The New York State Senate

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  8448

                            I N  S E N A T E

                              June 3, 2020
                               ___________

Introduced  by  Sen.  THOMAS -- read twice and ordered printed, and when
  printed to be committed to the Committee on Internet and Technology

AN ACT in relation to the collection of emergency health  data  and  the
  use of technology assisted contact tracing to aid during COVID-19; and
  providing for the repeal of such provision upon the expiration thereof

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Covered entity" means any person, including a government entity:
  (a) that collects,  uses,  or  discloses  emergency  health  data,  as
defined  in this act, electronically or through communication by wire or
radio; or
  (b) that develops or  operates  a  website,  web  application,  mobile
application,  mobile  operating system feature, or smart device applica-
tion for the purpose of tracking, screening, monitoring,  contact  trac-
ing,  or  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency.
  2. "De-identified information" means information that  cannot  reason-
ably identify, relate to, describe, be capable of being associated with,
or  be  linked,  directly  or  indirectly, to a particular individual. A
covered entity that uses de-identified information:
  (a) has implemented technical safeguards that prohibit  re-identifica-
tion of the individual to whom the information may pertain;
  (b)  has  implemented  business  processes  that specifically prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  3. "Emergency health data" means data linked or reasonably linkable to
an  individual  or  device, including data inferred or derived about the
individual or device from other collected data  provided  such  data  is
still  linked  or  reasonably linkable to the individual or device, that
concerns the public COVID-19 health emergency. Such data includes:

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.

                                                           LBD16478-01-0

S. 8448                             2

  (a) Information that reveals the past, present, or future physical  or
behavioral  health  or  condition  of, or provision of healthcare to, an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data or for the purpose  of  tracking,  screening,  monitoring,  contact
tracing,  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency including:
  (i) geolocation data, when such term means data capable of determining
the past or present precise physical location  of  an  individual  at  a
specific  point in time, taking account of population densities, includ-
ing cell-site location  information,  triangulation  data  derived  from
nearby  wireless  or  radio  frequency  networks  and global positioning
system data;
  (ii) proximity data, when such term means information that  identifies
or estimates the past or present physical proximity of one individual or
device  to  another, including information derived from Bluetooth, audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv) contact information for identifiable individuals or a history  of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  4. "Technology assisted contact tracing" means technology that sends a
steady  supply of information, including location information, movement,
social encounters, phone numbers, and health data, to a central authori-
ty.
  5. "Personal information" means information that  identifies,  relates
to,  describes, is capable of being associated with, or could reasonably
be linked, directly or indirectly, with a particular consumer or  house-
hold.
  6.  "Process"  means  any  operation  or  set  of  operations that are
performed on personal data by either automated or not automated means.
  § 2. Any entity creating, developing, or marketing technology assisted
contact tracing to aid during the COVID-19 public health emergency  must
disclose  the  following  information at a fourth grade reading level or
below and in the language the entity regularly uses to communicate  with
the individual:
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's emergency health data; and
  (ii)  make any changes in the processing of the individual's emergency
health data.
  (b) It shall be unlawful for a covered  entity  to  collect,  use,  or
disclose emergency health data unless:
  (i) the individual to whom the data pertains has freely given, specif-
ic,  informed,  and  unambiguous  consent  to  such  collection, use, or
disclosure; or
  (ii) such collection, use, or disclosure is necessary and for the sole
purpose of:

S. 8448                             3

  (A) protecting against malicious, deceptive,  fraudulent,  or  illegal
activity; or
  (B)  detecting,  responding  to,  or  preventing security incidents or
threats; or
  (iii) the covered entity is compelled to do so by  a  court  order  or
other legal obligation.
  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld.
  2. The individual's right to privacy. (a) All data collected  for  the
purpose  of  tracking,  screening, monitoring, contact tracing, or miti-
gation, or otherwise responding to the COVID-19 public health  emergency
shall  be  collected  at  a  minimum level of identifiability reasonably
needed for tracking COVID-19. For a covered entity using proximity trac-
ing or exposure notification this includes changing pseudonyms or tempo-
rary anonymous identifiers at least once in a twelve hour period.
  (b) A covered entity shall not  process  personal  information  beyond
what  is  adequate,  relevant,  and  necessary for the completion of the
transaction disclosed to, affirmatively consented to, and  requested  by
the individual.
  (c)  A  covered  entity  shall not collect, use, or disclose emergency
health data for any purpose not authorized under this act, including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or  education  opportu-
nities  in  a manner that discriminates or otherwise makes opportunities
unavailable on the basis of data; or
  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual  a  privacy  policy,  prior  to  or  at the point of
collection of emergency health data:
  (i) detailing how and for what purpose the  covered  entity  collects,
uses, and discloses emergency health data;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data; and
  (iii) describing how an individual  may  exercise  rights  under  this
section.
  (b)  A covered entity must develop a written policy, made available to
the public, establishing a retention schedule and guidelines for  perma-
nently  destroying  emergency  health  data when the initial purpose for

