S T A T E O F N E W Y O R K
________________________________________________________________________
4037
2021-2022 Regular Sessions
I N A S S E M B L Y
February 1, 2021
___________
Introduced by M. of A. ABINANTI -- read once and referred to the Commit-
tee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to establishing a
prohibition on sharing location data with third parties
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. The general business law is amended by adding a new article
29-CCC to read as follows:
ARTICLE 29-CCC
PROHIBITION ON SHARING LOCATION DATA
SECTION 539. DEFINITIONS.
539-A. PROHIBITION ON SHARING LOCATION DATA.
539-B. EXCEPTIONS.
539-C. ENFORCEMENT.
539-D. PENALTIES.
539-E. PRIVATE RIGHT OF ACTION.
539-F. RULEMAKING.
539-G. LOCAL LAWS OR ORDINANCES.
§ 539. DEFINITIONS. AS USED IN THIS ARTICLE, THE FOLLOWING TERMS SHALL
HAVE THE FOLLOWING MEANINGS:
(A) (1) "AUTHORIZED USE" MEANS THE SHARING OF A CUSTOMER'S LOCATION
DATA:
(I) FOR THE PURPOSE OF PROVIDING A SERVICE EXPLICITLY REQUESTED BY
SUCH CUSTOMER;
(II) EXCLUSIVELY FOR THE PURPOSE OF PROVIDING A SERVICE EXPLICITLY
REQUESTED BY SUCH CUSTOMER; AND
(III) WHERE SUCH DATA IS NOT COLLECTED, SHARED, STORED OR OTHERWISE
USED BY A THIRD PARTY FOR ANY PURPOSE OTHER THAN PROVIDING A SERVICE
EXPLICITLY REQUESTED BY SUCH CUSTOMER.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01794-01-1
A. 4037 2
(2) SUCH TERM DOES NOT INCLUDE ANY INSTANCE IN WHICH A CUSTOMER'S
LOCATION DATA IS SHARED IN EXCHANGE FOR PRODUCTS OR SERVICES.
(B) "CUSTOMER" MEANS A CURRENT OR FORMER SUBSCRIBER TO A TELECOMMUNI-
CATIONS CARRIER OR A CURRENT OR FORMER USER OF A MOBILE APPLICATION.
(C) "LOCATION DATA" MEANS INFORMATION RELATED TO THE PHYSICAL OR
GEOGRAPHICAL LOCATION OF A PERSON OR THE PERSON'S MOBILE COMMUNICATIONS
DEVICE, REGARDLESS OF THE PARTICULAR TECHNOLOGICAL METHOD USED TO OBTAIN
THIS INFORMATION.
(D) "MOBILE APPLICATION" MEANS A SOFTWARE PROGRAM THAT RUNS ON THE
OPERATING SYSTEM OF A MOBILE COMMUNICATIONS DEVICE.
(E) "MOBILE APPLICATION DEVELOPER" MEANS A PERSON THAT OWNS, OPERATES
OR MAINTAINS A MOBILE APPLICATION AND MAKES SUCH APPLICATION AVAILABLE
FOR THE USE OF CUSTOMERS, WHETHER FOR A FEE OR OTHERWISE.
(F) "MOBILE COMMUNICATIONS DEVICE" MEANS ANY PORTABLE WIRELESS TELE-
COMMUNICATIONS EQUIPMENT THAT IS UTILIZED FOR THE TRANSMISSION OR RECEP-
TION OF DATA, INCLUDING LOCATION DATA, AND THAT IS OR MAY BE COMMONLY
CARRIED BY OR ON A PERSON OR COMMONLY TRAVELS WITH A PERSON, INCLUDING
IN OR AS PART OF A VEHICLE A PERSON DRIVES.
(G) "MUNICIPALITY" SHALL MEAN ANY COUNTY, CITY, TOWN OR VILLAGE WITHIN
THE STATE.
(H) "SHARE" MEANS TO MAKE LOCATION DATA AVAILABLE TO ANOTHER PERSON,
WHETHER FOR A FEE OR OTHERWISE.
(I) "TELECOMMUNICATIONS CARRIER" MEANS A SERVICE OFFERED TO THE PUBLIC
FOR A FEE THAT TRANSMITS SOUNDS, IMAGES OR DATA THROUGH WIRELESS TELE-
COMMUNICATIONS TECHNOLOGY.
§ 539-A. PROHIBITION ON SHARING LOCATION DATA. (A) IT IS UNLAWFUL FOR
A MOBILE APPLICATION DEVELOPER OR A TELECOMMUNICATIONS CARRIER TO SHARE
A CUSTOMER'S LOCATION DATA WHERE SUCH LOCATION DATA WAS COLLECTED WHILE
THE CUSTOMER'S MOBILE COMMUNICATIONS DEVICE WAS PHYSICALLY PRESENT IN
THE STATE.
(B) IT IS UNLAWFUL FOR A PERSON WHO RECEIVES LOCATION DATA THAT IS
SHARED IN VIOLATION OF SUBDIVISION (A) OF THIS SECTION TO SHARE SUCH
DATA WITH ANY OTHER PERSON.
