S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  5094

                       2013-2014 Regular Sessions

                          I N  A S S E M B L Y

                            February 20, 2013
                               ___________

Introduced  by M. of A. MILLMAN -- read once and referred to the Commit-
  tee on Judiciary

AN ACT to amend the civil practice law and rules and the  general  busi-
  ness law, in relation to enacting "The Reader Privacy Act"

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. This act shall be known and may be  cited  as  "The  Reader
Privacy Act".
  S  2.  The  civil  practice  law  and rules is amended by adding a new
section 4509-a to read as follows:
  S 4509-A. BOOK SERVICE RECORDS. (A) FOR PURPOSES OF THIS SECTION:
  (1) "BOOK" MEANS PAGINATED OR SIMILARLY ORGANIZED CONTENT IN  PRINTED,
AUDIO,  ELECTRONIC,  OR  OTHER  FORMAT,  INCLUDING  FICTION, NONFICTION,
ACADEMIC, OR OTHER WORKS OF THE TYPE NORMALLY PUBLISHED IN A  VOLUME  OR
VOLUMES.
  (2)  "BOOK  SERVICE"  MEANS  A  SERVICE  THAT, AS ITS PRIMARY PURPOSE,
PROVIDES THE RENTAL, PURCHASE, BORROWING, BROWSING, OR VIEWING OF BOOKS.
  (3) "GOVERNMENT ENTITY" MEANS ANY STATE OR  LOCAL  AGENCY,  INCLUDING,
BUT NOT LIMITED TO, A LAW ENFORCEMENT OR ANY OTHER INVESTIGATIVE AGENCY,
DEPARTMENT,  DIVISION,  BUREAU,  BOARD, OR COMMISSION, OR ANY INDIVIDUAL
ACTING OR PURPORTING TO ACT FOR OR ON BEHALF OF A STATE OR LOCAL AGENCY.
  (4) "PERSONAL INFORMATION" MEANS ALL OF THE FOLLOWING:
  (A) ANY INFORMATION THAT IDENTIFIES,  RELATES  TO,  DESCRIBES,  OR  IS
ASSOCIATED WITH A PARTICULAR USER, INCLUDING, BUT NOT LIMITED TO, HIS OR
HER NAME, SIGNATURE, SOCIAL SECURITY NUMBER, PHYSICAL CHARACTERISTICS OR
DESCRIPTION,   ADDRESS,  TELEPHONE  NUMBER,  PASSPORT  NUMBER,  DRIVER'S
LICENSE OR STATE IDENTIFICATION CARD NUMBER,  INSURANCE  POLICY  NUMBER,
EDUCATION,  EMPLOYMENT,  EMPLOYMENT HISTORY, BANK ACCOUNT NUMBER, CREDIT
CARD NUMBER, DEBIT CARD NUMBER,  OR  ANY  OTHER  FINANCIAL  INFORMATION,
MEDICAL INFORMATION, OR HEALTH INSURANCE INFORMATION. "PERSONAL INFORMA-
TION"  DOES  NOT INCLUDE PUBLICLY AVAILABLE INFORMATION THAT IS LAWFULLY