S. 8448                             4

collecting or obtaining such data has been satisfied or within two years
of the individual's last interaction with the covered entity,  whichever
occurs  first.  A  covered entity in possession of emergency health data
must  comply  with  its  established  retention schedule and destruction
guidelines.
  (c) A covered entity shall create transparency reports, at least  once
every 90 days, that include:
  (i)  the number of individuals whose emergency health data the covered
entity collected or used;
  (ii) the categories of  emergency  health  data  collected,  used,  or
disclosed;
  (iii)  the  purposes  for which each category of emergency health data
was collected, used, or disclosed;
  (iv) the number of requests for  individuals  emergency  health  data,
including information on who the emergency health data was disclosed to;
and
  (v)  the number of instances where emergency health data was produced,
in whole or in part, without prior, explicit consents by the individuals
specified in the request.
  4. Time limitation on retention. (a) Emergency data collected for  the
purpose  of  tracking,  screening, monitoring, contact tracing, or miti-
gation, or otherwise responding to the COVID-19 public health  emergency
shall  be deleted within 30 days, except that proximity tracing or expo-
sure notification data which shall be  automatically  deleted  every  14
days.
  (b)  A  covered  entity  that stores data for longer than 30 days must
re-engage consent every 30 days. Data shall automatically delete  in  30
days unless consent is properly re-engaged.
  (c) This subdivision shall not apply to de-identified information.
  5.  Access  rights.  (a) Emergency health data shall be shared only as
necessary to provide the service requested by an individual.
  (b) A covered entity may  share  aggregate,  de-identified  data  with
public  health  authorities  solely  for  the limited purposes for which
information can be collected in the first place. No information shall be
shared with law enforcement without a valid court  order,  subpoena,  or
search warrant.
  (c)  A  covered  entity  shall not disclose emergency health data to a
third party unless that  third  party  is  contractually  bound  to  the
covered  entity to meet the same privacy and security obligations as the
covered entity.
  (d) No covered entity in  possession  of  emergency  health  data  may
disclose, redisclose, or otherwise disseminate an individual's emergency
health data unless:
  (i)  the  subject of the personal information or the subject's legally
authorized representative consents  in  writing  to  the  disclosure  or
redisclosure;
  (ii)  the  disclosure  or redisclosure is required by state or federal
law; or
  (iii) the disclosure is required pursuant to a  valid  warrant,  court
order, or subpoena issued by a court of competent jurisdiction.
  (e)  Individuals  shall  have the right to access the emergency health
data collected on them and correct any inaccuracies.
  (i) A covered entity must  comply  with  an  individual's  request  to
correct  emergency  health data not later than 30 days after receiving a
verifiable request from the individual or, in the case of a  minor,  the
individual's parent or guardian.

S. 8448                             5

  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of data.
  2. A covered entity that collects  an  individual's  emergency  health
data  shall  implement  and  maintain reasonable security procedures and
practices, including administrative, physical, and technical safeguards,
appropriate to the nature of the information and the purposes for  which
that  information  will  be used, to protect that information from unau-
thorized use, disclosure, access, destruction, or modification.
  3. A covered entity shall limit access to  emergency  health  data  to
authorized  essential  personnel  whose  use  of  the data is reasonably
necessary to operate the program and record who has  accessed  emergency
health data, the date of access, and for what purposes.
  §  4.  1.  All  covered  entities  shall be subject to data protection
audits evaluating the technology assisted contact tracing  utilized  and
the  development  processes, including the design and training data, for
statistical impacts on classes protected under section 296 of article 15
of the executive law, as well as for impacts on  privacy,  and  security
that includes at a minimum:
  (a) a detailed description of the technology assisted contact tracing,
its design, its training, data, and its purpose;
  (b) an assessment of the relative benefits and costs of the technology
assisted  contact  tracing  in light of its purpose, taking into account
relevant factors including data minimization practices; the duration for
which personal information and the results  of  the  data  analysis  are
stored;  what  information about the technology assisted contact tracing
is available to the public; and the recipients of  the  results  of  the
technology assisted contact tracing;
  (c) an assessment of the risk of harm posed by the technology assisted
contact  tracing and the risk that the technology assisted contact trac-
ing may result in  or  contribute  to  inaccurate,  unfair,  biased,  or
discriminatory decisions impacting individuals; and
  (d)  The  measures  the state agency will employ to minimize the risks
described in paragraph (c) of this subdivision, including  technological
and physical safeguards.
  2.  The audits required by this subdivision shall be made available to
the public.
  § 5. 1. An individual may bring a private right of action in  a  court
of  competent  jurisdiction  to  enforce  any right under this act or to
enjoin any violation of this act.
  2. The attorney general may bring an action in the name of the  state,
or  as  parens  patriae  on  behalf of persons residing in the state, to
enforce the provisions of this act. In an action brought by the attorney
general, the court may award injunction  relief,  including  preliminary
injunctions, to prevent further violations of and compel compliance with
this  act;  civil  penalties  up  to  twenty-five  thousand  dollars per
violation or up to four percent of  annual  revenue;  other  appropriate
relief,  including  restitution,  to  redress harms to individuals or to
mitigate all substantial risk of harm; and any other  relief  the  court
determines.

S. 8448                             6

  §  6.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                 8448--A

                            I N  S E N A T E

                              June 3, 2020
                               ___________

Introduced  by  Sen.  THOMAS -- read twice and ordered printed, and when
  printed to be committed to the Committee on Internet and Technology --
  committee discharged, bill amended, ordered reprinted as  amended  and
  recommitted to said committee

AN  ACT  in  relation to the collection of emergency health data and the
  use of technology to aid during COVID-19; and providing for the repeal
  of such provision upon the expiration thereof

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Covered entity" means any person, including a government entity:
  (a)  that  collects,  uses,  or  discloses  emergency  health data, as
defined in this act, electronically or through communication by wire  or
radio; or
  (b)  that  develops  or  operates  a  website, web application, mobile
application, mobile operating system feature, or smart  device  applica-
tion  for  the purpose of tracking, screening, monitoring, contact trac-
ing, or mitigation, or  otherwise  responding  to  the  COVID-19  public
health emergency.
  2.  "De-identified  information" means information that cannot reason-
ably identify, relate to, describe, be capable of being associated with,
or be linked, directly or indirectly,  to  a  particular  individual.  A
covered entity that uses de-identified information:
  (a)  has implemented technical safeguards that prohibit re-identifica-
tion of the individual to whom the information may pertain;
  (b) has implemented  business  processes  that  specifically  prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  3. "Emergency health data" means data linked or reasonably linkable to
an individual or device, including data inferred or  derived  about  the
individual  or  device  from  other collected data provided such data is

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.

