NY State Assembly Bill 2017-A7191B

Assembly Bill A7191B

2017-2018 Legislative Session

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer

download bill text pdf

Archive: Last Bill Status - In Senate Committee Rules Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jun 19, 2018	referred to rules delivered to senate passed assembly
Jan 03, 2018	ordered to third reading cal.504
Jun 19, 2017	ordered to third reading rules cal.498 rules report cal.498 reported reported referred to rules
Jun 15, 2017	print number 7191b
Jun 15, 2017	amend and recommit to codes
Jun 05, 2017	reported referred to codes
May 24, 2017	print number 7191a
May 24, 2017	amend (t) and recommit to consumer affairs and protection
Apr 12, 2017	referred to consumer affairs and protection

Bill Amendments

Original

B (Active)

co-Sponsors

View additional co-sponsors

multi-Sponsors

2017-A7191 - Details

See Senate Version of this Bill:: S5603
Current Committee:: Senate Rules
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: A2420, S518
2021-2022: A674, S4830
2023-2024: A1484, S4367

2017-A7191 - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-A7191 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7191
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              April 12, 2017
                                ___________
 
 Introduced  by  M.  of  A.  WALLACE,  ZEBROWSKI,  ROZIC,  JOHNS,  STECK,
   PHEFFER AMATO, MORINELLO, McDONOUGH,  OTIS,  BRINDISI,  GALEF,  LOPEZ,
   SKOUFIS,  JAFFEE,  BUCHWALD, DICKENS -- Multi-Sponsored by -- M. of A.
   CROUCH, SIMON -- read once and referred to the Committee  on  Consumer
   Affairs and Protection

 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure  of  personally  identifiable  information  by  an internet
   service provider without the express written approval of the customer
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   §  399-K.  DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION BY AN
 INTERNET SERVICE PROVIDER; PROHIBITED.  1.  FOR  THE  PURPOSES  OF  THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A)  "CONSUMER"  MEANS A PERSON WHO AGREES TO PAY A FEE TO AN INTERNET
 SERVICE PROVIDER FOR ACCESS TO THE INTERNET  FOR  PERSONAL,  FAMILY,  OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B)  "INTERNET  SERVICE  PROVIDER"  MEANS  A  BUSINESS  OR  PERSON WHO
 PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR PRESENCE ON, THE INTERNET
 BY MEANS OF A SWITCHED  OR  DEDICATED  TELECOMMUNICATIONS  CHANNEL  UPON
 WHICH  THE  PROVIDER  PROVIDES TRANSIT ROUTING OF INTERNET PROTOCOL (IP)
 PACKETS FOR AND ON BEHALF OF THE  CONSUMER.  INTERNET  SERVICE  PROVIDER
 DOES  NOT INCLUDE THE OFFERING, ON A COMMON CARRIER BASIS, OF TELECOMMU-
 NICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE  FACILI-
 TIES.
   (C)  "ORDINARY  COURSE  OF BUSINESS" MEANS DEBT-COLLECTION ACTIVITIES,
 ORDER FULFILLMENT, REQUEST PROCESSING, OR THE TRANSFER OF OWNERSHIP.
   (D) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD10928-02-7