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD01917-01-3
              

A. 5094                             2

MADE AVAILABLE TO THE GENERAL  PUBLIC  FROM  FEDERAL,  STATE,  OR  LOCAL
GOVERNMENT RECORDS.
  (B)  A UNIQUE IDENTIFIER OR INTERNET PROTOCOL ADDRESS, WHEN THAT IDEN-
TIFIER OR ADDRESS IS BEING USED TO IDENTIFY, RELATE TO, DESCRIBE, OR  BE
ASSOCIATED WITH A PARTICULAR USER OF A BOOK SERVICE OR BOOK, IN WHOLE OR
IN PARTIAL FORM.
  (C) ANY INFORMATION THAT RELATES TO, OR IS CAPABLE OF BEING ASSOCIATED
WITH,  A PARTICULAR USER'S ACCESS TO OR USE OF A BOOK SERVICE OR A BOOK,
IN WHOLE OR IN PARTIAL FORM.
  (5) "PROVIDER" MEANS ANY COMMERCIAL ENTITY OFFERING A BOOK SERVICE  TO
THE PUBLIC.
  (6) "USER" MEANS ANY PERSON OR ENTITY THAT USES A BOOK SERVICE.
  (B)  A PROVIDER SHALL NOT KNOWINGLY DISCLOSE TO ANY GOVERNMENT ENTITY,
OR BE COMPELLED TO DISCLOSE TO ANY PERSON, PRIVATE ENTITY, OR GOVERNMENT
ENTITY, ANY PERSONAL INFORMATION OF A USER,  EXCEPT  UNDER  ANY  OF  THE
FOLLOWING CIRCUMSTANCES:
  (1)  A  PROVIDER  SHALL  DISCLOSE  PERSONAL INFORMATION OF A USER TO A
GOVERNMENT ENTITY ONLY PURSUANT TO  A  COURT  ORDER  ISSUED  BY  A  DULY
AUTHORIZED  COURT WITH JURISDICTION OVER AN OFFENSE THAT IS UNDER INVES-
TIGATION AND ONLY IF ALL OF THE FOLLOWING CONDITIONS ARE MET:
  (A) THE COURT ISSUING THE ORDER FINDS THAT PROBABLE  CAUSE  EXISTS  TO
BELIEVE  THE  PERSONAL INFORMATION REQUESTED IS RELEVANT EVIDENCE TO THE
INVESTIGATION OF AN OFFENSE AND THE REQUIREMENTS OF ARTICLE SIX  HUNDRED
NINETY OF THE CRIMINAL PROCEDURE LAW ARE SATISFIED.
  (B)  THE COURT ISSUING THE ORDER FINDS THAT THE PERSON OR ENTITY SEEK-
ING DISCLOSURE HAS A  COMPELLING  INTEREST  IN  OBTAINING  THE  PERSONAL
INFORMATION SOUGHT.
  (C)  THE  COURT  ISSUING THE ORDER FINDS THAT THE PERSONAL INFORMATION
SOUGHT CANNOT BE OBTAINED BY THE PERSON  OR  ENTITY  SEEKING  DISCLOSURE
THROUGH LESS INTRUSIVE MEANS.
  (D) THE PERSON OR ENTITY SEEKING DISCLOSURE PROVIDES THE PROVIDER WITH
REASONABLE NOTICE OF THE PROCEEDING PRIOR TO THE ISSUANCE OF THE ORDER.
  (E) THE OPPORTUNITY TO APPEAR AND CONTEST THE ISSUANCE OF THE ORDER IS
AFFORDED TO THE PROVIDER PRIOR TO THE ISSUANCE OF THE ORDER.
  (F)  NOTICE  OF THE ORDER IS GIVEN TO THE USER BY THE PERSON OR ENTITY
SEEKING DISCLOSURE CONTEMPORANEOUS WITH EXECUTION OF THE  ORDER,  UNLESS
THERE  IS  A  JUDICIAL DETERMINATION OF A STRONG SHOWING OF NECESSITY TO
DELAY THAT NOTIFICATION FOR A REASONABLE PERIOD OF TIME, NOT  TO  EXCEED
SEVEN DAYS.
  (2)  A PROVIDER SHALL DISCLOSE PERSONAL INFORMATION OF A USER PURSUANT
TO A COURT ORDER IN A PENDING CIVIL OR ADMINISTRATIVE ACTION, IF ALL  OF
THE FOLLOWING CONDITIONS ARE MET:
  (A)  THE COURT ISSUING THE ORDER FINDS THAT THE PERSON OR ENTITY SEEK-
ING DISCLOSURE HAS A  COMPELLING  INTEREST  IN  OBTAINING  THE  PERSONAL
INFORMATION SOUGHT.
  (B)  THE  COURT  ISSUING THE ORDER FINDS THAT THE PERSONAL INFORMATION
SOUGHT CANNOT BE OBTAINED BY THE PERSON  OR  ENTITY  SEEKING  DISCLOSURE
THROUGH LESS INTRUSIVE MEANS.
  (C)  THE PERSON OR ENTITY SEEKING DISCLOSURE TAKES REASONABLE STEPS TO
PROVIDE THE USER AND THE PROVIDER WITH REASONABLE NOTICE OF THE PROCEED-
ING PRIOR TO THE ISSUANCE OF THE COURT ORDER IN A TIMELY MANNER TO ALLOW
THE USER AND PROVIDER THE OPPORTUNITY TO APPEAR AND CONTEST THE ISSUANCE
OF THE COURT ORDER.
  (D) THE PROVIDER REFRAINS FROM  DISCLOSING  ANY  PERSONAL  INFORMATION
PURSUANT  TO  THE COURT ORDER UNTIL IT PROVIDES NOTICE TO THE USER ABOUT
THE ISSUANCE OF THE ORDER AND THE ABILITY TO APPEAR AND QUASH THE ORDER,