                                                           LBD16478-03-0

S. 8448--A                          2

still linked or reasonably linkable to the individual  or  device,  that
concerns the public COVID-19 health emergency. Such data includes:
  (a)  Information that reveals the past, present, or future physical or
behavioral health or condition of, or provision  of  healthcare  to,  an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data that can be used to infer health status, health  history,  location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the  past  or  present  precise  physical location of an individual at a
specific point in time, taking account of population densities,  includ-
ing  cell-site  location  information,  triangulation  data derived from
nearby wireless or  radio  frequency  networks  and  global  positioning
system data;
  (ii)  proximity data, when such term means information that identifies
or estimates the past or present physical proximity of one individual or
device to another, including information derived from  Bluetooth,  audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv)  contact information for identifiable individuals or a history of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  4.  "Individual" means a natural person whom the covered entity  knows
or has reason to know is located in New York state.
  5.  "Personal  information" means information that identifies, relates
to, describes, is capable of being associated with, or could  reasonably
be  linked,  directly  or  indirectly,  with  a particular individual or
household, or device.
  6. "Process" means  any  operation  or  set  of  operations  that  are
performed on personal data by either automated or not automated means.
  § 2. All covered entities must disclose the following information at a
fourth grade reading level or below and in the language the entity regu-
larly uses to communicate with the individual:
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's emergency health data; and
  (ii)  make any changes in the processing of the individual's emergency
health data.
  (b) It shall be unlawful for a covered  entity  to  collect,  use,  or
disclose emergency health data unless:
  (i) the individual to whom the data pertains has freely given, specif-
ic,  informed,  and  unambiguous  consent  to  such  collection, use, or
disclosure; or
  (ii) such collection, use, or disclosure is necessary and for the sole
purpose of:
  (A) protecting against malicious, deceptive,  fraudulent,  or  illegal
activity; or
  (B)  detecting,  responding  to,  or  preventing security incidents or
threats; or

S. 8448--A                          3

  (iii) the covered entity is compelled to do so by  a  court  order  or
other legal obligation.
  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld or withdrawn.
  2. The individual's right to privacy. (a) All  emergency  health  data
and  personal information shall be collected at a minimum level of iden-
tifiability reasonably needed for tracking COVID-19. For a covered enti-
ty using proximity tracing or exposure notification this includes chang-
ing temporary anonymous identifiers at least once in a 10 minute period.
  (b) A covered entity shall not  process  personal  information  beyond
what  is  adequate,  relevant,  and  necessary for the completion of the
transaction disclosed to, affirmatively consented to, and  requested  by
the individual.
  (c)  A  covered entity shall not process emergency health data for any
purpose not authorized under this act, including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or education; or
  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual  a  privacy  policy,  prior  to  or  at the point of
collection of emergency health data:
  (i) detailing how and for what purpose the  covered  entity  collects,
uses, and discloses emergency health data;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data; and
  (iii) describing how an individual  may  exercise  rights  under  this
section.
  (b)  A covered entity shall create transparency reports, at least once
every 90 days, that include:
  (i) the number of individuals whose emergency health data the  covered
entity collected or used;
  (ii)  the  categories  of  emergency  health  data collected, used, or
disclosed;
  (iii) the purposes for which each category of  emergency  health  data
was collected, used, or disclosed;
  (iv)  the  number  of  requests for individuals emergency health data,
including information on who the emergency health data was disclosed to;
and

S. 8448--A                          4

  (v) the number of instances where emergency health data was  produced,
in whole or in part, without prior, explicit consents by the individuals
specified in the request.
  4.  Time  limitation  on  retention.  (a)  Emergency  health  data and
personal information shall be  deleted  when  the  initial  purpose  for
collecting  or obtaining such data has been satisfied or within 30 days,
whichever occurs  first,  except  that  proximity  tracing  or  exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5. Access rights. (a) Emergency health data shall be disclosed only as
necessary to provide the service requested by an individual.
  (b)  A  covered  entity  may  share aggregate, de-identified data with
public health authorities.
  (c) A covered entity shall not disclose emergency  health  data  to  a
third  party  unless  that  third  party  is  contractually bound to the
covered entity to meet the same privacy and security obligations as  the
covered entity.
  (d)  No  covered  entity  in  possession  of emergency health data may
disclose, redisclose, or otherwise disseminate an individual's emergency
health data unless:
  (i) the subject of the personal information or the  subject's  legally
authorized  representative  consents  in  writing  to  the disclosure or
redisclosure; or
  (ii) the disclosure or redisclosure is required by  state  or  federal
law.
  (e)  Individuals  shall  have the right to access the emergency health
data collected on them and correct any inaccuracies.
  (i) A covered entity must  comply  with  an  individual's  request  to
correct  emergency  health data not later than 30 days after receiving a
verifiable request from the individual or, in the case of a  minor,  the
individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data shall implement and maintain  reasonable  security  procedures  and
practices, including administrative, physical, and technical safeguards,
appropriate  to the nature of the information and the purposes for which
that information will be used, to protect that  information  from  unau-
thorized use, disclosure, access, destruction, or modification.
  3.  A  covered  entity  shall limit access to emergency health data to
authorized essential personnel whose  use  of  the  data  is  reasonably
necessary  to  operate the program and record who has accessed emergency
health data, the date of access, and for what purposes.
  § 4. 1. All covered entities  shall  be  subject  to  data  protection
audits  evaluating the technology utilized and the development processes
for statistical impacts on classes protected under section 296 of  arti-
cle  15  of  the  executive  law, as well as for impacts on privacy, and
security that includes at a minimum:

S. 8448--A                          5

  (a) a detailed description of the  technology,  its  design,  and  its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in  light of its purpose, taking into account relevant factors including
data minimization practices; the duration for which personal information
and the results of the data analysis are stored; what information  about
the  technology  is  available  to the public; and the recipients of the
results of the technology;
  (c) an assessment of the risk of harm posed  by  the  technology;  the
risk  that  the  technology  may  result in or contribute to inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy may dissuade New Yorkers from participating  in  contact  tracing  or
obtaining  medical  testing  or  treatment;  and  the risk that personal
information or emergency health data can be accessed by  third  parties,
including,  but  not  limited to law enforcement agencies and U.S. Immi-
gration and Customs Enforcement; and
  (d) the measures the covered entity will employ to minimize the  risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e)  an  assessment of whether the covered entity has followed through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2. The audits required by this subdivision shall be made fully  avail-
able to the public.
  §  5.  1. An individual may bring a private right of action in a court
of competent jurisdiction to enforce any right  under  this  act  or  to
enjoin any violation of this act.
  (a)  Any  individual  alleging a violation of this act or a regulation
promulgated under this act may bring a civil  action  in  any  court  of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with  respect to the personal information of an individual constitutes a
rebuttable presumption of harm to that individual.
  (c) In a civil action in which the plaintiff prevails, the  court  may
award:
  (i)  liquidated  damages  of  ten  thousand dollars or actual damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d) In addition to any relief awarded pursuant  to  paragraph  (c)  of
this  subdivision,  the court shall award reasonable attorney's fees and
costs to any prevailing plaintiff.
  2. The attorney general may bring an action in the name of the  state,
or  as  parens  patriae  on  behalf of persons residing in the state, to
enforce the provisions of this act. In an action brought by the attorney
general, the court may award injunctive  relief,  including  preliminary
injunctions, to prevent further violations of and compel compliance with
this  act;  civil  penalties  up  to  twenty-five  thousand  dollars per
violation or up to four percent of  annual  revenue;  other  appropriate
relief,  including  restitution,  to  redress harms to individuals or to
mitigate all substantial risk of harm; and any other  relief  the  court
determines.

S. 8448--A                          6

  §  6.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                 8448--B

                            I N  S E N A T E

                              June 3, 2020
                               ___________

Introduced  by  Sen.  THOMAS -- read twice and ordered printed, and when
  printed to be committed to the Committee on Internet and Technology --
  committee discharged, bill amended, ordered reprinted as  amended  and
  recommitted  to  said committee -- committee discharged, bill amended,
  ordered reprinted as amended and recommitted to said committee

AN ACT in relation to the collection of emergency health  data  and  the
  use of technology to aid during COVID-19; and providing for the repeal
  of such provision upon the expiration thereof

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Covered entity" means any person, including a government entity:
  (a) that collects,  uses,  or  discloses  emergency  health  data,  as
defined  in this act, electronically or through communication by wire or
radio; or
  (b) that develops or  operates  a  website,  web  application,  mobile
application,  mobile  operating system feature, or smart device applica-
tion for the purpose of tracking, screening, monitoring,  contact  trac-
ing,  or  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency.
  2. "De-identified information" means information that  cannot  reason-
ably identify, relate to, describe, be capable of being associated with,
or be linked, directly or indirectly, to a particular individual, house-
hold, or device.  A covered entity that uses de-identified information:
  (a)  has implemented technical safeguards that prohibit re-identifica-
tion of the individual to whom the information may pertain;
  (b) has implemented  business  processes  that  specifically  prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  3. "Emergency health data" means data linked or reasonably linkable to
an individual or device, including data inferred or  derived  about  the
individual, household, or device from other collected data provided such

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets

                      [ ] is old law to be omitted.
                                                           LBD16478-04-0

S. 8448--B                          2

data  is  still  linked or reasonably linkable to the individual, house-
hold, or device, that concerns the  public  COVID-19  health  emergency.
Such data includes:
  (a)  Information that reveals the past, present, or future physical or
behavioral health or condition of, or provision  of  healthcare  to,  an
individual including:
  (i) data derived from the testing or examination;
  (ii)  whether  or not an individual has contracted or been tested for,
or an estimate of  the  likelihood  that  a  particular  individual  may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b)  Other  data  collected in conjunction with other emergency health
data that can be used to infer health status, health  history,  location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the  past  or  present  precise  physical location of an individual at a
specific point in time, taking account of population densities,  includ-
ing  cell-site  location  information,  triangulation  data derived from
nearby wireless or  radio  frequency  networks  and  global  positioning
system data;
  (ii)  proximity data, when such term means information that identifies
or estimates the past or present physical proximity of one individual or
device to another, including information derived from  Bluetooth,  audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv)  contact information for identifiable individuals or a history of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  4.  "Individual" means a natural person whom the covered entity  knows
or has reason to know is located in New York state.
  5.  "Personal  information" means information that identifies, relates
to, describes, is capable of being associated with, or could  reasonably
be  linked,  directly  or  indirectly,  with  a particular individual or
household, or device.
  6. "Process" means  any  operation  or  set  of  operations  that  are
performed on personal data by either automated or not automated means.
  7.  "Public  health  authority" means the New York state department of
health, a county health department or the New York  city  department  of
health and mental hygiene, or a person or entity acting under a grant of
authority  from  or  contract  with  such  public  agency, including the
employees or agents of such public agency or its contractors or  persons
to  entities  to  whom it has granted authority, that is responsible for
public health matters as part of its official mandate.
  § 2. All covered entities must disclose the following information at a
fourth grade reading level or below and in the language the entity regu-
larly uses to communicate with the individual:
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's personal information or emergency  health
data; and
  (ii)  make  any changes in the processing of the individual's personal
information or emergency health data.
  (b) It shall be unlawful for a covered  entity  to  collect,  use,  or
disclose emergency health data unless:

S. 8448--B                          3

  (i) the individual to whom the data pertains has freely given, specif-
ic,  informed,  and  unambiguous  consent  to  such  collection, use, or
disclosure; or
  (ii) such collection, use, or disclosure is necessary and for the sole
purpose of:
  (A)  protecting  against  malicious, deceptive, fraudulent, or illegal
activity; or
  (B) detecting, responding to,  or  preventing  security  incidents  or
threats.
  (c) To the extent that a covered entity must process internet protocol
addresses,  system  configuration  information, URLs of referring pages,
locale and language preferences, keystrokes, and other personal informa-
tion in order to obtain individuals' freely given,  specific,  informed,
and unambiguous opt-in consent, the entity:
  (i)  shall  only process the personal information necessary to request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii) shall process the personal information solely to  request  freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii)  shall immediately delete the personal information if consent is
withheld or withdrawn.
  2. The individual's right to privacy. (a) All  emergency  health  data
and  personal information shall be collected at a minimum level of iden-
tifiability reasonably needed for tracking COVID-19. For a covered enti-
ty using proximity tracing or exposure notification this includes chang-
ing temporary anonymous identifiers at least once in a 10 minute period.
  (b) A covered entity shall not  process  personal  information  beyond
what  is  adequate,  relevant,  and  necessary for the completion of the
transaction disclosed to, affirmatively consented to, and  requested  by
the individual.
  (c)  A  covered entity shall not process emergency health data for any
purpose not authorized under this act, including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or education; or
  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual  a  privacy  policy,  prior  to  or  at the point of
collection of emergency health data:
  (i) detailing how and for what purpose the  covered  entity  collects,
uses, and discloses emergency health data;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data; and
  (iii) describing how an individual  may  exercise  rights  under  this
section.
  (b)  A covered entity shall create transparency reports, at least once
every 90 days, that include:
  (i) the number of individuals whose emergency health data the  covered
entity collected or used;

S. 8448--B                          4

  (ii)  the  categories  of  emergency  health  data collected, used, or
disclosed;
  (iii)  the  purposes  for which each category of emergency health data
was collected, used, or disclosed;
  (iv) the number of requests for  individuals  emergency  health  data,
including information on who the emergency health data was disclosed to;
and
  (v)  the number of instances where emergency health data was produced,
in whole or in part, without prior, explicit consents by the individuals
specified in the request.
  4. Time  limitation  on  retention.  (a)  Emergency  health  data  and
personal  information  shall  be  deleted  when  the initial purpose for
collecting or obtaining such data has been satisfied or within 30  days,
whichever  occurs  first,  except  that  proximity  tracing  or exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5. Access rights. (a) Emergency health data shall be disclosed only as
necessary to provide the service requested by an individual.
  (b) A covered entity may  share  aggregate,  de-identified  data  with
public health authorities.
  (c)  A  covered  entity  shall not disclose emergency health data to a
third party unless that  third  party  is  contractually  bound  to  the
covered  entity to meet the same privacy and security obligations as the
covered entity.
  (d) No covered entity in  possession  of  emergency  health  data  may
disclose, redisclose, or otherwise disseminate an individual's emergency
health  data  unless  the  subject  of  the  personal information or the
subject's legally authorized representative consents in writing  to  the
disclosure or redisclosure.
  (e)  Individuals  shall  have the right to access the emergency health
data collected on them and correct any inaccuracies.
  (i) A covered entity must  comply  with  an  individual's  request  to
correct  emergency  health data not later than 30 days after receiving a
verifiable request from the individual or, in the case of a  minor,  the
individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data shall implement and maintain  reasonable  security  procedures  and
practices, including administrative, physical, and technical safeguards,
appropriate  to the nature of the information and the purposes for which
that information will be used, to protect that  information  from  unau-
thorized use, disclosure, access, destruction, or modification.
  3.  A  covered  entity  shall limit access to emergency health data to
authorized essential personnel whose  use  of  the  data  is  reasonably
necessary  to  operate the program and record who has accessed emergency
health data, the date of access, and for what purposes.