 A. 7191                             2
 
   (II) A CONSUMER AS HAVING REQUESTED OR OBTAINED SPECIFIC MATERIALS  OR
 SERVICES FROM AN INTERNET SERVICE PROVIDER;
   (III) INTERNET OR ONLINE SITES VISITED BY A CONSUMER; OR
   (IV) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2.  EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS SECTION,
 AN INTERNET SERVICE PROVIDER SHALL  NOT  KNOWINGLY  DISCLOSE  PERSONALLY
 IDENTIFIABLE  INFORMATION RESULTING FROM THE CUSTOMER'S USE OF THE TELE-
 COMMUNICATIONS OR INTERNET  SERVICE  PROVIDER  WITHOUT  EXPRESS  WRITTEN
 APPROVAL FROM THE CUSTOMER.
   (A) A TELECOMMUNICATIONS OR INTERNET SERVICE PROVIDER ("ISP") THAT HAS
 ENTERED  INTO  A  FRANCHISE  AGREEMENT, RIGHT-OF-WAY AGREEMENT, OR OTHER
 CONTRACT WITH THE STATE OF NEW YORK OR ANY POLITICAL SUBDIVISION  THERE-
 OF, OR THAT USES FACILITIES THAT ARE SUBJECT TO SUCH AGREEMENTS, EVEN IF
 IT  IS  NOT  A  PARTY  TO  THE AGREEMENT, SHALL NOT COLLECT NOR DISCLOSE
 PERSONAL INFORMATION FROM A CUSTOMER RESULTING FROM THE  CUSTOMER'S  USE
 OF  THE  TELECOMMUNICATIONS OR INTERNET SERVICE PROVIDER WITHOUT EXPRESS
 WRITTEN APPROVAL FROM THE CUSTOMER; AND
   (B) NO SUCH  TELECOMMUNICATION  OR  INTERNET  SERVICE  PROVIDER  SHALL
 REFUSE  TO  PROVIDE  ITS  SERVICES TO A CUSTOMER ON THE GROUNDS THAT THE
 CUSTOMER HAS NOT APPROVED THE COLLECTION OR DISCLOSURE OF THE CUSTOMER'S
 PERSONAL INFORMATION.
   3. AN INTERNET SERVICE PROVIDER SHALL DISCLOSE PERSONALLY IDENTIFIABLE
 INFORMATION CONCERNING A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA;
   (B) TO AN INVESTIGATIVE OR LAW ENFORCEMENT  OFFICER  WHILE  ACTING  AS
 AUTHORIZED BY LAW;
   (C)  PURSUANT TO A COURT ORDER IN A CIVIL PROCEEDING UPON A SHOWING OF
 COMPELLING NEED FOR THE INFORMATION THAT CANNOT BE ACCOMMODATED BY OTHER
 MEANS;
   (D) TO A COURT IN A CIVIL  ACTION  FOR  CONVERSION  COMMENCED  BY  THE
 INTERNET  SERVICE PROVIDER OR IN A CIVIL ACTION TO ENFORCE COLLECTION OF
 UNPAID SUBSCRIPTION FEES OR PURCHASE  AMOUNTS,  AND  THEN  ONLY  TO  THE
 EXTENT  NECESSARY  TO ESTABLISH THE FACT OF THE SUBSCRIPTION DELINQUENCY
 OR PURCHASE AGREEMENT, AND WITH APPROPRIATE SAFEGUARDS AGAINST UNAUTHOR-
 IZED DISCLOSURE;
   (E) TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON  WRIT-
 TEN  OR  ELECTRONIC  REQUEST AND UPON PAYMENT OF A FEE NOT TO EXCEED THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (F) PURSUANT TO SUBPOENA, INCLUDING AN ADMINISTRATIVE SUBPOENA, ISSUED
 UNDER AUTHORITY OF A LAW OF THIS STATE OR ANOTHER STATE  OR  THE  UNITED
 STATES; OR
   (G) PURSUANT TO A WARRANT OR COURT ORDER.
   4.  AN  INTERNET SERVICE PROVIDER MAY DISCLOSE PERSONALLY IDENTIFIABLE
 INFORMATION CONCERNING A CONSUMER TO:
   (A) ANY PERSON IF THE DISCLOSURE IS INCIDENT TO THE ORDINARY COURSE OF
 BUSINESS OF THE INTERNET SERVICE PROVIDER;
   (B) ANOTHER INTERNET SERVICE PROVIDER FOR  PURPOSES  OF  REPORTING  OR
 PREVENTING  VIOLATIONS  OF THE PUBLISH ACCEPTABLE USE POLICY OR CUSTOMER
 SERVICE AGREEMENT OF THE INTERNET  SERVICE  PROVIDER;  EXCEPT  THAT  THE
 RECIPIENT  MAY  FURTHER DISCLOSE THE PERSONALLY IDENTIFIABLE INFORMATION
 ONLY AS PROVIDED BY THIS CHAPTER;
   (C) ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER; OR
   (D) AS REQUIRED BY SUBDIVISION THREE OF THIS SECTION.
   5. (A) THE INTERNET  SERVICE  PROVIDER  SHALL  OBTAIN  THE  CONSUMER'S
 AUTHORIZATION  OF  THE DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION
 IN WRITING OR BY ELECTRONIC MEANS.

