NY State Senate Bill 2021-S6448

Archive: Last Bill Status - In Senate Committee Codes Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 05, 2022	referred to codes
Apr 29, 2021	referred to codes

co-Sponsors

2021-S6448 (ACTIVE) - Details

Current Committee:: Senate Codes
Law Section:: Penal Law
Laws Affected:: Add §§250.70 & 250.75, Pen L; add §209, St Tech L; add §899-cc, Gen Bus L; add §79-q, Civ Rts L
Versions Introduced in 2019-2020 Legislative Session:: S8327

2021-S6448 (ACTIVE) - Summary

Protects people's privacy during contact tracing by creating the crimes of unlawful dissemination of contact tracing information and unlawful use of a surveillance drone; requires certain privacy measures be implemented in contact tracing applications.

2021-S6448 (ACTIVE) - Sponsor Memo

                                
 
BILL NUMBER: S6448

SPONSOR: JORDAN
 
TITLE OF BILL:

An act to amend the penal law, the state technology law, the general
business law and the civil rights law, in relation to protecting
people's privacy during contact tracing

 
PURPOSE:

To amend the penal law, the state technology law, and the general busi-
ness law, in relation to protecting people's privacy during contact
tracing.

 
SUMMARY OF PROVISIONS:

Section one of the bill amends penal law, by adding new section 250.70
to establish the crime of unlawful dissemination of contact tracing
information, a class E felony.

Section two of the bill amends penal law, by adding new section 250.75
to establish the crime of unlawful use of a surveillance drone, a class
E felony.

Section three of the bill amends state technology law, by adding new
section 209 to define contract tracing information and to ensure that
the download and use of any contact tracing technology, including appli-
cation shall be voluntary and that any user must provide consent to the
download, use and sharing of information. Users must be provided with a
plain language explanation of any technology, including application
functionality prior to consenting to the download of such technology.
Users will be afforded to ability to revoke their consent at any time
and to remove contact tracing technology from their device or devices.
Any user data stored must be encrypted for security purposes and all
information collected must be destroyed upon the end of the public
health emergency.

Section four of the bill amends general business law by adding new
section 899-cc to protect the privacy interests of consumers during
public health emergencies, and to ensure that the download and use of
any contact tracing technology, including application shall be voluntary
and that any user must provide consent to the download, use and sharing
of information. Users must be provided with a plain language explanation
of any technology, including application functionality prior to consent-
ing to the download of such technology.  Users will be afforded to abil-
ity to revoke their consent at any time and to remove contact tracing
technology from their device or devices. Any user data stored must be
encrypted for security purposes and all information collected must be
destroyed upon the end of the public health emergency.

Section five of the bill amends civil rights law by adding new section
79-p, to establish and define a right to privacy as it relates to
contact tracing technology and to prevent any loss or restriction of any
rights or privileges for refusal to utilize any such technology, includ-
ing refusal to download or use a contact tracing application. A cause of
action is also established to provide any person or persons with the
ability to sue the entity responsible for any violation of his or her
right to privacy as it relates to contact tracing. An aggrieved
individual(s) will be allowed to seek damages or declaratory or injunc-
tive relief.

Section six of the bill is the effective date; immediately upon being
signed into law.

 
JUSTIFICATION:

As our nation and New York State take much needs steps to recover from
the many hardships inflicted by the novel coronavirus disease 2019, or
the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), here-
after "COVID-19," New Yorkers agree that we must take action to protect
against the further spread of COVID-19. In order to proactively address
the COVID-19 pandemic that has ravaged our state, contact tracing is
vital. According to the Center for Disease Control and Prevention (CDC),
the key concepts of contact tracing involve a multifaceted approach in
order to "trace and monitor contacts of infected people," through a
combination of the quarantining of infected individuals, an expansion of
staffing resources and lastly, the "adoption and evaluation of digital
tools," which the CDC states "may expand reach and efficacy of contact
tracers." While the digital tools used by contact tracers such as moni-
toring cell phone data, social media or other indicators that form one's
"digital footprint," certainly have the ability to ensure that anyone
who came into contact with a person infected by COVID-19 is identified
and quarantined, there is always the potential for not just privacy
violations, but disclosure to unauthorized par ties who are not partic-
ipating in contact tracing.

A recent proposal in Australia announced on April 24, 2020 would make it
illegal for any non-health official to access data collection on smart-
phone software to trace the spread of COVID19, according to Australian
Prime Minister Scott Morrison. The news outlet Channel News Asia
reported that Prime Minister Morrison's proposal would utilize a smart-
phone application that would allow health officials to "identify who a
person with the illness has had contact with," once that infected person
downloaded the application. However, there has been controversy
surrounding this proposal due to not just privacy concerns but also the
accessibility of an infected person's data by non-health officials.

