LBD06064-01-1
A. 3586 2
WITHOUT HAVING FIRST OBTAINED THE WRITTEN CONSENT OF SUCH PERSON, OR IF
A MINOR OF HIS OR HER PARENT OR GUARDIAN, OR, WHEN SUCH CONSENT IS
OBTAINED, SUBSEQUENTLY FAILS TO EXERCISE REASONABLE CARE CONSISTENT WITH
ITS OBLIGATIONS AS BAILEE OF THAT INDIVIDUAL'S NAME, PORTRAIT, PICTURE,
VIDEO, VOICE, LIKENESS, AND ALL OTHER PERSONAL DATA, BIOMETRIC DATA, AND
LOCATION DATA first obtained as above provided may maintain an equitable
action in the supreme court of this state against the person, firm or
corporation so using his OR HER name, portrait, picture [or], VIDEO,
voice, LIKENESS, AND ALL OTHER PERSONAL DATA, BIOMETRIC DATA, AND
LOCATION DATA to prevent and restrain the use thereof; and may also sue
and recover damages for any injuries sustained by reason of such use and
if the defendant shall have knowingly used such person's name, portrait,
picture [or], VIDEO, voice, LIKENESS, AND ALL OTHER PERSONAL DATA, BIOM-
ETRIC DATA, AND LOCATION DATA in such manner as is forbidden or declared
to be unlawful by section fifty of this article, the jury, in its
discretion, may award exemplary damages. But nothing contained in this
article shall be so construed as to prevent any person, firm or corpo-
ration from selling or otherwise transferring any material containing
such name, portrait, picture [or], VIDEO, voice, LIKENESS, AND ALL OTHER
PERSONAL DATA, BIOMETRIC DATA, AND LOCATION DATA in whatever medium to
any user of such name, portrait, picture [or], VIDEO, voice, LIKENESS,
AND ALL OTHER PERSONAL DATA, BIOMETRIC DATA, AND LOCATION DATA or to any
third party [for sale] or transfer directly or indirectly to such a
user, for use, PROVIDED THAT THE TRANSFERRING PARTY UNDERTAKES REASON-
ABLE STEPS TO ENSURE THAT ANY SUCH USE IS CONSISTENT WITH THE SELLING OR
TRANSFERRING PARTY'S OBLIGATIONS AS BAILEE OF THAT INDIVIDUAL'S NAME,
PORTRAIT, PICTURE, VIDEO, VOICE, LIKENESS, AND ALL OTHER PERSONAL DATA,
BIOMETRIC DATA, AND LOCATION DATA AND USE in a manner lawful under this
article; nothing contained in this article shall be so construed as to
prevent any person, firm or corporation, practicing the profession of
photography, from exhibiting in or about his or its establishment speci-
mens of the work of such establishment, unless the same is continued by
such person, firm or corporation after written notice objecting thereto
has been given by the person portrayed; and nothing contained in this
article shall be so construed as to prevent any person, firm or corpo-
ration from using the name, portrait, picture [or], VIDEO, voice, LIKE-
NESS, AND ALL OTHER PERSONAL DATA, BIOMETRIC DATA, AND LOCATION DATA of
any manufacturer or dealer in connection with the goods, wares and
merchandise manufactured, produced or dealt in by him OR HER which he OR
SHE has sold or disposed of with such name, portrait, picture [or],
VIDEO, voice, LIKENESS, AND ALL OTHER PERSONAL DATA, BIOMETRIC DATA, AND
LOCATION DATA used in connection therewith; or from using the name,
portrait, picture [or], VIDEO, voice, LIKENESS, AND ALL OTHER PERSONAL
DATA, BIOMETRIC DATA, AND LOCATION DATA of any author, composer or
artist in connection with his OR HER literary, musical or artistic
productions which he OR SHE has sold or disposed of with such name,
portrait, picture [or], VIDEO, voice, LIKENESS, AND ALL OTHER PERSONAL
DATA, BIOMETRIC DATA, AND LOCATION DATA used in connection therewith.
Nothing contained in this section shall be construed to prohibit the
copyright owner of a sound recording from disposing of, dealing in,
licensing or selling that sound recording to any party, if the right to
dispose of, deal in, license or sell such sound recording has been
conferred by contract or other written document by such living person or
the holder of such right. Nothing contained in the foregoing sentence
shall be deemed to abrogate or otherwise limit any rights or remedies
otherwise conferred by federal law or state law.
A. 3586 3
§ 4. The general business law is amended by adding a new article 32-A
to read as follows:
ARTICLE 32-A
IT'S YOUR DATA ACT
SECTION 676. DEFINITIONS.
676-A. TRANSPARENCY OF THE COLLECTION, USE, RETENTION, AND SHAR-
ING OF PERSONAL INFORMATION.
676-B. FAIR COLLECTION AND USE OF PERSONAL INFORMATION.
676-C. DELETION OF PERSONAL INFORMATION.
676-D. ACCESS TO RETAINED PERSONAL INFORMATION.
676-E. ACCESS TO DISCLOSURE OF PERSONAL INFORMATION.
676-F. CONSENT TO ADDITIONAL COLLECTION OR SHARING OF PERSONAL
INFORMATION.
676-G. NO DISCRIMINATION BY A BUSINESS AGAINST A CONSUMER FOR
EXERCISE OF RIGHTS.
676-H. REASONABLE SECURITY.
676-I. BUSINESS IMPLEMENTATION OF DUTIES.
676-J. EXCEPTIONS.
676-K. CONSUMER'S PRIVATE RIGHT OF ACTION.
676-L. AGENCY ENFORCEMENT ACTION.
676-M. CONSTRUCTION.
676-N. ATTORNEY GENERAL REGULATIONS.
676-O. INTERMEDIATE TRANSACTIONS.
676-P. NON-WAIVER.
676-Q. SEVERABILITY.
§ 676. DEFINITIONS. 1. FOR THE PURPOSES OF THIS ARTICLE:
(A) "AGGREGATE CONSUMER INFORMATION" MEANS INFORMATION THAT RELATES TO
A GROUP OF CONSUMERS, FROM WHICH INDIVIDUAL CONSUMER IDENTITIES HAVE
BEEN REMOVED, THAT IS NOT LINKED OR REASONABLY LINKABLE TO ANY CONSUMER
OR HOUSEHOLD, INCLUDING VIA A DEVICE. AGGREGATE CONSUMER INFORMATION
DOES NOT MEAN ONE OR MORE INDIVIDUAL CONSUMER RECORDS THAT HAVE BEEN
DE-IDENTIFIED.
(B) "BIOMETRIC INFORMATION" MEANS AN INDIVIDUAL'S PHYSIOLOGICAL,
BIOLOGICAL OR BEHAVIORAL CHARACTERISTICS OR AN ELECTRONIC REPRESENTATION
OF SUCH, INCLUDING AN INDIVIDUAL'S DEOXYRIBONUCLEIC ACID (DNA), THAT CAN
BE USED, SINGLY OR IN COMBINATION WITH EACH OTHER OR WITH OTHER IDENTI-
FYING DATA, TO ESTABLISH INDIVIDUAL IDENTITY. BIOMETRIC INFORMATION
INCLUDES, BUT IS NOT LIMITED TO, IMAGERY OF THE IRIS, RETINA, FINGER-
PRINT, FACE, HAND, PALM, VEIN PATTERNS, AND VOICE RECORDINGS, FROM WHICH
AN IDENTIFIER TEMPLATE, SUCH AS A FACEPRINT, A MINUTIAE TEMPLATE, OR A
VOICEPRINT, CAN BE EXTRACTED, AND KEYSTROKE PATTERNS OR RHYTHMS, GAIT
PATTERNS OR RHYTHMS, AND SLEEP, HEALTH, OR EXERCISE DATA THAT CONTAIN
IDENTIFYING INFORMATION.
(C) "BUSINESS" MEANS:
(I) A SOLE PROPRIETORSHIP, PARTNERSHIP, LIMITED LIABILITY COMPANY,
CORPORATION, ASSOCIATION, OR OTHER LEGAL ENTITY THAT IS ORGANIZED OR
OPERATED FOR THE PROFIT OR FINANCIAL BENEFIT OF ITS SHAREHOLDERS OR
OTHER OWNERS, THAT COLLECTS CONSUMERS' PERSONAL INFORMATION, OR ON THE
BEHALF OF WHICH SUCH INFORMATION IS COLLECTED AND THAT ALONE, OR JOINTLY
WITH OTHERS, DETERMINES THE PURPOSES AND MEANS OF THE PROCESSING OF
CONSUMERS' PERSONAL INFORMATION, THAT DOES BUSINESS IN THE STATE OF NEW
YORK, AND THAT SATISFIES ONE OR MORE OF THE FOLLOWING THRESHOLDS:
(1) HAS ANNUAL GROSS REVENUES IN EXCESS OF FIFTY MILLION DOLLARS, AS
ADJUSTED PURSUANT TO PARAGRAPH (F) OF SUBDIVISION ONE OF SECTION SIX
HUNDRED SEVENTY-SIX-N OF THIS ARTICLE;
A. 3586 4
(2) ALONE OR IN COMBINATION, ANNUALLY BUYS, RECEIVES FOR THE BUSINESS'
COMMERCIAL PURPOSES, SELLS, OR DISCLOSES FOR COMMERCIAL PURPOSES, ALONE
OR IN COMBINATION, THE PERSONAL INFORMATION OF FIFTY THOUSAND OR MORE
CONSUMERS, HOUSEHOLDS, OR DEVICES; OR
(3) DERIVES FIFTY PERCENT OR MORE OF ITS ANNUAL REVENUES FROM SELLING
CONSUMERS' PERSONAL INFORMATION; AND
(II) ANY ENTITY THAT CONTROLS OR IS CONTROLLED BY A BUSINESS, AS
DEFINED IN SUBPARAGRAPH (I) OF THIS PARAGRAPH, AND THAT SHARES COMMON
BRANDING WITH SUCH BUSINESS.