 A. 7191                             3
 
   (B) THE REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE  THE  TYPES
 OF  PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C)  IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT BETWEEN
 AN INTERNET SERVICE PROVIDER  AND  THE  CONSUMER  MUST  STATE  THAT  THE
 AUTHORIZATION WILL BE OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E)  AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH SELF-
 REGULATING GUIDELINES ISSUED BY REPRESENTATIVES OF THE INTERNET  SERVICE
 PROVIDER  OR  ONLINE  INDUSTRIES,  OR  IN  ANY  OTHER  MANNER REASONABLY
 DESIGNED TO COMPLY WITH THIS SECTION.
   6. THE INTERNET SERVICE PROVIDER SHALL TAKE REASONABLE STEPS TO  MAIN-
 TAIN  THE  SECURITY  AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE
 INFORMATION.
   7. EXCEPT FOR PURPOSES OF ESTABLISHING A VIOLATION  OF  THIS  CHAPTER,
 PERSONALLY IDENTIFIABLE INFORMATION OBTAINED IN ANY MANNER OTHER THAN AS
 PROVIDED  IN  THIS  CHAPTER SHALL NOT BE RECEIVED IN EVIDENCE IN A CIVIL
 ACTION.
   8. A CONSUMER WHO PREVAILS OR  SUBSTANTIALLY  PREVAILS  IN  AN  ACTION
 BROUGHT  UNDER  THIS  SECTION IS ENTITLED TO THE GREATER OF FIVE HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES MAY BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION  OF  THIS
 SECTION.  THE DAMAGES AVAILABLE UNDER THIS SECTION ARE EXEMPTED FROM ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 INTERNET SERVICE PROVIDER AND THE CONSUMER.  IN  AN  ACTION  UNDER  THIS
 SECTION,  IT  IS A DEFENSE THAT THE DEFENDANT HAS ESTABLISHED AND IMPLE-
 MENTED REASONABLE PRACTICES AND PROCEDURES TO PREVENT VIOLATIONS OF THIS
 SECTION.
   9. THIS SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF  THE  PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A)  NOTHING IN THIS CHAPTER LIMITS THE AUTHORITY UNDER OTHER STATE OR
 FEDERAL LAW OF LAW ENFORCEMENT  OR  PROSECUTING  AUTHORITIES  TO  OBTAIN
 INFORMATION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE  INFORMATION  BY  INTERNET  SERVICE  PROVIDERS BUT DOES NOT
 PREEMPT STATE LAW ON THE SUBJECT, STATE LAW PREVAILS.
   10. THIS SECTION SHALL APPLY TO  INTERNET  SERVICE  PROVIDERS  IN  THE
 PROVISION OF SERVICES TO CONSUMERS IN THIS STATE.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.

co-Sponsors

View additional co-sponsors

multi-Sponsors

2017-A7191A - Details

See Senate Version of this Bill:: S5603
Current Committee:: Senate Rules
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: A2420, S518
2021-2022: A674, S4830
2023-2024: A1484, S4367

2017-A7191A - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-A7191A - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  7191--A
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              April 12, 2017
                                ___________
 
 Introduced  by  M.  of  A.  WALLACE,  ZEBROWSKI,  ROZIC,  JOHNS,  STECK,
   PHEFFER AMATO, MORINELLO, McDONOUGH,  OTIS,  BRINDISI,  GALEF,  LOPEZ,
   SKOUFIS,  JAFFEE, BUCHWALD, DICKENS, SIMOTAS, ROSENTHAL, LIFTON, SIMA-
   NOWITZ, COLTON,  HYNDMAN,  GOTTFRIED,  SIMON,  RAIA,  PICHARDO,  RYAN,
   JONES,  D'URSO, LUPARDO, BRONSON, WRIGHT, STIRPE, SKARTADOS, CAHILL --
   Multi-Sponsored by -- M.  of A. COOK, CROUCH -- read once and referred
   to the Committee on  Consumer  Affairs  and  Protection  --  committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee
 
 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure  of  personally  identifiable  information  by  an internet
   service provider without the express written approval of the consumer
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   §  399-K.  DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION BY AN
 INTERNET SERVICE PROVIDER; PROHIBITED.  1.  FOR  THE  PURPOSES  OF  THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A)  "CONSUMER"  MEANS A PERSON WHO AGREES TO PAY A FEE TO AN INTERNET
 SERVICE PROVIDER FOR ACCESS TO THE INTERNET  FOR  PERSONAL,  FAMILY,  OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET SERVICE PROVIDER" (ISP) MEANS A BUSINESS ENTITY OR INDI-
 VIDUAL  WHO  PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR PRESENCE ON,
 THE INTERNET BY MEANS OF  A  SWITCHED  OR  DEDICATED  TELECOMMUNICATIONS
 CHANNEL  UPON  WHICH  THE  PROVIDER PROVIDES TRANSIT ROUTING OF INTERNET
 PROTOCOL PACKETS FOR AND ON BEHALF OF  THE  CONSUMER.  INTERNET  SERVICE
 PROVIDER  DOES  NOT  INCLUDE THE OFFERING, ON A COMMON CARRIER BASIS, OF
 TELECOMMUNICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE
 FACILITIES.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD10928-05-7