A. 5094                             3

AND THE USER HAS BEEN GIVEN A REASONABLE OPPORTUNITY TO APPEAR AND QUASH
THE ORDER.
  (3)  A  PROVIDER  SHALL DISCLOSE THE PERSONAL INFORMATION OF A USER TO
ANY PERSON IF THE USER  HAS  GIVEN  HIS  OR  HER  INFORMED,  AFFIRMATIVE
CONSENT TO THE SPECIFIC DISCLOSURE FOR A PARTICULAR PURPOSE.
  (4)  A PROVIDER MAY DISCLOSE TO A GOVERNMENT ENTITY, IF THE GOVERNMENT
ENTITY ASSERTS, AND THE PROVIDER IN GOOD FAITH BELIEVES, THAT  THERE  IS
AN  IMMINENT  DANGER  OF  DEATH OR SERIOUS PHYSICAL INJURY REQUIRING THE
IMMEDIATE DISCLOSURE OF THE REQUESTED PERSONAL INFORMATION AND THERE  IS
INSUFFICIENT  TIME TO OBTAIN A COURT ORDER.  THE GOVERNMENT ENTITY SEEK-
ING THE DISCLOSURE SHALL PROVIDE THE PROVIDER WITH A  WRITTEN  STATEMENT
SETTING  FORTH THE FACTS GIVING RISE TO THE EMERGENCY UPON REQUEST OR NO
LATER THAN FORTY-EIGHT HOURS AFTER SEEKING DISCLOSURE.
  (5) A PROVIDER MAY DISCLOSE PERSONAL INFORMATION OF A USER OF  A  BOOK
SERVICE  TO  A  GOVERNMENT ENTITY IF THE PROVIDER IN GOOD FAITH BELIEVES
THAT THE PERSONAL INFORMATION IS EVIDENCE DIRECTLY RELATED AND  RELEVANT
TO A CRIME AGAINST THE PROVIDER OR THAT USER OF THE BOOK SERVICE.
  (C)  (1)  ANY  COURT  ISSUING  AN  ORDER  REQUIRING  THE DISCLOSURE OF
PERSONAL INFORMATION OF A USER OF A BOOK SERVICE SHALL IMPOSE  APPROPRI-
ATE  SAFEGUARDS AGAINST THE UNAUTHORIZED DISCLOSURE OF PERSONAL INFORMA-
TION BY THE PROVIDER PURSUANT TO THE ORDER.
  (2) THE COURT MAY, IN ITS DISCRETION, QUASH OR MODIFY AN ORDER REQUIR-
ING THE DISCLOSURE OF THE USER'S PERSONAL INFORMATION UPON A MOTION MADE
BY THE USER, PROVIDER, OR PERSON OR ENTITY SEEKING DISCLOSURE.
  (D) EXCEPT AS PROOF IN AN ACTION FOR A VIOLATION OF THIS  SECTION,  NO
EVIDENCE  OBTAINED  IN  VIOLATION OF THIS SECTION SHALL BE ADMISSIBLE IN