(D) "CONTROL" OR "CONTROLLED" MEANS OWNERSHIP OF, OR THE POWER TO
VOTE, MORE THAN FIFTY PERCENT OF THE OUTSTANDING SHARES OF ANY CLASS OF
VOTING SECURITY OF A BUSINESS; CONTROL IN ANY MANNER OVER THE ELECTION
OF A MAJORITY OF THE DIRECTORS, OR OF INDIVIDUALS EXERCISING SIMILAR
FUNCTIONS; OR THE POWER TO EXERCISE A CONTROLLING INFLUENCE OVER THE
MANAGEMENT OF A BUSINESS.
(E) "COMMON BRANDING" MEANS A SHARED NAME, SERVICEMARK, OR TRADEMARK.
(F) "OPERATIONAL PURPOSE" MEANS THE USE OF PERSONAL INFORMATION WHEN
REASONABLY NECESSARY AND PROPORTIONATE TO ACHIEVE ONE OF THE FOLLOWING
OPERATIONAL PURPOSES:
(I) AUDITING RELATED TO A CURRENT INTERACTION WITH THE CONSUMER AND
CONCURRENT TRANSACTIONS, INCLUDING, BUT NOT LIMITED TO, COUNTING AD
IMPRESSIONS TO UNIQUE VISITORS, VERIFYING POSITIONING AND QUALITY OF AD
IMPRESSIONS, AND AUDITING COMPLIANCE WITH THIS PARAGRAPH AND OTHER STAN-
DARDS;
(II) DETECTING AND RESPONDING TO SECURITY INCIDENTS, PROTECTING
AGAINST MALICIOUS, DECEPTIVE, FRAUDULENT, OR ILLEGAL ACTIVITY, AND PROS-
ECUTING THOSE RESPONSIBLE FOR THAT ACTIVITY;
(III) DEBUGGING TO IDENTIFY AND REPAIR ERRORS THAT IMPAIR EXISTING
INTENDED FUNCTIONALITY;
(IV) SHORT-TERM, TRANSIENT USE, PROVIDED THE PERSONAL INFORMATION IS
NOT DISCLOSED TO ANOTHER THIRD PARTY AND IS NOT USED TO BUILD A PROFILE
ABOUT A CONSUMER OR OTHERWISE ALTER AN INDIVIDUAL CONSUMER'S EXPERIENCE
OUTSIDE THE CURRENT INTERACTION, INCLUDING, BUT NOT LIMITED TO, THE
CONTEXTUAL CUSTOMIZATION OF ADS SHOWN AS PART OF THE SAME INTERACTION;
(V) PERFORMING OR PROVIDING SERVICES ON BEHALF OF THE BUSINESS OR
SERVICE PROVIDER, INCLUDING MAINTAINING OR SERVICING ACCOUNTS, BILLING
OR COLLECTING FOR REQUESTED PRODUCTS OR SERVICES, PROVIDING CUSTOMER
SERVICE, PROCESSING OR FULFILLING ORDERS AND TRANSACTIONS, VERIFYING
CUSTOMER INFORMATION, PROCESSING PAYMENTS, PROVIDING FINANCING, PROVID-
ING ADVERTISING OR MARKETING SERVICES, PROVIDING ANALYTIC SERVICES, OR
PROVIDING SIMILAR SERVICES ON BEHALF OF THE BUSINESS OR SERVICE PROVID-
ER;
(VI) UNDERTAKING INTERNAL RESEARCH FOR TECHNOLOGICAL DEVELOPMENT AND
DEMONSTRATION;
(VII) UNDERTAKING ACTIVITIES TO VERIFY OR MAINTAIN THE QUALITY OR
SAFETY OF A SERVICE OR DEVICE THAT IS OWNED, MANUFACTURED, MANUFACTURED
FOR, OR CONTROLLED BY THE BUSINESS, OR TO IMPROVE, UPGRADE, OR ENHANCE
THE SERVICE OR DEVICE THAT IS OWNED, MANUFACTURED, MANUFACTURED FOR, OR
CONTROLLED BY THE BUSINESS;
(VIII) CUSTOMIZATION OF CONTENT; OR
(IX) CUSTOMIZATION OF ADVERTISING OR MARKETING.
(G) "COLLECTS," "COLLECTED," OR "COLLECTION" MEANS BUYING, RENTING,
GATHERING, OBTAINING, RECEIVING, OR ACCESSING ANY PERSONAL INFORMATION
PERTAINING TO A CONSUMER BY ANY MEANS. THIS SHALL INCLUDE, BUT SHALL NOT
BE LIMITED TO, RECEIVING INFORMATION FROM THE CONSUMER, EITHER ACTIVELY
OR PASSIVELY, OR BY OBSERVING THE CONSUMER'S BEHAVIOR.
A. 3586 5
(H) "COMMERCIAL PURPOSES" MEANS TO ADVANCE A PERSON'S COMMERCIAL OR
ECONOMIC INTERESTS, SUCH AS BY INDUCING ANOTHER PERSON TO BUY, RENT,
LEASE, JOIN, SUBSCRIBE TO, PROVIDE, OR EXCHANGE PRODUCTS, GOODS, PROPER-
TY, INFORMATION, OR SERVICES, OR ENABLING OR EFFECTING, DIRECTLY OR
INDIRECTLY, A COMMERCIAL TRANSACTION. COMMERCIAL PURPOSES SHALL NOT
INCLUDE ENGAGING IN SPEECH THAT STATE OR FEDERAL COURTS HAVE RECOGNIZED
AS NONCOMMERCIAL SPEECH, INCLUDING, BUT NOT LIMITED TO, POLITICAL SPEECH
AND JOURNALISM.
(I) "CONSUMER" MEANS A NATURAL PERSON WHO IS A RESIDENT OF THE STATE
OF NEW YORK.
(J) "DE-IDENTIFIED" MEANS INFORMATION THAT CANNOT REASONABLY IDENTIFY,
RELATE TO, DESCRIBE, BE CAPABLE OF BEING ASSOCIATED WITH, OR BE LINKED,
DIRECTLY OR INDIRECTLY, TO A PARTICULAR CONSUMER, PROVIDED THAT A BUSI-
NESS THAT USES DE-IDENTIFIED INFORMATION:
(I) TAKES REASONABLE MEASURES TO ENSURE THAT THE DATA IS DE-IDENTI-
FIED;
(II) PUBLICLY COMMITS TO MAINTAIN AND USE THE DATA IN A DE-IDENTIFIED
FASHION AND NOT TO ATTEMPT TO RE-IDENTIFY THE DATA; AND
(III) CONTRACTUALLY PROHIBITS DOWNSTREAM RECIPIENTS FROM ATTEMPTING TO
RE-IDENTIFY THE DATA.
(K) "DESIGNATED METHODS FOR SUBMITTING REQUESTS" MEANS A MAILING
ADDRESS, EMAIL ADDRESS, INTERNET WEB PAGE, INTERNET WEB PORTAL, TOLL-
FREE TELEPHONE NUMBER, OR OTHER APPLICABLE CONTACT INFORMATION, WHEREBY
CONSUMERS MAY SUBMIT A REQUEST UNDER THIS ARTICLE, AND ANY NEW, CONSUM-
ER-FRIENDLY MEANS OF CONTACTING A BUSINESS, AS APPROVED BY THE ATTORNEY
GENERAL PURSUANT TO SECTION SIX HUNDRED SEVENTY-SIX-N OF THIS ARTICLE.
(L) "DEVICE" MEANS ANY PHYSICAL OBJECT THAT IS CAPABLE OF CONNECTING
TO THE INTERNET, DIRECTLY OR INDIRECTLY, OR TO ANOTHER DEVICE.
(M) "HEALTH INSURANCE INFORMATION" MEANS A CONSUMER'S INSURANCE POLICY
NUMBER OR SUBSCRIBER IDENTIFICATION NUMBER, ANY UNIQUE IDENTIFIER USED
BY A HEALTH INSURER TO IDENTIFY THE CONSUMER, OR ANY INFORMATION IN THE
CONSUMER'S APPLICATION AND CLAIMS HISTORY, INCLUDING ANY APPEALS
RECORDS, IF THE INFORMATION IS LINKED OR REASONABLY LINKABLE TO A
CONSUMER OR HOUSEHOLD, INCLUDING VIA A DEVICE, BY A BUSINESS OR SERVICE
PROVIDER.
(N) "INFER" OR "INFERENCE" MEANS THE DERIVATION OF INFORMATION, DATA,
ASSUMPTIONS, OR CONCLUSIONS FROM FACTS, EVIDENCE, OR ANOTHER SOURCE OF
INFORMATION OR DATA.