S. 8448--B                          5

  § 4. 1. All covered entities  shall  be  subject  to  data  protection
audits, conducted by a neutral third party auditor, evaluating the tech-
nology utilized and the development processes for statistical impacts on
classes  protected under section 296 of article 15 of the executive law,
as well as for impacts on privacy, and security that includes at a mini-
mum:
  (a)  a  detailed  description  of  the technology, its design, and its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in light of its purpose, taking into account relevant factors  including
data minimization practices; the duration for which personal information
and  the results of the data analysis are stored; what information about
the technology is available to the public; and  the  recipients  of  the
results of the technology;
  (c)  an  assessment  of  the risk of harm posed by the technology; the
risk that the technology may result  in  or  contribute  to  inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy  may  dissuade  New  Yorkers from participating in contact tracing or
obtaining medical testing or  treatment;  and  the  risk  that  personal
information  or  emergency health data can be accessed by third parties,
including, but not limited to law enforcement agencies  and  U.S.  Immi-
gration and Customs Enforcement; and
  (d)  the measures the covered entity will employ to minimize the risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e) an assessment of whether the covered entity has  followed  through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2.  The audits required by this subdivision shall be made fully avail-
able to the public.
  § 5. 1. Private right of action.
  (a) Any individual alleging a violation of this act  or  a  regulation
promulgated  under  this  act  may  bring a civil action in any court of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with respect to the personal information of an individual constitutes  a
rebuttable presumption of harm to that individual.
  (c)  In  a civil action in which the plaintiff prevails, the court may
award:
  (i) liquidated damages of ten  thousand  dollars  or  actual  damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d)  In  addition  to  any relief awarded pursuant to paragraph (c) of
this subdivision, the court shall award reasonable attorney's  fees  and
costs to any prevailing plaintiff.
  2.  The attorney general may bring an action in the name of the state,
or as parens patriae on behalf of persons  residing  in  the  state,  to
enforce the provisions of this act. In an action brought by the attorney
general,  the  court  may award injunctive relief, including preliminary
injunctions, to prevent further violations of and compel compliance with
this act;  civil  penalties  up  to  twenty-five  thousand  dollars  per
violation  or  up  to  four percent of annual revenue; other appropriate

S. 8448--B                          6

relief, including restitution, to redress harms  to  individuals  or  to
mitigate  all  substantial  risk of harm; and any other relief the court
determines.
  §  6.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                 8448--C

                            I N  S E N A T E

                              June 3, 2020
                               ___________

Introduced  by  Sens. THOMAS, BAILEY, CARLUCCI, GOUNARDES, HOYLMAN, MAY,
  RAMOS, STAVISKY -- read twice and ordered printed, and when printed to
  be committed to the Committee on Internet and Technology --  committee
  discharged, bill amended, ordered reprinted as amended and recommitted
  to  said  committee  --  committee  discharged,  bill amended, ordered
  reprinted as amended and recommitted to said  committee  --  committee
  discharged, bill amended, ordered reprinted as amended and recommitted
  to said committee

AN  ACT  in  relation  to  the  collection  of emergency health data and
  personal information and the use of technology to aid during COVID-19;
  and providing for the repeal of such  provision  upon  the  expiration
  thereof

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. For the purposes of this act:
  1. "Collect" means to buy, rent, gather, obtain,  receive,  or  access
any  personal  information  pertaining  to  an  individual by any means,
online or offline, including but not limited to,  receiving  information
from  the  individual  or  from a third party, actively or passively, or
obtaining information by observing an individual's behavior.
  2. "Covered entity" means any person, including a government entity:
  (a) that collects, processes, or discloses emergency health  data,  as
defined  in this act, electronically or through communication by wire or
radio; or
  (b) that develops or  operates  a  website,  web  application,  mobile
application,  mobile  operating system feature, or smart device applica-
tion for the purpose of tracking, screening, monitoring,  contact  trac-
ing,  or  mitigation,  or  otherwise  responding  to the COVID-19 public
health emergency.
  3. "De-identified information" means information that  cannot  reason-
ably identify, relate to, describe, be capable of being associated with,
or be linked, directly or indirectly, to a particular individual, house-
hold, or device.  A covered entity that uses de-identified information:

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.

                                                           LBD16478-12-0

S. 8448--C                          2

  (a)  has implemented technical safeguards that prohibit re-identifica-
tion of the individual to whom the information may pertain;
  (b)  has  implemented  business  processes  that specifically prohibit
re-identification of the information;
  (c)  has  implemented  business  processes  that  prevent  inadvertent
release of de-identified information; and
  (d) makes no attempt to re-identify the information.
  4. "Disclose" means any action, set of actions, or omission in which a
covered  entity  makes personal information available to another person,
intentionally or unintentionally, including but not limited to, sharing,
publishing, releasing, transferring,  disseminating,  making  available,
selling, leasing, providing access to, failing to restrict access to, or
otherwise  communicating  orally,  in writing, electronically, or by any
other means.
  5. "Emergency health data" means data linked or reasonably linkable to
an individual, household, or device, including data inferred or  derived
about  the  individual,  household,  or device from other collected data
provided such data is still linked or reasonably linkable to  the  indi-
vidual,  household,  or device, that concerns the public COVID-19 health
emergency. Such data includes:
  (a) Information that reveals the past, present, or future physical  or
behavioral  health  or  condition  of, or provision of healthcare to, an
individual including:
  (i) data derived from the testing or examination;
  (ii) whether or not an individual has contracted or been  tested  for,
or  an  estimate  of  the  likelihood  that  a particular individual may
contract, such disease or disorder; and
  (iii) genetic data, biological samples and biometrics; and
  (b) Other data collected in conjunction with  other  emergency  health
data  that  can be used to infer health status, health history, location
or associations, including:
  (i) geolocation data, when such term means data capable of determining
the past or present precise physical location  of  an  individual  at  a
specific  point in time, taking account of population densities, includ-
ing cell-site location  information,  triangulation  data  derived  from
nearby  wireless  or  radio  frequency  networks  and global positioning
system data;
  (ii) proximity data, when such term means information that  identifies
or estimates the past or present physical proximity of one individual or
device  to  another, including information derived from Bluetooth, audio
signatures, nearby wireless networks, and near field communications;
  (iii) demographic data;
  (iv) contact information for identifiable individuals or a history  of
the individual's contacts over a period of time, such as an address book
or call log; and
  (v) any other data collected from a personal device.
  6.  "Individual"  means a natural person whom the covered entity knows
or has reason to know is located in New York state.
  7. "Personal information" means information that  identifies,  relates
to,  describes, is capable of being associated with, or could reasonably
be linked, directly or  indirectly,  with  a  particular  individual  or
household, or device.
  8.  "Process"  means  any  operation  or  set  of  operations that are
performed on personal data by either automated or not automated means.
  9. "Public health authority" means the New York  state  department  of
health,  a  county  health department or the New York city department of