ANY CIVIL, ADMINISTRATIVE, OR OTHER PROCEEDING.
  (E) (1) VIOLATIONS OF THIS SECTION SHALL BE SUBJECT TO  THE  FOLLOWING
PENALTIES:
  (A)  ANY PROVIDER THAT KNOWINGLY PROVIDES PERSONAL INFORMATION ABOUT A
USER TO A GOVERNMENT ENTITY  IN  VIOLATION  OF  THIS  SECTION  SHALL  BE
SUBJECT  TO  A CIVIL PENALTY NOT TO EXCEED FIVE HUNDRED DOLLARS FOR EACH
VIOLATION, WHICH MAY BE RECOVERED IN  A  CIVIL  ACTION  BROUGHT  BY  THE
PERSON WHO IS THE SUBJECT OF THE RECORDS.
  (B)  ANY  PROVIDER  THAT  KNOWINGLY PROVIDES PERSONAL INFORMATION TO A
GOVERNMENT ENTITY IN VIOLATION OF THIS SECTION SHALL, IN ADDITION TO THE
PENALTY PRESCRIBED BY SUBPARAGRAPH (A) OF THIS PARAGRAPH, BE SUBJECT  TO
A  CIVIL  PENALTY NOT TO EXCEED FIVE HUNDRED DOLLARS FOR EACH VIOLATION,
WHICH MAY BE ASSESSED AND RECOVERED IN A CIVIL  ACTION  BROUGHT  BY  THE
ATTORNEY  GENERAL,  BY  ANY  DISTRICT ATTORNEY OR CITY ATTORNEY, OR BY A
CITY PROSECUTOR IN ANY CITY HAVING A FULL-TIME CITY PROSECUTOR,  IN  ANY
COURT OF COMPETENT JURISDICTION.
  (2)  IF  AN ACTION IS BROUGHT BY THE ATTORNEY GENERAL, ONE-HALF OF THE
PENALTY COLLECTED SHALL BE PAID TO THE TREASURER OF THE COUNTY IN  WHICH
THE  JUDGMENT WAS ENTERED, AND ONE-HALF TO THE GENERAL FUND DESCRIBED IN
SECTION SEVENTY-TWO OF THE STATE FINANCE LAW. IF THE ACTION  IS  BROUGHT
BY A DISTRICT ATTORNEY, THE PENALTY COLLECTED SHALL BE PAID TO THE TREA-
SURER  OF THE COUNTY IN WHICH THE JUDGMENT WAS ENTERED. IF THE ACTION IS
BROUGHT BY A CITY ATTORNEY OR CITY PROSECUTOR, ONE-HALF OF  THE  PENALTY
SHALL  BE  PAID  TO  THE TREASURER OF THE CITY IN WHICH THE JUDGMENT WAS
ENTERED, AND ONE-HALF TO THE TREASURER OF THE COUNTY IN WHICH THE  JUDG-
MENT WAS ENTERED.
  (3) THE PENALTIES PROVIDED BY THIS SECTION ARE NOT THE EXCLUSIVE REME-
DY AND DO NOT AFFECT ANY OTHER RELIEF OR REMEDY PROVIDED BY LAW.