(O) "PERSON" MEANS AN INDIVIDUAL, PROPRIETORSHIP, FIRM, PARTNERSHIP,
JOINT VENTURE, SYNDICATE, BUSINESS TRUST, COMPANY, CORPORATION, LIMITED
LIABILITY COMPANY, ASSOCIATION, COMMITTEE, AND ANY OTHER ORGANIZATION OR
GROUP OF PERSONS ACTING IN CONCERT.
(P) "PERSONAL INFORMATION" MEANS INFORMATION THAT IDENTIFIES OR COULD
REASONABLY BE LINKED, DIRECTLY OR INDIRECTLY, WITH A PARTICULAR CONSUM-
ER, HOUSEHOLD, OR CONSUMER DEVICE. PERSONAL INFORMATION SHALL NOT
INCLUDE PUBLICLY AVAILABLE INFORMATION, INFORMATION THAT IS DE-IDENTI-
FIED, OR AGGREGATE CONSUMER INFORMATION.
(Q) "PUBLICLY AVAILABLE" MEANS INFORMATION THAT IS LAWFULLY MADE
AVAILABLE FROM FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS. PUBLICLY
AVAILABLE DOES NOT MEAN INFORMATION COLLECTED BY A BUSINESS ABOUT A
CONSUMER WITHOUT THE CONSUMER'S KNOWLEDGE.
(R) "SERVICE" OR "SERVICES" MEANS WORK, LABOR, AND SERVICES, INCLUDING
SERVICES FURNISHED IN CONNECTION WITH THE PRODUCTION, SALE OR REPAIR OF
GOODS.
(S) "SERVICE PROVIDER" MEANS AN INDIVIDUAL SOLE PROPRIETORSHIP, PART-
NERSHIP, LIMITED LIABILITY COMPANY, CORPORATION, ASSOCIATION, OR OTHER
A. 3586 6
LEGAL ENTITY THAT IS ORGANIZED OR OPERATED FOR THE PROFIT OR FINANCIAL
BENEFIT OF ITS SHAREHOLDERS OR OTHER OWNERS, THAT PROCESSES INFORMATION
ON BEHALF OF A BUSINESS AND TO WHICH SUCH BUSINESS DISCLOSES A CONSUM-
ER'S PERSONAL INFORMATION FOR AN OPERATIONAL PURPOSE PURSUANT TO A WRIT-
TEN OR ELECTRONIC CONTRACT, PROVIDED THAT THE CONTRACT PROHIBITS THE
ENTITY RECEIVING THE INFORMATION FROM RETAINING, USING, OR DISCLOSING
THE PERSONAL INFORMATION FOR ANY PURPOSE OTHER THAN FOR THE SPECIFIC
PURPOSE OF PERFORMING THE SERVICES SPECIFIED IN THE CONTRACT FOR SUCH
BUSINESS, OR AS OTHERWISE PERMITTED BY THIS ARTICLE, INCLUDING A PROHI-
BITION ON RETAINING, USING, OR DISCLOSING THE PERSONAL INFORMATION FOR A
COMMERCIAL PURPOSE OTHER THAN PROVIDING THE SERVICES SPECIFIED IN THE
CONTRACT WITH SUCH BUSINESS.
(T) "VERIFIABLE CONSUMER REQUEST" MEANS A REQUEST THAT IS MADE BY A
CONSUMER, BY A CONSUMER ON BEHALF OF THE CONSUMER'S MINOR CHILD, OR BY A
NATURAL PERSON OR A PERSON REGISTERED WITH THE SECRETARY OF STATE,
AUTHORIZED BY THE CONSUMER TO ACT ON THE CONSUMER'S BEHALF, AND THAT THE
BUSINESS CAN REASONABLY VERIFY. A BUSINESS SHALL NOT BE OBLIGATED TO
PROVIDE ANY PERSONAL INFORMATION TO A CONSUMER IF SUCH BUSINESS CANNOT
VERIFY THAT THE CONSUMER MAKING THE REQUEST IS THE CONSUMER ABOUT WHOM
SUCH BUSINESS HAS COLLECTED PERSONAL INFORMATION OR IS A PERSON AUTHOR-
IZED BY THE CONSUMER TO ACT ON SUCH CONSUMER'S BEHALF.
(U) "THIRD PARTY" MEANS A PERSON OR BUSINESS THAT IS NOT ANY OF THE
FOLLOWING:
(I) THE BUSINESS THAT COLLECTS PERSONAL INFORMATION FROM CONSUMERS
UNDER THIS ARTICLE; OR
(II) A PERSON TO WHOM THE BUSINESS DISCLOSES A CONSUMER'S PERSONAL
INFORMATION FOR AN OPERATIONAL PURPOSE PURSUANT TO A WRITTEN CONTRACT,
PROVIDED THAT THE CONTRACT:
(1) PROHIBITS THE PERSON RECEIVING THE PERSONAL INFORMATION FROM:
(A) SELLING THE PERSONAL INFORMATION;
(B) RETAINING, USING, OR DISCLOSING THE PERSONAL INFORMATION FOR ANY
PURPOSE OTHER THAN FOR THE SPECIFIC PURPOSE OF PERFORMING THE SERVICES
SPECIFIED IN THE CONTRACT, INCLUDING RETAINING, USING, OR DISCLOSING THE
PERSONAL INFORMATION FOR A COMMERCIAL PURPOSE OTHER THAN PROVIDING THE
SERVICES SPECIFIED IN THE CONTRACT; AND
(C) RETAINING, USING, OR DISCLOSING THE INFORMATION OUTSIDE OF THE
DIRECT BUSINESS RELATIONSHIP BETWEEN THE PERSON AND THE BUSINESS; AND
(2) INCLUDES A CERTIFICATION MADE BY THE PERSON RECEIVING THE PERSONAL
INFORMATION THAT THE PERSON UNDERSTANDS THE RESTRICTIONS IN CLAUSE ONE
OF THIS PARAGRAPH AND WILL COMPLY WITH SUCH RESTRICTIONS.
2. FOR REFERENCES TO A CATEGORY OR CATEGORIES OF PERSONAL INFORMATION
REQUIRED TO BE DISCLOSED PURSUANT TO THIS ARTICLE:
(A) "PROCESSING" MEANS ANY OPERATION OR SET OF OPERATIONS THAT ARE
PERFORMED ON PERSONAL DATA OR ON SETS OF PERSONAL DATA, WHETHER OR NOT
BY AUTOMATED MEANS.
(B) "RESEARCH" MEANS SCIENTIFIC AND SYSTEMATIC STUDY AND OBSERVATION,
INCLUDING BASIC RESEARCH OR APPLIED RESEARCH THAT IS IN THE PUBLIC
INTEREST AND THAT ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY
LAWS OR STUDIES CONDUCTED IN THE PUBLIC INTEREST IN THE AREA OF PUBLIC
HEALTH. RESEARCH WITH PERSONAL INFORMATION THAT MAY HAVE BEEN COLLECTED
FROM A CONSUMER IN THE COURSE OF THE CONSUMER'S INTERACTIONS WITH A
BUSINESS' SERVICE OR DEVICE FOR OTHER PURPOSES SHALL BE:
(I) COMPATIBLE WITH AN OPERATIONAL PURPOSE FOR WHICH THE PERSONAL
INFORMATION WAS COLLECTED;
(II) SUBSEQUENTLY DE-IDENTIFIED, OR IN THE AGGREGATE, SUCH THAT THE
INFORMATION CANNOT REASONABLY IDENTIFY, RELATE TO, DESCRIBE, BE CAPABLE
A. 3586 7
OF BEING ASSOCIATED WITH, OR BE LINKED, DIRECTLY OR INDIRECTLY, TO A
PARTICULAR CONSUMER;
(III) MADE SUBJECT TO TECHNICAL SAFEGUARDS TO PREVENT RE-IDENTIFICA-
TION OF THE CONSUMER TO WHOM THE INFORMATION MAY PERTAIN;
(IV) SUBJECT TO BUSINESS PROCESSES THAT SPECIFICALLY PROHIBIT RE-IDEN-
TIFICATION OF THE INFORMATION;
(V) MADE SUBJECT TO BUSINESS PROCESSES TO PREVENT INADVERTENT RELEASE
OF DE-IDENTIFIED INFORMATION;
(VI) PROTECTED FROM ANY RE-IDENTIFICATION ATTEMPTS;
(VII) USED SOLELY FOR RESEARCH PURPOSES THAT ARE COMPATIBLE WITH THE
CONTEXT IN WHICH THE PERSONAL INFORMATION WAS COLLECTED;
(VIII) NOT BE USED FOR ANY COMMERCIAL PURPOSE; AND
(IX) SUBJECTED BY THE BUSINESS CONDUCTING THE RESEARCH TO ADDITIONAL
SECURITY CONTROLS THAT LIMIT ACCESS TO THE RESEARCH DATA TO ONLY THOSE
INDIVIDUALS IN A BUSINESS AS ARE NECESSARY TO CARRY OUT THE RESEARCH
PURPOSE.