S. 8448--C                          3

health and mental hygiene, or a person or entity acting under a grant of
authority from or  contract  with  such  public  agency,  including  the
employees  or agents of such public agency or its contractors or persons
to  entities  to  whom it has granted authority, that is responsible for
public health matters as part of its official mandate.
  § 2. Individual rights.
  1. The individual's right to opt-in. (a) A covered entity shall obtain
freely given, specific, informed, and unambiguous opt-in consent from an
individual to:
  (i) process the individual's personal information or emergency  health
data; and
  (ii)  make  any changes in the processing of the individual's personal
information or emergency health data.
  (b) It shall be unlawful for a covered entity to collect, process,  or
disclose emergency health data or personal information unless:
  (i) the individual to whom the data pertains has freely given, specif-
ic, informed, and unambiguous consent to such collection, processing, or
disclosure; or
  (ii)  such  collection, processing, or disclosure is necessary and for
the sole purpose of:
  (A) protecting against malicious, deceptive,  fraudulent,  or  illegal
activity; or
  (B)  detecting,  responding  to,  or  preventing security incidents or
threats.
  (c) To the extent that a covered entity must process internet protocol
addresses, system configuration information, URLs  of  referring  pages,
locale and language preferences, keystrokes, and other personal informa-
tion  in  order to obtain individuals' freely given, specific, informed,
and unambiguous opt-in consent, the entity:
  (i) shall only process the personal information necessary  to  request
freely given, specific, informed, and unambiguous opt-in consent;
  (ii)  shall  process the personal information solely to request freely
given, specific, informed, and unambiguous opt-in consent; and
  (iii) shall immediately delete the personal information if consent  is
withheld or withdrawn.
  2.  The  individual's  right to privacy. (a) All emergency health data
and personal information shall be collected at a minimum level of  iden-
tifiability  reasonably  needed  for  the  completion of the transaction
disclosed to, affirmatively consented to, and requested by the  individ-
ual.  For a covered entity using proximity tracing or exposure notifica-
tion this includes changing temporary  anonymous  identifiers  at  least
once in a 20 minute period.
  (b)  A  covered entity shall not process personal information or emer-
gency health data beyond what is adequate, relevant, and  necessary  for
the  completion of the transaction disclosed to, affirmatively consented
to, and requested by the individual.
  (c) A covered entity  shall  not  process  emergency  health  data  or
personal  information  for  any  purpose  not authorized under this act,
including:
  (i) commercial advertising,  recommendation  for  e-commerce,  or  the
training  of machine learning algorithms related to, or subsequently for
use in, commercial advertising and e-commerce;
  (ii)  soliciting,  offering,  selling,  leasing,  licensing,  renting,
advertising,   marketing,  or  otherwise  commercially  contracting  for
employment, finance, credit, insurance, housing, or education; or

S. 8448--C                          4

  (iii) segregating, discriminating in, or otherwise making  unavailable
the  goods,  services,  facilities,  privileges, advantages, or accommo-
dations of any place of public accommodation (as such term is defined in
section 301 of the Americans with Disabilities Act of 1990),  except  as
authorized  by  a state or federal government entity for a public health
purpose; provided that a covered  entity  shall  not  process  emergency
health  data or personal information to make categorical decisions about
the allocation of care based on disability.
  3. Covered entity privacy policy. (a) A covered entity  shall  provide
to  the  individual a privacy policy, at a fourth grade reading level or
below and in the language the entity regularly uses to communicate  with
the  individual,  prior  to  or  at the point of collection of emergency
health data or personal information:
  (i) detailing how and for what purpose the  covered  entity  collects,
processes, and discloses emergency health data and personal information;
  (ii)  describing the covered entity's data retention and data security
policies and practices for emergency health data and  personal  informa-
tion; and
  (iii)  describing  how  an  individual  may exercise rights under this
section.
  (b) A covered entity shall create transparency reports, at least  once
every 90 days, that include:
  (i)  the number of individuals whose emergency health data or personal
information the covered entity collected or processed;
  (ii) the categories of emergency health data and personal  information
collected, processed, or disclosed;
  (iii) the purposes for which each category of emergency health data or
personal information was collected, processed, or disclosed;
  (iv)  the number of requests for individuals' emergency health data or
personal information, including information on who the emergency  health
data or personal information was disclosed to; and
  (v)  the  number  of instances where emergency health data or personal
information was produced, in whole or in part, without  prior,  explicit
consents by the individuals specified in the request.
  (c) The covered entity shall make each transparency report persistent-
ly available and readily accessible on such entity's website.
  4.  Time  limitation  on  retention.  (a)  Emergency  health  data and
personal information shall be  deleted  when  the  initial  purpose  for
collecting  or obtaining such data has been satisfied or within 30 days,
whichever occurs  first,  except  that  proximity  tracing  or  exposure
notification data which shall be automatically deleted every 14 days.
  (b) This subdivision shall not apply to de-identified information.
  5.  Access  rights. (a) Emergency health data and personal information
shall be disclosed only as necessary to provide the service requested by
an individual.
  (b) A covered entity may  share  aggregate,  de-identified  data  with
public health authorities.
  (c)  A  covered  entity  shall  not  disclose emergency health data or
personal information to  a  third  party  unless  that  third  party  is
contractually  bound  to the covered entity to meet the same privacy and
security obligations as the covered entity.
  (d) No covered entity  in  possession  of  emergency  health  data  or
personal  information may disclose, redisclose, or otherwise disseminate
an individual's emergency health data or personal information unless the
subject of the emergency health data  or  personal  information  or  the