This bill would seek to eliminate the potential for non-health officials
from accessing personal data obtained by contact tracers and impose a
criminal penalty against any individual who shares such personal data
with an unauthorized individual or entity that is not involved in
contact tracing. Additionally, the usage of any technology to access the
personal data of an infected person would be voluntary and require an
"opt-in." Absent the consent of the infected person, no entity - includ-
ing local government - could access the data or mandate usage of the
contact tracing technology in its jurisdiction.

Additionally, this bill would allow the infected person - should they
choose to opt-in - the ability to close, stop, shut down and fully
remove the contact tracing technology from any device in their
possession at any time, as well as require such personal data be
encrypted. The use of this would ensure that the infected person is in
full control of their privacy and also their data is secure.  Finally,
once the public health emergency has officially ended any and all data
collected through the contact tracing technology must be destroyed by
the Department of Health, as well as the companies that create the
contact tracing technology. While New York State is living through
unprecedented times, we must not forgo New Yorkers' fundamental right to
privacy and this bill would ensure the appropriate steps are taken to
ensure that does not happen.

 
LEGISLATIVE HISTORY:

S.8327 of 2019-20

 
FISCAL IMPLICATIONS:

None

 
LOCAL FISCAL IMPLICATIONS:

None

 
EFFECTIVE DATE:
This bill shall take effect immediately upon being signed into law.

2021-S6448 (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6448
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                              April 29, 2021
                                ___________
 
 Introduced  by Sens. JORDAN, BORRELLO -- read twice and ordered printed,
   and when printed to be committed to the Committee on Codes
 
 AN ACT to amend the penal law, the state  technology  law,  the  general
   business  law  and  the  civil  rights  law, in relation to protecting
   people's privacy during contact tracing

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1. The penal law is amended by adding two new sections 250.70
 and 250.75 to read as follows:
 § 250.70 UNLAWFUL DISSEMINATION OF CONTACT TRACING INFORMATION.
   A PERSON IS GUILTY OF UNLAWFUL DISSEMINATION OF CONTACT TRACING INFOR-
 MATION WHEN HE OR SHE:
   1. KNOWINGLY USES, CAUSES TO BE USED, OR ACCESSES A COMPUTER, COMPUTER
 SERVICE, OR COMPUTER NETWORK WITHOUT AUTHORIZATION AND HE OR SHE THEREBY
 KNOWINGLY GAINS ACCESS TO CONTACT TRACING INFORMATION; OR
   2. KNOWINGLY DISSEMINATES CONTACT TRACING INFORMATION  TO  ANY  PERSON
 NOT  AUTHORIZED BY THE GOVERNOR OR THE COMMISSIONER OF THE DEPARTMENT OF
 HEALTH TO RECEIVE SUCH INFORMATION.  FOR THE PURPOSES OF  THIS  SECTION,
 THE  TERM  "CONTACT  TRACING  INFORMATION"  SHALL  MEAN  ANY INFORMATION
 COLLECTED FOR THE PURPOSES OF PERFORMING THE PROCESS  OF  IDENTIFICATION
 OF  PERSONS  WHO MAY HAVE COME INTO CONTACT WITH OR INTO CLOSE PROXIMITY
 TO AN INFECTED PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL INFOR-
 MATION ABOUT THESE PERSONS AND CONTACTS.
   UNLAWFUL DISSEMINATION OF CONTACT TRACING INFORMATION  IS  A  CLASS  E
 FELONY.
 § 250.75 UNLAWFUL USE OF A SURVEILLANCE DRONE.
   A  PERSON IS GUILTY OF UNLAWFUL USE OF A SURVEILLANCE DRONE WHEN HE OR
 SHE KNOWINGLY USES OR CAUSES TO BE USED A  DRONE  FOR  THE  PURPOSES  OF
 SURVEILLANCE  WITHOUT  THE  CONSENT OF ALL PERSONS WITHIN THE AREA SURV-
 EILLED BY SUCH DRONE FOR THE  PURPOSES  OF  COLLECTING  CONTACT  TRACING
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD10990-01-1