(C) (I) "SELL," "SELLING," "SALE," OR "SOLD," MEANS SELLING, RENTING,
RELEASING, DISCLOSING, DISSEMINATING, MAKING AVAILABLE, TRANSFERRING, OR
OTHERWISE COMMUNICATING ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER
MEANS, A CONSUMER'S PERSONAL INFORMATION BY THE BUSINESS TO ANOTHER
BUSINESS OR A THIRD PARTY FOR MONETARY OR OTHER VALUABLE CONSIDERATION.
(II) FOR PURPOSES OF THIS ARTICLE, A BUSINESS DOES NOT SELL PERSONAL
INFORMATION WHEN:
(1) A CONSUMER USES OR DIRECTS THE BUSINESS TO INTENTIONALLY DISCLOSE
PERSONAL INFORMATION OR USES THE BUSINESS TO INTENTIONALLY INTERACT WITH
A THIRD PARTY, PROVIDED SUCH THIRD PARTY DOES NOT ALSO SELL THE PERSONAL
INFORMATION, UNLESS SUCH DISCLOSURE WOULD BE CONSISTENT WITH THE
PROVISIONS OF THIS ARTICLE. AN INTENTIONAL INTERACTION OCCURS WHEN THE
CONSUMER INTENDS TO INTERACT WITH THE THIRD PARTY, VIA ONE OR MORE
DELIBERATE INTERACTIONS. HOVERING OVER, MUTING, PAUSING, OR CLOSING A
GIVEN PIECE OF CONTENT SHALL NOT CONSTITUTE A CONSUMER'S INTENT TO
INTERACT WITH A THIRD PARTY;
(2) THE BUSINESS USES OR DISCLOSES AN IDENTIFIER FOR A CONSUMER WHO
HAS OPTED OUT OF THE SALE OF THE CONSUMER'S PERSONAL INFORMATION FOR THE
PURPOSES OF ALERTING THIRD PARTIES THAT THE CONSUMER HAS OPTED OUT OF
THE SALE OF THE CONSUMER'S PERSONAL INFORMATION;
(3) THE BUSINESS USES OR DISCLOSES PERSONAL INFORMATION OF A CONSUMER
WITH A SERVICE PROVIDER THAT IS NECESSARY TO PERFORM AN OPERATIONAL
PURPOSE AND THE BUSINESS HAS PROVIDED NOTICE THAT INFORMATION BEING USED
OR DISCLOSED IN ITS TERMS AND CONDITIONS CONSISTENT WITH SECTION SIX
HUNDRED SEVENTY-SIX-I OF THIS ARTICLE; OR
(4) THE BUSINESS TRANSFERS TO A THIRD PARTY THE PERSONAL INFORMATION
OF A CONSUMER AS AN ASSET THAT IS PART OF A MERGER, ACQUISITION, BANK-
RUPTCY, OR OTHER TRANSACTION IN WHICH THE THIRD PARTY ASSUMES CONTROL OF
ALL OR PART OF THE BUSINESS, PROVIDED THAT INFORMATION IS USED OR
DISCLOSED CONSISTENTLY WITH THIS ARTICLE. A THIRD PARTY MAY NOT MATE-
RIALLY ALTER HOW IT USES OR DISCLOSES THE PERSONAL INFORMATION OF A
CONSUMER IN A MANNER THAT IS MATERIALLY INCONSISTENT WITH THE PROMISES
MADE AT THE TIME OF COLLECTION, UNLESS IT FIRST OBTAINS OPT-IN CONSENT,
AS SET FORTH IN THIS ARTICLE.
§ 676-A. TRANSPARENCY OF THE COLLECTION, USE, RETENTION, AND SHARING
OF PERSONAL INFORMATION. ANY BUSINESS THAT COLLECTS A CONSUMER'S
PERSONAL INFORMATION SHALL DISCLOSE THE FOLLOWING INFORMATION IN ITS
ONLINE PRIVACY POLICY OR POLICIES, IF THE BUSINESS HAS AN ONLINE PRIVACY
POLICY, AND UPDATE SUCH INFORMATION AT LEAST ONCE EVERY TWELVE MONTHS:
A. 3586 8
1. A DESCRIPTION OF A CONSUMER'S RIGHTS PURSUANT TO SECTIONS SIX
HUNDRED SEVENTY-SIX-B, SIX HUNDRED SEVENTY-SIX-D, SIX HUNDRED SEVENTY-
SIX-E, SIX HUNDRED SEVENTY-SIX-F AND SIX HUNDRED SEVENTY-SIX-G OF THIS
ARTICLE AND ONE OR MORE DESIGNATED METHODS FOR SUBMITTING REQUESTS
PURSUANT TO SECTIONS SIX HUNDRED SEVENTY-SIX-C, SIX HUNDRED
SEVENTY-SIX-D, AND SIX HUNDRED SEVENTY-SIX-E OF THIS ARTICLE;
2. A DESCRIPTION OF THE PERSONAL INFORMATION SUCH BUSINESS COLLECTS
ABOUT CONSUMERS;
3. THE CATEGORIES OF SOURCES FROM WHICH THE PERSONAL INFORMATION IS
COLLECTED;
4. A DESCRIPTION OF THE METHODS SUCH BUSINESS USES TO COLLECT PERSONAL
INFORMATION;
5. THE SPECIFIC PURPOSES FOR COLLECTING, DISCLOSING, OR RETAINING
PERSONAL INFORMATION;
6. A DESCRIPTION OF THE PERSONAL INFORMATION IT DISCLOSES ABOUT
CONSUMERS, OR IF THE BUSINESS DOES NOT DISCLOSE CONSUMERS' PERSONAL
INFORMATION, THE BUSINESS SHALL DISCLOSE SUCH FACT;
7. THE CATEGORIES OF THIRD PARTIES WITH WHOM SUCH BUSINESS SHARES
PERSONAL INFORMATION WITH, OR IF THE BUSINESS DOES NOT DISCLOSE CONSUM-
ERS' PERSONAL INFORMATION TO THIRD PARTIES, THE BUSINESS SHALL DISCLOSE
SUCH FACT;
8. THE CATEGORIES OF SERVICE PROVIDERS WITH WHOM SUCH BUSINESS SHARES
PERSONAL INFORMATION WITH, OR IF THE BUSINESS DOES NOT DISCLOSE CONSUM-
ERS' PERSONAL INFORMATION TO SERVICE PROVIDERS, THE BUSINESS SHALL
DISCLOSE SUCH FACT;
9. A DESCRIPTION OF THE LENGTH OF TIME FOR WHICH PERSONAL INFORMATION
IS RETAINED; AND
10. IF PERSONAL DATA IS DE-IDENTIFIED SUCH THAT IT IS NO LONGER
CONSIDERED PERSONAL INFORMATION BUT SUBSEQUENTLY RETAINED, USED, OR
SHARED BY THE BUSINESS, A DESCRIPTION OF THE METHOD OR METHODS OF DE-I-
DENTIFICATION.
§ 676-B. FAIR COLLECTION AND USE OF PERSONAL INFORMATION. 1. SUBJECT
TO SECTION SIX HUNDRED SEVENTY-SIX-F OF THIS ARTICLE A BUSINESS THAT
COLLECTS A CONSUMER'S PERSONAL INFORMATION SHALL LIMIT ITS COLLECTION
AND SHARING OF PERSONAL INFORMATION WITH THIRD PARTIES TO WHAT IS
REASONABLY NECESSARY TO PROVIDE A SERVICE OR CONDUCT AN ACTIVITY THAT A
CONSUMER HAS REQUESTED OR IS REASONABLY NECESSARY FOR SECURITY OR FRAUD
PREVENTION, AND SHALL REQUIRE ANY SUCH THIRD PARTY TO EXERCISE CARE OVER
THE CONSUMER'S PERSONAL INFORMATION CONSISTENT WITH THE ORIGINAL BUSI-
NESS'S OBLIGATIONS AS BAILEE OF SUCH INFORMATION.
2. SUBJECT TO SECTION SIX HUNDRED SEVENTY-SIX-F OF THIS ARTICLE, A
BUSINESS THAT COLLECTS A CONSUMER'S PERSONAL INFORMATION SHALL BE OBLI-
GATED TO EXERCISE REASONABLE CARE WITH RESPECT TO THE COLLECTION, STOR-
AGE, AND USE OF THAT INFORMATION, CONSISTENT WITH ITS OBLIGATIONS AS A
BAILEE, AND SHALL LIMIT ITS USE AND RETENTION OF PERSONAL INFORMATION TO
WHAT IS REASONABLY NECESSARY TO PROVIDE A SERVICE OR CONDUCT AN ACTIVITY
THAT A CONSUMER HAS REQUESTED OR A RELATED OPERATIONAL PURPOSE, PROVIDED
HOWEVER THAT DATA COLLECTED OR RETAINED SOLELY FOR SECURITY OR FRAUD
PREVENTION MAY NOT BE USED FOR RELATED OPERATIONAL PURPOSES.
§ 676-C. DELETION OF PERSONAL INFORMATION. 1. A CONSUMER SHALL HAVE
THE RIGHT TO REQUEST THAT A BUSINESS DELETE ANY PERSONAL INFORMATION
ABOUT SUCH CONSUMER WHICH THE BUSINESS HAS COLLECTED FROM THE CONSUMER.