(C) EACH INSTANCE IN WHICH A MOBILE APPLICATION DEVELOPER, TELECOMMU-
NICATIONS CARRIER OR OTHER PERSON SHARES A CUSTOMER'S LOCATION DATA WITH
ANOTHER PERSON IN A MANNER PROHIBITED BY THIS SECTION CONSTITUTES A
SEPARATE VIOLATION OF THIS SECTION.
§ 539-B. EXCEPTIONS. THE PROVISIONS OF SECTION FIVE HUNDRED THIRTY-
NINE-A OF THIS ARTICLE DO NOT APPLY TO:
(A) INFORMATION PROVIDED TO A LAW ENFORCEMENT AGENCY IN RESPONSE TO A
LAWFUL PROCESS;
(B) INFORMATION PROVIDED TO AN EMERGENCY SERVICE AGENCY RESPONDING TO
A 911 COMMUNICATION OR ANY OTHER COMMUNICATION REPORTING AN IMMINENT
THREAT TO LIFE OR PROPERTY;
(C) INFORMATION REQUIRED TO BE PROVIDED BY FEDERAL, STATE OR LOCAL
LAW; OR
(D) A CUSTOMER PROVIDING THE CUSTOMER'S OWN LOCATION DATA TO A MOBILE
APPLICATION OR TELECOMMUNICATIONS CARRIER TO BE SHARED FOR AN AUTHORIZED
USE.
§ 539-C. ENFORCEMENT. THE OFFICE OF INFORMATION TECHNOLOGY SERVICES
SHALL ENFORCE THE PROVISIONS OF THIS SECTION.
§ 539-D. PENALTIES. (A) EXCEPT AS PROVIDED IN SUBDIVISION (B) OF THIS
SECTION, ANY PERSON WHO VIOLATES THE PROVISIONS OF SECTION FIVE HUNDRED
THIRTY-NINE-A OF THIS ARTICLE SHALL BE SUBJECT TO A CIVIL PENALTY OF ONE
THOUSAND DOLLARS FOR EACH SUCH VIOLATION.
A. 4037 3
(B) WHERE A PERSON COMMITS MULTIPLE VIOLATIONS OF SUBDIVISION (A) OR
(B) OF SECTION FIVE HUNDRED THIRTY-NINE-A OF THIS ARTICLE ON THE SAME
DAY, THE MAXIMUM CIVIL PENALTY ASSESSED AGAINST SUCH PERSON FOR ALL
VIOLATIONS OCCURRING ON SUCH DAY SHALL BE A CUMULATIVE PENALTY OF TEN
THOUSAND DOLLARS PER PERSON WHOSE LOCATION DATA WAS SHARED UNLAWFULLY.
§ 539-E. PRIVATE RIGHT OF ACTION. (A) ANY CUSTOMER WHOSE LOCATION DATA
HAS BEEN SHARED IN VIOLATION OF THIS ARTICLE MAY BRING AN ACTION IN ANY
COURT OF COMPETENT JURISDICTION. IF A COURT OF COMPETENT JURISDICTION
FINDS THAT A PERSON HAS VIOLATED A PROVISION OF THIS ARTICLE, THE COURT
MAY AWARD: (1) ACTUAL DAMAGES, COMPUTED AT A RATE OF ONE THOUSAND
DOLLARS PER VIOLATION UP TO TEN THOUSAND DOLLARS PER DAY; AND (2)
REASONABLE ATTORNEY'S FEES AND COSTS INCURRED IN MAINTAINING SUCH CIVIL
ACTION.
(B) THE PRIVATE RIGHT OF ACTION PROVIDED BY THIS SECTION DOES NOT
SUPPLANT ANY OTHER CLAIM OR CAUSE OF ACTION AVAILABLE TO A CUSTOMER
UNDER COMMON LAW OR BY STATUTE. THE PROVISIONS OF THIS SECTION ARE IN
ADDITION TO ANY SUCH COMMON LAW AND STATUTORY REMEDIES.
(C) NOTHING IN THIS ARTICLE SHALL BE CONSTRUED AS CREATING A PRIVATE
RIGHT OF ACTION AGAINST THE CITY OR ANY AGENCY OR EMPLOYEE THEREOF.
§ 539-F. RULEMAKING. THE DIRECTOR OF THE OFFICE OF INFORMATION TECH-
NOLOGY SERVICES MAY PROMULGATE AND AMEND RULES IN FURTHERANCE OF THE
ADMINISTRATION OF THIS ARTICLE.
§ 539-G. LOCAL LAWS OR ORDINANCES. NOTHING IN THIS ARTICLE SHALL BE
DEEMED TO PREEMPT ANY PROVISION OF LOCAL LAW OR ORDINANCE RESTRICTING
THE SHARING OF LOCATION DATA WITH THIRD PARTIES, PROVIDED THAT THE
PROVISIONS OF SUCH LOCAL LAW OR ORDINANCE ARE AT LEAST AS STRINGENT AS
THE PROVISIONS OF THIS ARTICLE.
§ 2. This act shall take effect on the one hundred twentieth day after
it shall have become a law.