A. 5094                             4

  (4) A CIVIL ACTION BROUGHT PURSUANT TO THIS SECTION SHALL BE COMMENCED
WITHIN TWO YEARS AFTER THE DATE UPON WHICH THE CLAIMANT FIRST DISCOVERED
THE VIOLATION.
  (F)  AN  OBJECTIVELY  REASONABLE  RELIANCE  BY THE PROVIDER ON A COURT
ORDER FOR THE DISCLOSURE OF PERSONAL INFORMATION OF A  USER  OF  A  BOOK
SERVICE,  OR  ON ANY OF THE ENUMERATED EXCEPTIONS TO THE CONFIDENTIALITY
OF A USER'S PERSONAL  INFORMATION  SET  FORTH  IN  THIS  SECTION,  IS  A
COMPLETE DEFENSE TO ANY CIVIL, ADMINISTRATIVE, OR CRIMINAL ACTION.
  (G)  UNLESS  DISCLOSURE  OF  INFORMATION  PERTAINING  TO  A PARTICULAR
REQUEST OR SET OF REQUESTS IS SPECIFICALLY PROHIBITED BY LAW, A PROVIDER
SHALL PREPARE A REPORT INCLUDING ALL OF THE  FOLLOWING  INFORMATION,  TO
THE EXTENT IT CAN BE REASONABLY DETERMINED:
  (1)  THE  NUMBER  OF  GRAND  JURY  SUBPOENAS, CIVIL AND ADMINISTRATIVE
SUBPOENAS, FEDERAL AND  STATE  CIVIL  AND  CRIMINAL  COURT  ORDERS,  AND
REQUESTS  FOR  INFORMATION MADE WITH THE INFORMED CONSENT OF THE USER AS
DESCRIBED IN PARAGRAPH THREE OF SUBDIVISION (B) OF THIS SECTION, SEEKING
DISCLOSURE OF ANY PERSONAL INFORMATION OF A USER RELATED TO  THE  ACCESS
OR  USE OF A BOOK SERVICE OR BOOK, RECEIVED BY THE PROVIDER FROM JANUARY
FIRST TO DECEMBER THIRTY-FIRST, INCLUSIVE, OF THE PREVIOUS YEAR.
  (2) THE NUMBER OF DISCLOSURES MADE BY THE PROVIDER PURSUANT  TO  PARA-
GRAPHS  FOUR  AND  FIVE  OF SUBDIVISION (B) OF THIS SECTION FROM JANUARY
FIRST TO DECEMBER THIRTY-FIRST, INCLUSIVE, OF THE PREVIOUS YEAR.
  (3) FOR EACH CATEGORY OF DEMAND  OR  DISCLOSURE,  THE  PROVIDER  SHALL
INCLUDE ALL OF THE FOLLOWING INFORMATION:
  (A)  THE  NUMBER OF TIMES NOTICE OF A COURT ORDER IN A CRIMINAL, CIVIL
OR ADMINISTRATIVE ACTION HAS BEEN PROVIDED BY THE PROVIDER AND THE  DATE
THE NOTICE WAS PROVIDED.
  (B) THE NUMBER OF TIMES PERSONAL INFORMATION HAS BEEN DISCLOSED BY THE
PROVIDER.
  (C)  THE NUMBER OF TIMES NO PERSONAL INFORMATION HAS BEEN DISCLOSED BY
THE PROVIDER.
  (D) THE NUMBER OF TIMES THE PROVIDER CONTESTS THE DEMAND.
  (E) THE NUMBER OF TIMES THE USER CONTESTS THE DEMAND.
  (F) THE NUMBER OF USERS WHOSE PERSONAL INFORMATION  WAS  DISCLOSED  BY
THE PROVIDER.
  (G) THE TYPE OF PERSONAL INFORMATION THAT WAS DISCLOSED AND THE NUMBER
OF TIMES THAT TYPE OF PERSONAL INFORMATION WAS DISCLOSED.
  (H) REPORTS PREPARED PURSUANT TO SUBDIVISION (G) OF THIS SECTION SHALL
BE  MADE PUBLICLY AVAILABLE IN AN ONLINE, SEARCHABLE FORMAT ON OR BEFORE
MARCH FIRST OF EACH YEAR. IF THE PROVIDER DOES NOT HAVE AN INTERNET  WEB
SITE, THE PROVIDER SHALL POST THE REPORTS PROMINENTLY ON ITS PREMISES OR
SEND  THE  REPORTS  TO  THE  OFFICE OF THE ATTORNEY GENERAL ON OR BEFORE
MARCH FIRST OF EACH YEAR.
  (I) ANY PROVIDER OPERATING A COMMERCIAL WEB  SITE  OR  ONLINE  SERVICE
THAT  COLLECTS USER INFORMATION THROUGH THE INTERNET FROM OR ABOUT INDI-
VIDUAL CONSUMERS RESIDING IN THE STATE WHO USE OR VISIT  ITS  COMMERCIAL
WEB  SITE  OR  ONLINE  SERVICE SHALL CREATE A PROMINENT HYPERLINK TO ITS
LATEST REPORT PUBLISHED PURSUANT TO SUBDIVISION (H) OF THIS  SECTION  IN
THE  DISCLOSURE  SECTION  OF  THE  PRIVACY POLICY APPLICABLE TO ITS BOOK
SERVICE ON OR BEFORE MARCH FIRST OF EACH YEAR.
  (J) NOTHING IN THIS SECTION SHALL OTHERWISE AFFECT THE RIGHTS  OF  ANY
PERSON UNDER ANY OTHER LAW OF THIS STATE.
  S  3. The general business law is amended by adding a new section 399-
ff to read as follows:
  S 399-FF. READER PRIVACY.  1. ANY PROVIDER OPERATING A COMMERCIAL  WEB
SITE  OR  ONLINE  SERVICE THAT COLLECTS PERSONAL INFORMATION THROUGH THE