2. A BUSINESS THAT COLLECTS PERSONAL INFORMATION ABOUT CONSUMERS SHALL
DISCLOSE, PURSUANT TO THE NOTICE REQUIREMENTS OF SECTION SIX HUNDRED
SEVENTY-SIX-I OF THIS ARTICLE, THE CONSUMER'S RIGHTS TO REQUEST THE
DELETION OF THE CONSUMER'S PERSONAL INFORMATION.
A. 3586 9
3. A BUSINESS THAT RECEIVES A VERIFIABLE CONSUMER REQUEST FROM A
CONSUMER TO DELETE THE CONSUMER'S PERSONAL INFORMATION PURSUANT TO
SUBDIVISION ONE OF THIS SECTION SHALL DELETE THE CONSUMER'S PERSONAL
INFORMATION FROM ITS RECORDS AND DIRECT ANY SERVICE PROVIDERS TO DELETE
THE CONSUMER'S PERSONAL INFORMATION FROM THEIR RECORDS.
4. A BUSINESS OR A SERVICE PROVIDER SHALL NOT BE REQUIRED TO COMPLY
WITH A CONSUMER'S REQUEST TO DELETE THE CONSUMER'S PERSONAL INFORMATION
IF:
(A) SUCH RETENTION OF PERSONAL INFORMATION IS REASONABLY ANTICIPATED
WITHIN THE CONTEXT OF A BUSINESS'S ONGOING BUSINESS RELATIONSHIP WITH
THE CONSUMER; OR
(B) IT IS NECESSARY FOR THE BUSINESS OR SERVICE PROVIDER TO MAINTAIN
THE CONSUMER'S PERSONAL INFORMATION IN ORDER TO:
(I) COMPLETE THE TRANSACTION FOR WHICH THE PERSONAL INFORMATION WAS
COLLECTED, PROVIDE A GOOD OR SERVICE REQUESTED BY THE CONSUMER, OR
OTHERWISE PERFORM A CONTRACT BETWEEN THE BUSINESS AND THE CONSUMER;
(II) DETECT OR RESPOND TO SECURITY INCIDENTS, PROTECT AGAINST MALI-
CIOUS, DECEPTIVE, FRAUDULENT, OR ILLEGAL ACTIVITY, OR PROSECUTE THOSE
RESPONSIBLE FOR THAT ACTIVITY;
(III) DEBUG TO IDENTIFY AND REPAIR ERRORS THAT IMPAIR EXISTING
INTENDED FUNCTIONALITY;
(IV) EXERCISE FREE SPEECH, ENSURE THE RIGHT OF ANOTHER CONSUMER TO
EXERCISE HIS OR HER RIGHT OF FREE SPEECH;
(V) ENGAGE IN PUBLIC OR PEER-REVIEWED SCIENTIFIC, HISTORICAL, OR
STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT ADHERES TO ALL OTHER
APPLICABLE ETHICS AND PRIVACY LAWS, WHEN THE BUSINESSES' DELETION OF THE
INFORMATION IS LIKELY TO RENDER IMPOSSIBLE OR SERIOUSLY IMPAIR THE
ACHIEVEMENT OF SUCH RESEARCH, IF THE CONSUMER HAS PROVIDED INFORMED
CONSENT; OR
(VI) COMPLY WITH A LEGAL OBLIGATION.
§ 676-D. ACCESS TO RETAINED PERSONAL INFORMATION. 1. IF A BUSINESS
COLLECTS PERSONAL INFORMATION ABOUT A CONSUMER, THE CONSUMER SHALL HAVE
THE RIGHT TO ASK THE BUSINESS FOR THE FOLLOWING INFORMATION, AND THE
BUSINESS SHALL HAVE THE DUTY TO PROVIDE IT, PROMPTLY AND FREE OF CHARGE,
UPON RECEIPT OF A VERIFIABLE REQUEST:
(A) THE SPECIFIC PIECES OF PERSONAL INFORMATION THAT THE BUSINESS
RETAINS ABOUT THAT CONSUMER;
(B) THE SPECIFIC SOURCES FROM WHICH THE BUSINESS COLLECTED THE
PERSONAL INFORMATION; AND
(C) ITS PURPOSE FOR COLLECTING THE PERSONAL INFORMATION.
2. WHEN A BUSINESS RECEIVES A VERIFIABLE CONSUMER REQUEST FROM A
CONSUMER FOR THE SPECIFIC PIECES OF THEIR PERSONAL INFORMATION, SUCH
BUSINESS SHALL DISCLOSE SUCH INFORMATION IN AN ELECTRONIC, PORTABLE,
MACHINE-READABLE, AND READILY-USEABLE FORMAT OR FORMATS THAT ALLOW THE
CONSUMER TO UNDERSTAND SUCH INFORMATION AND TO TRANSMIT SUCH INFORMATION
TO ANOTHER ENTITY WITHOUT HINDRANCE.
§ 676-E. ACCESS TO DISCLOSURE OF PERSONAL INFORMATION. IF A BUSINESS
DISCLOSES PERSONAL INFORMATION ABOUT A CONSUMER TO A THIRD PARTY, THE
CONSUMER SHALL HAVE THE RIGHT TO REQUEST THE FOLLOWING INFORMATION FROM
THE BUSINESS, AND SUCH BUSINESS SHALL HAVE THE DUTY TO PROVIDE IT,
PROMPTLY AND FREE OF CHARGE, UPON RECEIPT OF A VERIFIABLE REQUEST:
1. THE CATEGORIES OF PERSONAL INFORMATION THAT THE BUSINESS DISCLOSED
ABOUT THE CONSUMER, AND THE CATEGORIES OF THIRD PARTIES TO WHOM THE
PERSONAL INFORMATION WAS DISCLOSED, BY CATEGORY OF PERSONAL INFORMATION
FOR EACH CATEGORY OF THIRD PARTY; AND
A. 3586 10
2. THE SPECIFIC THIRD PARTIES TO WHOM THE PERSONAL INFORMATION WAS
DISCLOSED.
§ 676-F. CONSENT TO ADDITIONAL COLLECTION OR SHARING OF PERSONAL
INFORMATION. 1. OTHER THAN AS DESCRIBED IN SECTION SIX HUNDRED SEVENTY-
SIX-B OF THIS ARTICLE, A BUSINESS SHALL NOT COLLECT OR SHARE A CONSUM-
ER'S PERSONAL INFORMATION UNLESS THE CONSUMER HAS AFFIRMATIVELY AUTHOR-
IZED THE COLLECTION OR DISCLOSURE. THIS RIGHT TO COLLECT OR SHARE A
CONSUMER'S PERSONAL INFORMATION MAY BE REFERRED TO AS THE RIGHT TO
"OPT-IN CONSENT".
2. ANY PERSONAL INFORMATION OF A CONSUMER COLLECTED OR SHARED BY A
BUSINESS UPON THE AFFIRMATIVE AUTHORIZATION OF THE CONSUMER SHALL REMAIN
THE PROPERTY OF SUCH CONSUMER, AND THE BUSINESS SHALL BE REQUIRED TO
EXERCISE REASONABLE CARE IN THE COLLECTION AND SHARING OF SUCH DATA,
CONSISTENT WITH ITS OBLIGATIONS TOWARDS THE CONSUMER AS BAILEE OF HIS OR
HER PERSONAL INFORMATION.
3. A BUSINESS SHALL REQUEST A USER'S OPT-IN CONSENT SEPARATELY FROM
ANY OTHER PERMISSION OR CONSENT, WITH THE OPTION TO DECLINE CONSENT AT
LEAST AS PROMINENT AS THE OPTION TO PROVIDE CONSENT.
4. IF A CONSUMER DECLINES TO PROVIDE THEIR OPT-IN CONSENT TO THE
DISCLOSURE OF THEIR PERSONAL INFORMATION, A BUSINESS SHALL REFRAIN FOR
AT LEAST TWELVE MONTHS BEFORE AGAIN REQUESTING THAT THE CONSUMER PROVIDE
THEIR OPT-IN CONSENT TO THE DISCLOSURE OF THEIR PERSONAL INFORMATION.
5. A BUSINESS MAY MAKE AVAILABLE A SETTING OR OTHER USER CONTROL THAT
THE CONSUMER MAY AFFIRMATIVELY ACCESS IN ORDER TO CONSENT TO ADDITIONAL
DATA COLLECTION OR SHARING.
6. A BUSINESS THAT OBTAINS A CONSUMER'S OPT-IN CONSENT TO COLLECT OR
DISCLOSE THEIR PERSONAL INFORMATION PURSUANT TO THIS SECTION SHALL
PROVIDE CONSUMERS THE ABILITY TO WITHDRAW SUCH CONSENT THROUGH A READILY
USABLE AND AUTOMATED MEANS AT ANY TIME.