S. 8448--C                          5

subject's  legally  authorized representative consents in writing to the
disclosure or redisclosure.
  (e)  Without  consent under subdivision one of this section, emergency
health data, personal information, and any  evidence  derived  therefrom
shall  not be subject to or provided in response to any legal process or
be admissible for any purpose in any judicial or  administrative  action
or proceeding.
  (f)  Individuals  shall  have the right to access the emergency health
data and personal information collected on them and correct any  inaccu-
racies.
  (i)  A  covered  entity  must  comply  with an individual's request to
correct emergency health data or personal information not later than  30
days after receiving a verifiable request from the individual or, in the
case of a minor, the individual's parent or guardian.
  (ii)  Where  the covered entity has reasonable doubts or cannot verify
the identity of the individual making a request  under  this  paragraph,
the  covered entity may request additional information necessary for the
specific purpose of confirming the identity of the individual.  In  such
cases, the additional information shall not be processed for any purpose
other  than verifying the identity of the individual and must be deleted
immediately upon verification or failure to verify the individual.
  § 3. 1. A covered entity shall implement reasonable measures to ensure
confidentiality, integrity, and availability of  emergency  health  data
and personal information.
  2.  A  covered  entity  that collects an individual's emergency health
data or personal information shall  implement  and  maintain  reasonable
security  procedures  and practices, including administrative, physical,
and technical safeguards, appropriate to the nature of  the  information
and  the  purposes  for  which  that  information  will be processed, to
protect  that  information  from  unauthorized  processing,  disclosure,
access, destruction, or modification.
  3.  A  covered  entity shall limit access to emergency health data and
personal information to authorized essential personnel whose use of  the
data  is  reasonably necessary to operate the program and record who has
accessed emergency health data or  personal  information,  the  date  of
access, and for what purposes.
  §  4.  1.  All  covered  entities  shall  be  subject  to  annual data
protection audits, conducted by a neutral third party auditor,  evaluat-
ing  the  technology  utilized and the development processes for statis-
tical impacts on classes protected under section 296 of  article  15  of
the  executive law, as well as for impacts on privacy and security, that
includes at a minimum:
  (a) a detailed description of the  technology,  its  design,  and  its
purpose;
  (b) an assessment of the relative benefits and costs of the technology
in  light of its purpose, taking into account relevant factors including
data minimization practices; the duration for which personal information
and emergency health data and the  results  of  the  data  analysis  are
stored;  what  information  about  the  technology  is  available to the
public; and the recipients of the results of the technology;
  (c) an assessment of the risk of harm posed  by  the  technology;  the
risk  that  the  technology  may  result in or contribute to inaccurate,
unfair, biased, or discriminatory decisions; the risk that the technolo-
gy may dissuade New Yorkers from participating  in  contact  tracing  or
obtaining  medical  testing  or  treatment;  and  the risk that personal
information or emergency health data can be accessed by  third  parties,

S. 8448--C                          6

including,  but  not  limited to law enforcement agencies and U.S. Immi-
gration and Customs Enforcement; and
  (d)  the measures the covered entity will employ to minimize the risks
described in paragraph (c) of this subdivision, including technological,
legal and physical safeguards;
  (e) an assessment of whether the covered entity has  followed  through
on the promises made in its privacy notice regarding collection, access,
sharing, retention, deletion and sunsetting; and
  (f) if the technology utilizes machine-learning systems, a description
of the training data information.
  2.  The covered entity shall make the audit persistently available and
readily accessible on such entity's website.
  3. The cost of the audit shall be paid by the covered entity.
  § 5. 1. Private right of action.
  (a) Any individual alleging a violation of this act  or  a  regulation
promulgated  under  this  act  may  bring a civil action in any court of
competent jurisdiction.
  (b) A violation of this act or a regulation promulgated under this act
with respect to the personal information of an individual constitutes  a
rebuttable presumption of harm to that individual.
  (c)  In  a civil action in which the plaintiff prevails, the court may
award:
  (i) liquidated damages of ten  thousand  dollars  or  actual  damages,
whichever is greater;
  (ii) punitive damages; and
  (iii) any other relief, including an injunction, that the court deter-
mines is appropriate.
  (d)  In  addition  to  any relief awarded pursuant to paragraph (c) of
this subdivision, the court shall award reasonable attorney's  fees  and
costs to any prevailing plaintiff.
  2.  The attorney general may bring an action in the name of the state,
or as parens patriae on behalf of persons  residing  in  the  state,  to
enforce the provisions of this act. In an action brought by the attorney
general,  the  court  may award injunctive relief, including preliminary
injunctions, to prevent further violations of and compel compliance with
this act;  civil  penalties  up  to  twenty-five  thousand  dollars  per
violation  or  up  to  four percent of annual revenue; other appropriate
relief, including restitution, to redress harms  to  individuals  or  to
mitigate  all  substantial  risk of harm; and any other relief the court
determines.
  § 6. Severability. If any clause,  sentence,  paragraph,  subdivision,
section  or part of this act shall be adjudged by any court of competent
jurisdiction to be invalid, such judgment shall not affect,  impair,  or
invalidate the remainder thereof, but shall be confined in its operation
to the clause, sentence, paragraph, subdivision, section or part thereof
directly  involved  in the controversy in which such judgment shall have
been rendered. It is hereby declared to be the intent of the legislature
that this act would have been enacted even if  such  invalid  provisions
had not been included herein.
  §  7.  This  act shall take effect on the thirtieth day after it shall
have become a law and shall expire and be  deemed  repealed  January  1,
2023.