 A. 7191--A                          2
 
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II)  A  CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET USAGE HISTORY;
 OR
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2. EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS  SECTION,
 AN  ISP SHALL NOT KNOWINGLY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION
 RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR ISP WITH-
 OUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER.
   (A) A TELECOMMUNICATIONS OR ISP THAT  HAS  ENTERED  INTO  A  FRANCHISE
 AGREEMENT,  RIGHT-OF-WAY  AGREEMENT, OR OTHER CONTRACT WITH THE STATE OF
 NEW YORK OR ANY POLITICAL SUBDIVISION THEREOF, OR THAT  USES  FACILITIES
 THAT  ARE  SUBJECT  TO SUCH AGREEMENTS, EVEN IF IT IS NOT A PARTY TO THE
 AGREEMENT, SHALL NOT COLLECT NOR DISCLOSE PERSONAL  INFORMATION  FROM  A
 CONSUMER  RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR
 ISP WITHOUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER; AND
   (B) NO SUCH TELECOMMUNICATION OR  ISP  SHALL  REFUSE  TO  PROVIDE  ITS
 SERVICES TO A CONSUMER ON THE GROUNDS THAT THE CONSUMER HAS NOT APPROVED
 THE COLLECTION OR DISCLOSURE OF THE CONSUMER'S PERSONAL INFORMATION.
   3.  AN ISP MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION CONCERNING
 A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA;
   (B) TO AN INVESTIGATIVE OR LAW ENFORCEMENT  OFFICER  WHILE  ACTING  AS
 AUTHORIZED BY LAW;
   (C)  PURSUANT TO A COURT ORDER IN A CIVIL PROCEEDING UPON A SHOWING OF
 COMPELLING NEED FOR THE INFORMATION THAT CANNOT BE ACCOMMODATED BY OTHER
 MEANS;
   (D) TO A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY  THE  ISP
 OR  IN  A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID SUBSCRIPTION FEES
 OR PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO  ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST UNAUTHORIZED DISCLOSURE;
   (E)  TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON WRIT-
 TEN OR ELECTRONIC REQUEST AND UPON PAYMENT OF A FEE NOT  TO  EXCEED  THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (F) PURSUANT TO SUBPOENA, INCLUDING AN ADMINISTRATIVE SUBPOENA, ISSUED
 UNDER  AUTHORITY  OF  A LAW OF THIS STATE OR ANOTHER STATE OR THE UNITED
 STATES;
   (G) ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING VIOLATIONS  OF
 THE  PUBLISH  ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT OF THE
 ISP; EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE THE PERSONALLY IDEN-
 TIFIABLE INFORMATION ONLY AS PROVIDED BY THIS CHAPTER;
   (H) ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER; OR
   (I) AS REQUIRED BY THIS SUBDIVISION.
   4. (A) THE ISP  SHALL  OBTAIN  THE  CONSUMER'S  AUTHORIZATION  OF  THE
 DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION IN WRITING OR BY ELEC-
 TRONIC MEANS.
   (B)  THE  REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE THE TYPES
 OF PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE  DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C)  IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT BETWEEN
 AN ISP AND THE CONSUMER  MUST  STATE  THAT  THE  AUTHORIZATION  WILL  BE
 OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.