§ 676-G. NO DISCRIMINATION BY A BUSINESS AGAINST A CONSUMER FOR EXER-
CISE OF RIGHTS. A BUSINESS SHALL NOT DISCRIMINATE AGAINST A CONSUMER
BECAUSE THE CONSUMER EXERCISED ANY OF THE CONSUMER'S RIGHTS UNDER THIS
ARTICLE OR DOES NOT PROVIDE CONSENT TO ADDITIONAL DATA COLLECTION OR
SHARING UNDER SECTION SIX HUNDRED SEVENTY-SIX-F OF THIS ARTICLE INCLUD-
ING, BUT NOT LIMITED TO, BY:
1. DENYING GOODS OR SERVICES TO THE CONSUMER;
2. CHARGING DIFFERENT PRICES OR RATES FOR GOODS OR SERVICES, INCLUDING
THROUGH THE USE OF DISCOUNTS OR OTHER BENEFITS OR IMPOSING PENALTIES;
3. PROVIDING A DIFFERENT LEVEL OR QUALITY OF GOODS OR SERVICES TO THE
CONSUMER; OR
4. SUGGESTING THAT THE CONSUMER WILL RECEIVE A DIFFERENT PRICE OR RATE
FOR GOODS OR SERVICES OR A DIFFERENT LEVEL OR QUALITY OF GOODS OR
SERVICES.
§ 676-H. REASONABLE SECURITY. 1. A BUSINESS OR SERVICE PROVIDER SHALL
IMPLEMENT AND MAINTAIN REASONABLE SECURITY PROCEDURES AND PRACTICES,
INCLUDING ADMINISTRATIVE, PHYSICAL, AND TECHNICAL SAFEGUARDS, APPROPRI-
ATE TO THE NATURE OF THE INFORMATION AND THE PURPOSES FOR WHICH THE
PERSONAL INFORMATION WILL BE USED, TO PROTECT CONSUMERS' PERSONAL INFOR-
MATION FROM UNAUTHORIZED USE, DISCLOSURE, ACCESS, DESTRUCTION, OR
MODIFICATION.
2. A BUSINESS OR SERVICE PROVIDER MAY EMPLOY ANY LAWFUL SECURITY MEAS-
URES THAT ALLOW IT TO COMPLY WITH THE REQUIREMENTS SET FORTH IN THIS
SECTION.
§ 676-I. BUSINESS IMPLEMENTATION OF DUTIES. 1. A BUSINESS SHALL:
(A) MAKE AVAILABLE TO CONSUMERS TWO OR MORE DESIGNATED METHODS FOR
SUBMITTING REQUESTS PURSUANT TO SECTIONS SIX HUNDRED SEVENTY-SIX-C, SIX
A. 3586 11
HUNDRED SEVENTY-SIX-D, AND SIX HUNDRED SEVENTY-SIX-E OF THIS ARTICLE,
INCLUDING, AT A MINIMUM, A TELEPHONE NUMBER, AND, IF THE BUSINESS MAIN-
TAINS AN INTERNET WEB SITE, A WEB SITE ADDRESS;
(B) DISCLOSE AND DELIVER THE REQUIRED INFORMATION TO A CONSUMER FREE
OF CHARGE WITHIN FORTY-FIVE DAYS OF RECEIVING A VERIFIABLE CONSUMER
REQUEST. A BUSINESS SHALL TAKE STEPS TO DETERMINE WHETHER THE REQUEST IS
A VERIFIABLE CONSUMER REQUEST FROM THE IDENTIFIED CONSUMER. THE TIME
PERIOD MAY BE EXTENDED ONCE BY FORTY-FIVE DAYS WHEN REASONABLY NECES-
SARY, PROVIDED THE CONSUMER IS PROVIDED NOTICE OF THE EXTENSION WITHIN
THE FIRST FORTY-FIVE DAY PERIOD. THE DISCLOSURE SHALL COVER THE TWELVE
MONTH PERIOD PRECEDING THE REQUEST. IT SHALL BE DELIVERED THROUGH THE
CONSUMER'S ACCOUNT WITH THE BUSINESS, IF THE CONSUMER MAINTAINS AN
ACCOUNT WITH THE BUSINESS, OR BY MAIL OR ELECTRONICALLY AT THE CONSUM-
ER'S OPTION, IF THE CONSUMER DOES NOT MAINTAIN AN ACCOUNT WITH THE BUSI-
NESS. THE BUSINESS SHALL NOT REQUIRE THE CONSUMER TO CREATE AN ACCOUNT
WITH THE BUSINESS IN ORDER TO MAKE A VERIFIABLE REQUEST;
(C) ENSURE THAT ALL INDIVIDUALS RESPONSIBLE FOR HANDLING CONSUMER
INQUIRIES ABOUT THE BUSINESS'S PRIVACY PRACTICES OR THE BUSINESS'S
COMPLIANCE WITH THIS ARTICLE ARE INFORMED OF ALL REQUIREMENTS IN THIS
ARTICLE, AND HOW TO DIRECT CONSUMERS TO EXERCISE THEIR RIGHTS IN THIS
ARTICLE; AND
(D) LIMIT THE USE OF ANY PERSONAL INFORMATION COLLECTED FROM THE
CONSUMER IN CONNECTION WITH A BUSINESS'S VERIFICATION OF THE CONSUMER'S
REQUEST SOLELY FOR THE PURPOSES OF VERIFICATION.
2. A BUSINESS SHALL NOT BE OBLIGATED TO PROVIDE THE INFORMATION
REQUIRED BY SECTIONS SIX HUNDRED SEVENTY-SIX-D AND SIX HUNDRED SEVENTY-
SIX-E OF THIS ARTICLE TO THE SAME CONSUMER MORE THAN TWICE IN A TWELVE
MONTH PERIOD.
§ 676-J. EXCEPTIONS. 1. THE OBLIGATIONS IMPOSED ON BUSINESSES BY THIS
ARTICLE SHALL NOT RESTRICT A BUSINESS'S OR SERVICE PROVIDER'S ABILITY
TO:
(A) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS;
(B) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTI-
GATION, SUBPOENA, OR SUMMONS BY FEDERAL, STATE, OR LOCAL AUTHORITIES;
(C) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING CONDUCT OR
ACTIVITY THAT THE BUSINESS, SERVICE PROVIDER, OR THIRD PARTY REASONABLY
AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAW;
(D) EXERCISE OR DEFEND LEGAL CLAIMS;
(E) COLLECT, USE, RETAIN, SELL, OR DISCLOSE CONSUMER INFORMATION THAT
IS DE-IDENTIFIED OR IN THE AGGREGATE; OR
(F) COLLECT OR SELL A CONSUMER'S PERSONAL INFORMATION IF EVERY ASPECT
OF THAT COMMERCIAL CONDUCT TAKES PLACE WHOLLY OUTSIDE OF THE STATE. FOR
PURPOSES OF THIS SECTION, COMMERCIAL CONDUCT TAKES PLACE WHOLLY OUTSIDE
OF THE STATE IF THE BUSINESS COLLECTED INFORMATION WHILE THE CONSUMER
WAS OUTSIDE OF THE STATE, NO PART OF THE SALE OF THE CONSUMER'S PERSONAL
INFORMATION OCCURRED IN THE STATE, AND NO PERSONAL INFORMATION COLLECTED
WHILE THE CONSUMER WAS IN THE STATE IS SOLD. THIS PARAGRAPH SHALL NOT
PERMIT A BUSINESS FROM STORING, INCLUDING ON A DEVICE, PERSONAL INFORMA-
TION ABOUT A CONSUMER WHEN SUCH CONSUMER IS IN THE STATE AND THEN
COLLECTING SUCH PERSONAL INFORMATION WHEN SUCH CONSUMER AND STORED
PERSONAL INFORMATION IS OUTSIDE OF THE STATE.
2. NOTHING IN THIS ARTICLE SHALL REQUIRE A BUSINESS TO VIOLATE AN
EVIDENTIARY PRIVILEGE UNDER STATE OR FEDERAL LAW OR PREVENT A BUSINESS
FROM PROVIDING THE PERSONAL INFORMATION OF A CONSUMER WHO IS COVERED BY
AN EVIDENTIARY PRIVILEGE UNDER STATE OR FEDERAL LAW AS PART OF A PRIVI-
LEGED COMMUNICATION.
A. 3586 12
3. THIS ARTICLE SHALL NOT APPLY TO ANY OF THE FOLLOWING:
(A) MEDICAL INFORMATION GOVERNED BY PART 2.6 OF THE CONFIDENTIALITY OF
MEDICAL INFORMATION ACT OR PROTECTED HEALTH INFORMATION THAT IS
COLLECTED BY A COVERED ENTITY OR BUSINESS ASSOCIATE GOVERNED BY THE
PRIVACY, SECURITY, AND BREACH NOTIFICATION RULES ISSUED OR ESTABLISHED
BY THE UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, 45 C.F.R.
PARTS 160 AND 164, THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY
ACT OF 1996, OR THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLIN-
ICAL HEALTH ACT;
(B) A PROVIDER OF HEALTH CARE GOVERNED BY PART 2.6 OF THE CONFIDEN-
TIALITY OF MEDICAL INFORMATION ACT OR A COVERED ENTITY GOVERNED BY THE
PRIVACY, SECURITY, AND BREACH NOTIFICATION RULES ISSUED OR ESTABLISHED
BY THE UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, 45 C.F.R.
