had not been included herein.
  § 7. This act shall take effect on the thirtieth day  after  it  shall
have  become  a  law  and shall expire and be deemed repealed January 1,
2023.