 S. 6448                             2
 
 INFORMATION OR FOR MONITORING THE VITAL SIGNS OR SOCIAL DISTANCING PRAC-
 TICES OF INDIVIDUALS.
   FOR  THE  PURPOSES OF THIS SECTION, THE TERM "CONTACT TRACING INFORMA-
 TION" SHALL MEAN ANY INFORMATION COLLECTED FOR THE PURPOSES OF  PERFORM-
 ING  THE  PROCESS  OF  IDENTIFICATION  OF PERSONS WHO MAY HAVE COME INTO
 CONTACT WITH OR INTO CLOSE PROXIMITY  TO  AN  INFECTED  PERSON  AND  ANY
 SUBSEQUENT  COLLECTION  OF  FURTHER  INFORMATION ABOUT THESE PERSONS AND
 CONTACTS.
   UNLAWFUL USE OF A SURVEILLANCE DRONE IS A CLASS E FELONY.
   § 2. The state technology law is amended by adding a new  section  209
 to read as follows:
   §  209.  CONTACT  TRACING  APPLICATION PRIVACY. 1. FOR THE PURPOSES OF
 THIS SECTION, THE TERM:
   (A) "CONTACT TRACING INFORMATION" SHALL MEAN ANY INFORMATION COLLECTED
 FOR THE PURPOSES OF PERFORMING THE PROCESS OF IDENTIFICATION OF  PERSONS
 WHO  MAY  HAVE  COME  INTO  CONTACT  WITH  OR INTO CLOSE PROXIMITY TO AN
 INFECTED PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL  INFORMATION
 ABOUT THESE PERSONS AND CONTACTS.
   (B) "APPLICATION" SHALL MEAN COMPUTER SOFTWARE, APPLICATIONS AND OTHER
 FORMS  OF  TECHNOLOGY  CREATED  AND  USED FOR THE PURPOSES OF COLLECTING
 CONTACT TRACING INFORMATION.
   2. THE USE OF APPLICATIONS  CREATED  FOR  THE  PURPOSE  OF  COLLECTING
 CONTACT TRACING INFORMATION SHALL BE VOLUNTARY. THE USER OF ANY APPLICA-
 TION SHALL BE REQUIRED TO GIVE EXPLICIT CONSENT TO THE APPLICATION BEING
 DOWNLOADED,  TO  THE  APPLICATION  BEING  USED,  AND  TO THE APPLICATION
 PROVIDING ANY INFORMATION COLLECTED TO ANY PERSON.   THE USER  SHALL  BE
 PROVIDED  WITH A CONSPICUOUS, PLAIN LANGUAGE EXPLANATION OF THE APPLICA-
 TION, THE APPLICATION'S FUNCTIONS AND ANY INFORMATION THAT THE  APPLICA-
 TION  WILL  COLLECT  PRIOR TO THE USER BEING ABLE TO GIVE CONSENT TO THE
 DOWNLOAD OF THE APPLICATION.  SUCH CONSENT SHALL BE REVOCABLE AT ANYTIME
 AT WHICH POINT THE APPLICATION  SHALL  TERMINATE  THE  FUNCTIONALITY  TO
 WHICH  THE USER IS NO LONGER CONSENTING. IF CONSENT TO HAVING THE APPLI-
 CATION DOWNLOADED IS REVOKED, THE APPLICATION SHALL FULLY REMOVE  ITSELF
 OR  ENABLE  THE USER TO EASILY REMOVE THE APPLICATION FROM THE DEVICE IT
 IS DOWNLOADED ONTO.
   3. ANY INFORMATION STORED OR TRANSMITTED BY AN  APPLICATION  SHALL  BE
 STORED  OR TRANSMITTED IN AN ENCRYPTED MANNER AS TO PREVENT ACCESS BY AN
 UNAUTHORIZED PERSON.
   4. ANY INFORMATION COLLECTED BY AN  APPLICATION  SHALL  BE  COMPLETELY
 DELETED,  DESTROYED  AND  ERASED  AND  NO  FURTHER  INFORMATION SHALL BE
 COLLECTED UPON THE END OF  THE  STATE  PUBLIC  EMERGENCY  REQUIRING  THE
 CREATION OF THE APPLICATION.
   5.  NOTWITHSTANDING  ANY  OTHER  PROVISION OF LAW TO THE CONTRARY, ANY
 PERSON, BUSINESS OR GOVERNMENTAL ENTITY IN  VIOLATION  OF  THIS  SECTION
 SHALL  BE  LIABLE TO ANY PERSON WHO USED AN APPLICATION INVOLUNTARILY OR
 WITHOUT GIVING PROPERLY INFORMED CONSENT OR WHOSE CONTACT TRACING INFOR-
 MATION WAS DISCLOSED OR USED IMPROPERLY. LIABILITY UNDER THIS SECTION IS
 IN ADDITION TO ANY OTHER APPLICABLE PENALTIES AND CAUSES OF  ACTION.  AN
 ACTION  TO  RECOVER  DAMAGES  UNDER  THIS SECTION MAY BE MAINTAINED AS A
 CLASS ACTION, NOTWITHSTANDING SUBDIVISION B OF SECTION NINE HUNDRED  ONE
 OF THE CIVIL PRACTICE LAW AND RULES.
   §  3. The general business law is amended by adding a new section 899-
 cc to read as follows:
   § 899-CC. CONTACT TRACING APPLICATION PRIVACY. 1. FOR THE PURPOSES  OF
 THIS SECTION, THE TERM:

 S. 6448                             3
 
   (A) "CONTACT TRACING INFORMATION" SHALL MEAN ANY INFORMATION COLLECTED
 FOR  THE PURPOSES OF PERFORMING THE PROCESS OF IDENTIFICATION OF PERSONS
 WHO MAY HAVE COME INTO CONTACT  WITH  OR  INTO  CLOSE  PROXIMITY  TO  AN
 INFECTED  PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL INFORMATION
 ABOUT THESE PERSONS AND CONTACTS.
   (B) "APPLICATION" SHALL MEAN COMPUTER SOFTWARE, APPLICATIONS AND OTHER
 FORMS  OF  TECHNOLOGY  CREATED  AND  USED FOR THE PURPOSES OF COLLECTING
 CONTACT TRACING INFORMATION.
   2. THE USE OF APPLICATIONS  CREATED  FOR  THE  PURPOSE  OF  COLLECTING
 CONTACT TRACING INFORMATION SHALL BE VOLUNTARY. THE USER OF ANY APPLICA-
 TION SHALL BE REQUIRED TO GIVE EXPLICIT CONSENT TO THE APPLICATION BEING
 DOWNLOADED,  TO  THE  APPLICATION  BEING  USED,  AND  TO THE APPLICATION
 PROVIDING ANY INFORMATION COLLECTED TO ANY PERSON.   THE USER  SHALL  BE
 PROVIDED  WITH A CONSPICUOUS, PLAIN LANGUAGE EXPLANATION OF THE APPLICA-
 TION, THE APPLICATION'S FUNCTIONS AND ANY INFORMATION THAT THE  APPLICA-
 TION  WILL  COLLECT  PRIOR TO THE USER BEING ABLE TO GIVE CONSENT TO THE
 DOWNLOAD OF THE APPLICATION.   SUCH CONSENT SHALL BE  REVOCABLE  AT  ANY
 TIME AT WHICH POINT THE APPLICATION SHALL TERMINATE THE FUNCTIONALITY TO
 WHICH  THE USER IS NO LONGER CONSENTING. IF CONSENT TO HAVING THE APPLI-
 CATION DOWNLOADED IS REVOKED, THE APPLICATION SHALL FULLY REMOVE  ITSELF
 OR  ENABLE  THE USER TO EASILY REMOVE THE APPLICATION FROM THE DEVICE IT
 IS DOWNLOADED ONTO.
   3. ANY INFORMATION STORED OR TRANSMITTED BY AN  APPLICATION  SHALL  BE
 STORED  OR TRANSMITTED IN AN ENCRYPTED MANNER AS TO PREVENT ACCESS BY AN
 UNAUTHORIZED PERSON.
   4. ANY INFORMATION COLLECTED BY AN  APPLICATION  SHALL  BE  COMPLETELY
 DELETED,  DESTROYED  AND  ERASED  AND  NO  FURTHER  INFORMATION SHALL BE
 COLLECTED UPON THE END OF  THE  STATE  PUBLIC  EMERGENCY  REQUIRING  THE
 CREATION OF THE APPLICATION.
   5.  NOTWITHSTANDING  ANY  OTHER  PROVISION OF LAW TO THE CONTRARY, ANY
 PERSON, BUSINESS OR GOVERNMENTAL ENTITY IN  VIOLATION  OF  THIS  SECTION
 SHALL  BE  LIABLE TO ANY PERSON WHO USED AN APPLICATION INVOLUNTARILY OR
 WITHOUT GIVING PROPERLY INFORMED CONSENT OR WHOSE CONTACT TRACING INFOR-
 MATION WAS DISCLOSED OR USED IMPROPERLY. LIABILITY UNDER THIS SECTION IS
 IN ADDITION TO ANY OTHER APPLICABLE PENALTIES AND CAUSES OF  ACTION.  AN
 ACTION  TO  RECOVER  DAMAGES  UNDER  THIS SECTION MAY BE MAINTAINED AS A
 CLASS ACTION, NOTWITHSTANDING SUBDIVISION B OF SECTION NINE HUNDRED  ONE
 OF THE CIVIL PRACTICE LAW AND RULES.
   §  4.  The civil rights law is amended by adding a new section 79-q to
 read as follows:
   § 79-Q. RIGHT TO PRIVACY; CONTACT  TRACING.  1.  THE  FOLLOWING  DEFI-
 NITIONS ARE APPLICABLE TO THIS SECTION:
   (A) "CONTACT TRACING INFORMATION" SHALL MEAN ANY INFORMATION COLLECTED
 FOR  THE PURPOSES OF PERFORMING THE PROCESS OF IDENTIFICATION OF PERSONS
 WHO MAY HAVE COME INTO CONTACT  WITH  OR  INTO  CLOSE  PROXIMITY  TO  AN
 INFECTED    PERSON   AND ANY SUBSEQUENT COLLECTION OF FURTHER ADDITIONAL
 INFORMATION ABOUT THESE PERSONS AND CONTACTS.
   (B) "APPLICATION" SHALL MEAN COMPUTER SOFTWARE,  OR  APPLICATIONS  AND
 OTHER  FORMS OF TECHNOLOGY CREATED AND USED FOR THE PURPOSES OF COLLECT-
 ING CONTACT TRACING INFORMATION.
    2. (A) NO PERSON, BUSINESS, OR GOVERNMENTAL ENTITY SHALL REQUIRE  THE
 DOWNLOAD,  INSTALLATION  OR  USE  OF  AN  APPLICATION OF THE PURPOSES OF
 COLLECTING CONTACT TRACING INFORMATION FOR ANY REASON  AND  THE  USE  OF
 SUCH APPLICATIONS SHALL BE VOLUNTARY.
   (B)  NO  PERSON,  BUSINESS,  OR GOVERNMENTAL ENTITY SHALL RESTRICT THE
 RIGHTS AND PRIVILEGES OF A PERSON BASED ON SUCH PERSONS REFUSAL TO DOWN-