A. 5094                             5

INTERNET FROM OR ABOUT INDIVIDUAL CONSUMERS RESIDING IN  THE  STATE  WHO
USE OR VISIT ITS COMMERCIAL WEB SITE OR ONLINE SERVICE SHALL:
  (A) CREATE A PROMINENT HYPERLINK TO ITS PRIVACY POLICY TO DISCLOSE ITS
INFORMATION  GATHERING AND DISSEMINATION PRACTICES RELATED TO THE INTER-
NET; AND
  (B) REQUIRE THAT, PRIOR TO BEING GIVEN ACCESS TO THE SITE OR  SERVICE,
ALL  INDIVIDUAL CONSUMERS DESIRING TO UTILIZE THE COMMERCIAL WEB SITE OR
ONLINE SERVICE CHECK A NOTIFICATION  BOX  LOCATED  AFTER  THE  FOLLOWING
STATEMENT: "I UNDERSTAND THAT BY AGREEING TO THIS I AM GIVING UP CERTAIN
PRIVACY  RIGHTS".  SUCH  STATEMENT AND BOX SHALL BE CONSPICUOUSLY POSTED
DIRECTLY ABOVE THE TERMS  OF  SERVICES  ACCEPTANCE  AND  ACKNOWLEDGEMENT
STATEMENT AND NOTIFICATION BOX.
  2.  THE PRIVACY POLICY REQUIRED BY PARAGRAPH (A) OF SUBDIVISION ONE OF
THIS SECTION SHALL DESCRIBE, AT A MINIMUM,  THE  PROVIDER'S  INFORMATION
PRACTICES  WITH  REGARD  TO  THE  FOLLOWING  MATTERS IN CLEAR AND EASILY
UNDERSTANDABLE LANGUAGE:
  (A) THE TYPES OF  PERSONAL  INFORMATION  THAT  THE  PROVIDER  COLLECTS
THROUGH  THE WEB SITE OR ONLINE SERVICE FROM OR ABOUT INDIVIDUAL CONSUM-
ERS;
  (B) THE MANNER IN WHICH THE PROVIDER USES THE INFORMATION;
  (C) WHETHER AND UNDER WHAT CIRCUMSTANCES THE  PROVIDER  DISCLOSES  THE
OBTAINED  INFORMATION  TO  OTHER  ENTITIES  OR  PERSONS,  INCLUDING  LAW
ENFORCEMENT AGENCIES;
  (D) WHETHER AND UNDER WHAT CIRCUMSTANCES OTHER  ENTITIES  OR  PERSONS,
INCLUDING  LAW  ENFORCEMENT AGENCIES, ARE COLLECTING INFORMATION THROUGH
THE PROVIDER WEB SITE;
  (E) THE IDENTITIES OF OTHER ENTITIES OR PERSONS WITH WHOM THE PROVIDER
MAY SHARE PERSONAL INFORMATION;
  (F) THE PROCESS FOR A CONSUMER WHO USES OR VISITS THE  PROVIDER'S  WEB
SITE  OR  ONLINE  SERVICE TO REVIEW AND REQUEST CHANGES TO ANY OF HIS OR
HER PERSONALLY IDENTIFIABLE INFORMATION THAT IS  COLLECTED  THROUGH  THE
WEB SITE OR ONLINE SERVICE, IF SUCH PROCESS EXISTS; AND