PARTS 160 AND 164, OR THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABIL-
ITY ACT OF 1996, TO THE EXTENT THE PROVIDER OR COVERED ENTITY MAINTAINS
PATIENT INFORMATION IN THE SAME MANNER AS MEDICAL INFORMATION OR
PROTECTED HEALTH INFORMATION AS DESCRIBED IN PARAGRAPH (A) OF THIS
SUBDIVISION;
(C) INFORMATION COLLECTED AS PART OF A CLINICAL TRIAL SUBJECT TO THE
FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, ALSO KNOWN AS THE
"COMMON RULE", PURSUANT TO GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY
THE INTERNATIONAL COUNCIL FOR HARMONIZATION OR PURSUANT TO HUMAN SUBJECT
PROTECTION REQUIREMENTS OF THE UNITED STATES FOOD AND DRUG ADMINIS-
TRATION;
(D) THE SALE OF PERSONAL INFORMATION TO OR FROM A CONSUMER REPORTING
AGENCY IF SUCH INFORMATION IS TO BE REPORTED IN, OR USED TO GENERATE, A
CONSUMER REPORT AS DEFINED IN SECTION THREE HUNDRED EIGHTY-A OF THIS
CHAPTER AND USE OF THAT INFORMATION IS LIMITED BY THE FEDERAL FAIR CRED-
IT REPORTING ACT, 15 USC 1681;
(E) PERSONAL INFORMATION COLLECTED, PROCESSED, SOLD, OR DISCLOSED
PURSUANT TO THE FEDERAL GRAMM-LEACH-BLILEY ACT OR ANY FINANCIAL PRIVACY
LAWS OR REGULATIONS OF THE STATE OF NEW YORK, AND IMPLEMENTING REGU-
LATIONS, IF IT IS IN CONFLICT WITH SUCH LAW; OR
(F) PERSONAL INFORMATION COLLECTED, PROCESSED, SOLD, OR DISCLOSED
PURSUANT TO THE DRIVER'S PRIVACY PROTECTION ACT OF 1994, IF IT IS IN
CONFLICT WITH SUCH ACT.
4. NOTWITHSTANDING A BUSINESS' OBLIGATIONS TO RESPOND TO AND HONOR
CONSUMER RIGHTS REQUESTS PURSUANT TO SECTIONS SIX HUNDRED SEVENTY-SIX-C,
SIX HUNDRED SEVENTY-SIX-D, AND SIX HUNDRED SEVENTY-SIX-E OF THIS ARTI-
CLE:
(A) THE TIME PERIOD FOR A BUSINESS TO RESPOND TO ANY VERIFIED CONSUMER
REQUEST MAY BE EXTENDED BY UP TO NINETY ADDITIONAL DAYS WHERE NECESSARY,
TAKING INTO ACCOUNT THE COMPLEXITY AND NUMBER OF THE REQUESTS. A BUSI-
NESS SHALL INFORM THE CONSUMER OF ANY SUCH EXTENSION WITHIN FORTY-FIVE
DAYS OF RECEIPT OF THE REQUEST, TOGETHER WITH THE REASONS FOR THE DELAY;
(B) IF A BUSINESS DOES NOT TAKE ACTION ON THE REQUEST OF THE CONSUMER,
SUCH BUSINESS SHALL INFORM THE CONSUMER, WITHOUT DELAY AND AT THE LATEST
WITHIN THE TIME PERIOD PERMITTED OF RESPONSE BY THIS SECTION, OF THE
REASONS FOR NOT TAKING ACTION AND ANY RIGHTS THE CONSUMER MAY HAVE TO
APPEAL THE DECISION TO THE BUSINESS; AND
(C) IF REQUESTS FROM A CONSUMER ARE MANIFESTLY UNFOUNDED OR EXCESSIVE,
IN PARTICULAR BECAUSE OF THEIR REPETITIVE CHARACTER, A BUSINESS MAY
EITHER CHARGE A REASONABLE FEE, TAKING INTO ACCOUNT THE ADMINISTRATIVE
COSTS OF PROVIDING THE INFORMATION OR COMMUNICATION OR TAKING THE ACTION
REQUESTED, OR REFUSE TO ACT ON THE REQUEST AND NOTIFY THE CONSUMER OF
THE REASON FOR REFUSING THE REQUEST. SUCH BUSINESS SHALL BEAR THE BURDEN
A. 3586 13
OF DEMONSTRATING THAT ANY VERIFIED CONSUMER REQUEST IS MANIFESTLY
UNFOUNDED OR EXCESSIVE.
5. A BUSINESS THAT DISCLOSES PERSONAL INFORMATION TO A SERVICE PROVID-
ER SHALL NOT BE LIABLE UNDER THIS ARTICLE IF THE SERVICE PROVIDER
RECEIVING THE PERSONAL INFORMATION USES IT IN VIOLATION OF THE
RESTRICTIONS SET FORTH IN THIS ARTICLE, PROVIDED THAT, AT THE TIME OF
DISCLOSING THE PERSONAL INFORMATION, SUCH BUSINESS DOES NOT HAVE ACTUAL
KNOWLEDGE, OR REASON TO BELIEVE, THAT THE SERVICE PROVIDER INTENDS TO
COMMIT SUCH A VIOLATION. A SERVICE PROVIDER SHALL NOT BE LIABLE UNDER
THIS ARTICLE FOR THE OBLIGATIONS OF A BUSINESS FOR WHICH IT PROVIDES
SERVICES AS SET FORTH IN THIS ARTICLE.
6. THIS ARTICLE SHALL NOT BE CONSTRUED TO: (A) REQUIRE A BUSINESS TO
COLLECT OR RETAIN PERSONAL INFORMATION ABOUT A CONSUMER LONGER THAN IT
WOULD BE RETAINED SUCH INFORMATION IN THE ORDINARY COURSE OF BUSINESS;
OR
(B) REQUIRE A BUSINESS TO RE-IDENTIFY OR OTHERWISE LINK INFORMATION
THAT IS NOT MAINTAINED IN A MANNER THAT WOULD BE CONSIDERED PERSONAL
INFORMATION.
7. THE RIGHTS AFFORDED TO CONSUMERS AND THE OBLIGATIONS IMPOSED ON A
BUSINESS PURSUANT TO THIS ARTICLE SHALL NOT ADVERSELY AFFECT THE RIGHTS
AND FREEDOMS OF OTHER CONSUMERS.
8. THE RIGHTS AFFORDED TO CONSUMERS AND THE OBLIGATIONS IMPOSED ON ANY
BUSINESS PURSUANT TO THIS ARTICLE SHALL NOT APPLY TO THE EXTENT THAT
THEY INFRINGE ON THE NONCOMMERCIAL ACTIVITIES OF A PUBLISHER, EDITOR,
REPORTER, OR OTHER PERSON CONNECTED WITH OR EMPLOYED UPON A NEWSPAPER,
MAGAZINE, OR OTHER PERIODICAL PUBLICATION, OR BY A PRESS ASSOCIATION OR
WIRE SERVICE.
§ 676-K. CONSUMER'S PRIVATE RIGHT OF ACTION. 1. A CONSUMER WHO HAS
SUFFERED A VIOLATION OF THIS ARTICLE MAY BRING A LAWSUIT AGAINST THE
BUSINESS THAT COMMITTED SUCH VIOLATION. A VIOLATION OF THIS ARTICLE
SHALL BE DEEMED TO CONSTITUTE AN INJURY IN FACT TO THE CONSUMER WHO HAS
SUFFERED SUCH VIOLATION, AND THE CONSUMER NEED NOT SUFFER MONETARY OR
PROPERTY LOSS AS A RESULT OF SUCH VIOLATION IN ORDER TO BRING AN ACTION
FOR A VIOLATION OF THIS ARTICLE.
2. A CONSUMER WHO PREVAILS IN SUCH AN ACTION SHALL OBTAIN THE FOLLOW-
ING REMEDIES:
(A) DAMAGES IN AN AMOUNT NOT TO EXCEED SEVEN HUNDRED FIFTY DOLLARS PER
CONSUMER PER VIOLATION OR ACTUAL DAMAGES, WHICHEVER IS GREATER;
(B) INJUNCTIVE OR DECLARATORY RELIEF, AS THE COURT DEEMS PROPER;
(C) REASONABLE ATTORNEY FEES AND COSTS; AND
(D) ANY OTHER RELIEF THE COURT DEEMS PROPER.
3. IN ASSESSING THE AMOUNT OF STATUTORY DAMAGES, THE COURT SHALL
CONSIDER ANY ONE OR MORE OF THE RELEVANT CIRCUMSTANCES PRESENTED BY ANY
OF THE PARTIES TO THE CASE, INCLUDING, BUT NOT LIMITED TO, THE NATURE
AND SERIOUSNESS OF THE MISCONDUCT, THE NUMBER OF VIOLATIONS, THE
PERSISTENCE OF THE MISCONDUCT, THE LENGTH OF TIME OVER WHICH THE MISCON-
DUCT OCCURRED, THE WILLFULNESS OF THE DEFENDANT'S MISCONDUCT, AND THE
DEFENDANT'S ASSETS, LIABILITIES, AND NET WORTH.
4. A CONSUMER BRINGING AN ACTION PURSUANT TO THIS SECTION SHALL NOTIFY
THE ATTORNEY GENERAL WITHIN THIRTY DAYS OF THE FILING OF SUCH ACTION.
§ 676-L. AGENCY ENFORCEMENT ACTION. 1. THE ATTORNEY GENERAL, COUNTY
DISTRICT ATTORNEY, OR CITY CORPORATION COUNSEL HAVING PROPER JURISDIC-
TION MAY BRING A CIVIL ACTION IN THE NAME OF THE PEOPLE OF THE STATE OF
NEW YORK AGAINST ANY PERSON, BUSINESS, OR SERVICE PROVIDER WHO VIOLATES
ANY PROVISION OF THIS ARTICLE.