 S. 6448                             4
 
 LOAD, INSTALLATION OR USE OF AN APPLICATION FOR THE PURPOSES OF COLLECT-
 ING CONTACT TRACING INFORMATION.
   (C)    NO PERSON, BUSINESS, OR GOVERNMENTAL ENTITY SHALL COLLECT, USE,
 OR DISTRIBUTE CONTACT TRACING INFORMATION IN VIOLATION OF SECTION 250.70
 OR 250.75 OF THE PENAL LAW, SECTION TWO HUNDRED NINE OF THE STATE  TECH-
 NOLOGY LAW, OR SECTION EIGHT HUNDRED NINETY-NINE-CC OF THE GENERAL BUSI-
 NESS LAW.
   3.  ANY  PERSON AGGRIEVED BY A VIOLATION OF THE PROTECTIONS CREATED BY
 THIS SECTION SHALL HAVE THE RIGHT TO BRING AN ACTION OR SPECIAL PROCEED-
 ING IN A COURT  OF  APPROPRIATE  JURISDICTION  TO  SEEK  DAMAGES  AND/OR
 DECLARATORY  AND  INJUNCTIVE RELIEF OR ANY OTHER REMEDIES AS PROVIDED BY
 LAW WITH RESPECT TO SUCH VIOLATION. THE RIGHT TO BRING AN  ACTION  UNDER
 THIS SECTION IS IN ADDITION TO ANY OTHER APPLICABLE PENALTIES AND CAUSES
 OF ACTION.
   4.  AN  ACTION TO RECOVER DAMAGES UNDER THIS SECTION MAY BE MAINTAINED
 AS A CLASS ACTION, NOTWITHSTANDING SUBDIVISION B OF SECTION NINE HUNDRED
 ONE OF THE CIVIL PRACTICE LAW AND RULES.
   § 5. This act shall take effect immediately.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S6448

Sponsored By

Archive: Last Bill Status - In Senate Committee Codes Committee

co-Sponsors

2021-S6448 (ACTIVE) - Details

2021-S6448 (ACTIVE) - Summary

2021-S6448 (ACTIVE) - Sponsor Memo

2021-S6448 (ACTIVE) - Bill Text download pdf

Comments

Senate Bill S6448

Share this bill

Sponsored By

Daphne Jordan

Archive: Last Bill Status - In Senate Committee Codes Committee

co-Sponsors

George M. Borrello

2021-S6448 (ACTIVE) - Details

2021-S6448 (ACTIVE) - Summary

2021-S6448 (ACTIVE) - Sponsor Memo

2021-S6448 (ACTIVE) - Bill Text download pdf

Comments