  (G)  THE  PROCESS  BY WHICH THE PROVIDER NOTIFIES CONSUMERS WHO USE OR
VISIT ITS COMMERCIAL WEB SITE OR ONLINE SERVICE OF MATERIAL  CHANGES  TO
THE PROVIDER'S PRIVACY POLICY FOR THAT WEB SITE OR ONLINE SERVICE.
  3.  A  PROVIDER  SHALL BE IN VIOLATION OF THIS SUBDIVISION ONLY IF THE
PROVIDER FAILS TO POST ITS POLICY WITHIN THIRTY DAYS AFTER  BEING  NOTI-
FIED OF NONCOMPLIANCE.
  4. AS USED IN THIS SECTION:
  (A) "PERSONAL INFORMATION" MEANS ALL OF THE FOLLOWING:
  (1)  ANY  INFORMATION  THAT  IDENTIFIES,  RELATES TO, DESCRIBES, OR IS
ASSOCIATED WITH A PARTICULAR PERSON, INCLUDING, BUT NOT LIMITED TO,  HIS
OR HER NAME, SIGNATURE, SOCIAL SECURITY NUMBER, PHYSICAL CHARACTERISTICS
OR  DESCRIPTION,  ADDRESS,  TELEPHONE  NUMBER, PASSPORT NUMBER, DRIVER'S
LICENSE OR STATE IDENTIFICATION CARD NUMBER,  INSURANCE  POLICY  NUMBER,
EDUCATION,  EMPLOYMENT,  EMPLOYMENT HISTORY, BANK ACCOUNT NUMBER, CREDIT
CARD NUMBER, DEBIT CARD NUMBER,  OR  ANY  OTHER  FINANCIAL  INFORMATION,
MEDICAL INFORMATION, OR HEALTH INSURANCE INFORMATION. "PERSONAL INFORMA-
TION"  DOES  NOT INCLUDE PUBLICLY AVAILABLE INFORMATION THAT IS LAWFULLY
MADE AVAILABLE TO THE GENERAL  PUBLIC  FROM  FEDERAL,  STATE,  OR  LOCAL
GOVERNMENT RECORDS;
  (2)  A UNIQUE IDENTIFIER OR INTERNET PROTOCOL ADDRESS, WHEN THAT IDEN-
TIFIER OR ADDRESS IS BEING USED TO IDENTIFY, RELATE TO, DESCRIBE, OR  BE
ASSOCIATED  WITH A PARTICULAR PERSON OF A BOOK SERVICE OR BOOK, IN WHOLE
OR IN PARTIAL FORM; AND

A. 5094                             6

  (3) ANY INFORMATION THAT RELATES TO, OR IS CAPABLE OF BEING ASSOCIATED
WITH, A PARTICULAR PERSON'S ACCESS TO OR USE OF  A  BOOK  SERVICE  OR  A
BOOK, IN WHOLE OR IN PARTIAL FORM.
  (B)  "PROVIDER" MEANS ANY COMMERCIAL ENTITY OFFERING A BOOK SERVICE TO
THE PUBLIC.
  (C) "CONSUMER" MEANS ANY INDIVIDUAL WHO SEEKS OR ACQUIRES, BY PURCHASE
OR LEASE, ANY GOODS, SERVICES, MONEY, OR CREDIT FOR PERSONAL, FAMILY, OR
HOUSEHOLD PURPOSES.
  S 4. This act shall take effect on the sixtieth  day  after  it  shall
have become a law.