A. 3586 14
2. ANY PERSON, BUSINESS, OR SERVICE PROVIDER WHO VIOLATES THE
PROVISIONS OF THIS ARTICLE MAY BE LIABLE FOR A CIVIL PENALTY OF UP TO
SEVEN THOUSAND FIVE HUNDRED DOLLARS FOR EACH INTENTIONAL VIOLATION AND
OF UP TO TWO THOUSAND FIVE HUNDRED DOLLARS FOR EACH UNINTENTIONAL
VIOLATION.
§ 676-M. CONSTRUCTION. THIS ARTICLE IS INTENDED TO FURTHER THE CONSTI-
TUTIONAL RIGHT OF PRIVACY AND TO SUPPLEMENT EXISTING LAWS RELATING TO
CONSUMERS' PERSONAL INFORMATION. THE PROVISIONS OF THIS ARTICLE ARE NOT
LIMITED TO INFORMATION COLLECTED ELECTRONICALLY OR OVER THE INTERNET,
BUT SHALL APPLY TO THE COLLECTION AND SALE OF ALL PERSONAL INFORMATION
COLLECTED BY A BUSINESS FROM CONSUMERS. WHEREVER POSSIBLE, LAW RELATING
TO CONSUMERS' PERSONAL INFORMATION SHOULD BE CONSTRUED TO HARMONIZE WITH
THE PROVISIONS OF THIS ARTICLE, BUT IN THE EVENT OF A CONFLICT BETWEEN
OTHER LAWS AND THE PROVISIONS OF THIS ARTICLE, THE PROVISIONS OF THE LAW
THAT AFFORD THE GREATEST PROTECTION FOR THE RIGHT OF PRIVACY FOR CONSUM-
ERS SHALL CONTROL.
§ 676-N. ATTORNEY GENERAL REGULATIONS. 1. WITHIN ONE YEAR OF THE
EFFECTIVE DATE OF THIS ARTICLE, THE ATTORNEY GENERAL SHALL ADOPT REGU-
LATIONS TO FURTHER THE PURPOSES OF THIS ARTICLE, INCLUDING, BUT NOT
LIMITED TO:
(A) DETAILING AS NEEDED THE TYPES OF INFORMATION THAT ARE PERSONAL
INFORMATION IN TECHNOLOGY, DATA COLLECTION PRACTICES, OBSTACLES TO
IMPLEMENTATION, AND PRIVACY CONCERNS;
(B) ESTABLISHING ANY EXCEPTIONS NECESSARY TO COMPLY WITH STATE OR
FEDERAL LAW, INCLUDING, BUT NOT LIMITED TO, THOSE RELATING TO TRADE
SECRETS AND INTELLECTUAL PROPERTY RIGHTS;
(C) FACILITATING AND GOVERNING THE SUBMISSION OF A REQUEST BY A
CONSUMER TO OPT OUT OF THE SALE OF PERSONAL INFORMATION PURSUANT TO
SECTION SIX HUNDRED SEVENTY-SIX-F OF THIS ARTICLE;
(D) GOVERNING BUSINESS COMPLIANCE WITH A CONSUMER'S OPT-OUT REQUEST;
(E) DEVELOPING A RECOGNIZABLE AND UNIFORM OPT-OUT LOGO OR BUTTON BY
ALL BUSINESSES TO PROMOTE CONSUMER AWARENESS OF THE OPPORTUNITY TO OPT-
OUT OF THE SALE OF PERSONAL INFORMATION;
(F) ADJUSTING THE MONETARY THRESHOLD IN CLAUSE ONE OF SUBPARAGRAPH (I)
OF PARAGRAPH (C) OF SUBDIVISION ONE OF SECTION SIX HUNDRED SEVENTY-SIX
OF THIS ARTICLE IN JANUARY OF EVERY ODD-NUMBERED YEAR TO REFLECT ANY
INCREASE IN THE CONSUMER PRICE INDEX;
(G) ESTABLISHING RULES, PROCEDURES, AND ANY EXCEPTIONS NECESSARY TO
ENSURE THAT THE NOTICES AND INFORMATION THAT BUSINESSES ARE REQUIRED TO
PROVIDE PURSUANT TO THIS ARTICLE ARE PROVIDED IN A MANNER THAT MAY BE
EASILY UNDERSTOOD BY THE AVERAGE CONSUMER, ARE ACCESSIBLE TO CONSUMERS
WITH DISABILITIES, AND ARE AVAILABLE IN THE LANGUAGE PRIMARILY USED TO
INTERACT WITH THE CONSUMER, INCLUDING ESTABLISHING RULES AND GUIDELINES
REGARDING FINANCIAL INCENTIVE OFFERINGS; AND
(H) ESTABLISHING RULES AND PROCEDURES TO FURTHER THE PURPOSES OF
SECTIONS SIX HUNDRED SEVENTY-SIX-D AND SIX HUNDRED SEVENTY-SIX-E OF THIS
ARTICLE AND TO FACILITATE A CONSUMER'S OR THE CONSUMER'S AUTHORIZED
AGENT'S ABILITY TO OBTAIN INFORMATION PURSUANT TO SECTION SIX HUNDRED
SEVENTY-SIX-I OF THIS ARTICLE, WITH THE GOAL OF MINIMIZING THE ADMINIS-
TRATIVE BURDEN ON CONSUMERS, TAKING INTO ACCOUNT AVAILABLE TECHNOLOGY,
SECURITY CONCERNS, AND THE BURDEN ON THE BUSINESS, TO GOVERN A BUSINESS'
DETERMINATION THAT A REQUEST FOR INFORMATION RECEIVED BY A CONSUMER IS A
VERIFIABLE CONSUMER REQUEST, INCLUDING TREATING A REQUEST SUBMITTED
THROUGH A PASSWORD-PROTECTED ACCOUNT MAINTAINED BY THE CONSUMER WITH THE
BUSINESS WHILE THE CONSUMER IS LOGGED INTO THE ACCOUNT AS A VERIFIABLE
CONSUMER REQUEST AND PROVIDING A MECHANISM FOR A CONSUMER WHO DOES NOT
A. 3586 15
MAINTAIN AN ACCOUNT WITH THE BUSINESS TO REQUEST INFORMATION THROUGH THE
BUSINESS' AUTHENTICATION OF THE CONSUMER'S IDENTITY.
2. THE ATTORNEY GENERAL MAY UPDATE THE FOREGOING REGULATIONS, AND
ADOPT ADDITIONAL REGULATIONS, AS NECESSARY TO FURTHER THE PURPOSES OF
THIS ARTICLE.
3. BEFORE ADOPTING ANY REGULATIONS, THE ATTORNEY GENERAL SHALL SOLICIT
BROAD PUBLIC PARTICIPATION CONCERNING THOSE REGULATIONS.
§ 676-O. INTERMEDIATE TRANSACTIONS. IF A SERIES OF STEPS OR TRANS-
ACTIONS WERE COMPONENT PARTS OF A SINGLE TRANSACTION INTENDED FROM THE
BEGINNING TO BE TAKEN WITH THE INTENTION OF AVOIDING THE REACH OF THIS
ARTICLE, A COURT SHALL DISREGARD THE INTERMEDIATE STEPS OR TRANSACTIONS
FOR PURPOSES OF EFFECTUATING THE PURPOSES OF THIS ARTICLE.
§ 676-P. NON-WAIVER. ANY PROVISION OF A CONTRACT OR AGREEMENT OF ANY
KIND THAT PURPORTS TO WAIVE OR LIMIT IN ANY WAY A CONSUMER'S RIGHTS
UNDER THIS ARTICLE, INCLUDING, BUT NOT LIMITED TO, ANY RIGHT TO A REMEDY
OR MEANS OF ENFORCEMENT, SHALL BE DEEMED CONTRARY TO PUBLIC POLICY AND
SHALL BE VOID AND UNENFORCEABLE. THIS SECTION SHALL NOT PREVENT A
CONSUMER FROM DECLINING TO REQUEST INFORMATION FROM A BUSINESS, DECLIN-
ING TO OPT OUT OF A BUSINESS' SALE OF THE CONSUMER'S PERSONAL INFORMA-
TION, OR AUTHORIZING A BUSINESS TO SELL THE CONSUMER'S PERSONAL INFORMA-
TION AFTER PREVIOUSLY OPTING OUT.
§ 676-Q. SEVERABILITY. IF ANY PROVISION OF THIS ARTICLE OR THE APPLI-
CATION THEREOF TO ANY PERSON, BUSINESS, SERVICE PROVIDER, OR CIRCUM-
STANCES IS HELD INVALID, SUCH INVALIDITY SHALL NOT AFFECT OTHER
PROVISIONS OR APPLICATIONS OF THIS ARTICLE WHICH CAN BE GIVEN EFFECT
WITHOUT THE INVALID PROVISION OR APPLICATION, AND TO THIS END THE
PROVISIONS OF THIS ARTICLE ARE DECLARED TO BE SEVERABLE.
§ 5. This act shall take effect one year after it shall have become a
law.