 A. 7191--A                          3
 
   (E) AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH GUIDE-
 LINES  ISSUED  BY REPRESENTATIVES OF THE ISP OR ONLINE INDUSTRIES, OR IN
 ANY OTHER MANNER REASONABLY DESIGNED TO COMPLY WITH THIS SECTION.
   5.  THE  ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS TO MAINTAIN
 THE SECURITY AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE  INFOR-
 MATION.
   6.  A  CONSUMER  WHO  PREVAILS  OR SUBSTANTIALLY PREVAILS IN AN ACTION
 BROUGHT UNDER THIS SECTION IS ENTITLED TO THE GREATER  OF  FIVE  HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES  MAY  BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION OF THIS
 SECTION. THE DAMAGES AVAILABLE UNDER THIS SECTION ARE EXEMPTED FROM  ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP  AND  THE CONSUMER. IN AN ACTION UNDER THIS SECTION, IT IS A DEFENSE
 THAT THE DEFENDANT HAS ESTABLISHED AND IMPLEMENTED REASONABLE  PRACTICES
 AND PROCEDURES TO PREVENT VIOLATIONS OF THIS SECTION.
   7.  THIS  SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF THE PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A) NOTHING IN THIS SECTION SHALL BE DEEMED  TO  LIMIT  THE  AUTHORITY
 UNDER  OTHER  STATE OR FEDERAL LAW OF LAW ENFORCEMENT TO OBTAIN INFORMA-
 TION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE INFORMATION BY ISPS BUT DOES NOT PREEMPT STATE LAW  ON  THE
 SUBJECT, STATE LAW PREVAILS.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.

co-Sponsors

View additional co-sponsors

multi-Sponsors

2017-A7191B (ACTIVE) - Details

See Senate Version of this Bill:: S5603
Current Committee:: Senate Rules
Law Section:: General Business Law
Laws Affected:: Add §399-k, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2019-2020: A2420, S518
2021-2022: A674, S4830
2023-2024: A1484, S4367

2017-A7191B (ACTIVE) - Summary

Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

2017-A7191B (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  7191--B
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              April 12, 2017
                                ___________
 
 Introduced  by  M.  of  A.  WALLACE,  ZEBROWSKI,  ROZIC,  JOHNS,  STECK,
   PHEFFER AMATO, MORINELLO, McDONOUGH,  OTIS,  BRINDISI,  GALEF,  LOPEZ,
   SKOUFIS,  JAFFEE, BUCHWALD, DICKENS, SIMOTAS, ROSENTHAL, LIFTON, SIMA-
   NOWITZ, COLTON,  HYNDMAN,  GOTTFRIED,  SIMON,  RAIA,  PICHARDO,  RYAN,
   JONES,  D'URSO,  LUPARDO,  BRONSON, WRIGHT, STIRPE, SKARTADOS, CAHILL,
   SOLAGES -- Multi-Sponsored by -- M. of A. COOK, CROUCH  --  read  once
   and  referred  to  the Committee on Consumer Affairs and Protection --
   committee discharged, bill amended, ordered reprinted as  amended  and
   recommitted  to said committee -- reported and referred to the Commit-
   tee on Codes -- committee discharged, bill amended, ordered  reprinted
   as amended and recommitted to said committee
 
 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure  of  personally  identifiable  information  by  an internet
   service provider without the express written approval of the consumer
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   §  399-K.  DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION BY AN
 INTERNET SERVICE PROVIDER; PROHIBITED.  1.  FOR  THE  PURPOSES  OF  THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A)  "CONSUMER"  MEANS A PERSON WHO AGREES TO PAY A FEE TO AN INTERNET
 SERVICE PROVIDER FOR ACCESS TO THE INTERNET  FOR  PERSONAL,  FAMILY,  OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET SERVICE PROVIDER" (ISP) MEANS A BUSINESS ENTITY OR INDI-
 VIDUAL  WHO  PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR PRESENCE ON,
 THE INTERNET BY MEANS OF  A  SWITCHED  OR  DEDICATED  TELECOMMUNICATIONS
 CHANNEL  UPON  WHICH  THE  PROVIDER PROVIDES TRANSIT ROUTING OF INTERNET
 PROTOCOL PACKETS FOR AND ON BEHALF OF  THE  CONSUMER.  INTERNET  SERVICE
 PROVIDER  DOES  NOT  INCLUDE THE OFFERING, ON A COMMON CARRIER BASIS, OF
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD10928-07-7

 A. 7191--B                          2
 
 TELECOMMUNICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE
 FACILITIES.
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II)  A  CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET USAGE HISTORY;
 OR
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2. EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS  SECTION,
 AN  ISP SHALL NOT KNOWINGLY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION
 RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR ISP WITH-
 OUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER.
   (A) A TELECOMMUNICATIONS OR ISP THAT  HAS  ENTERED  INTO  A  FRANCHISE
 AGREEMENT,  RIGHT-OF-WAY  AGREEMENT, OR OTHER CONTRACT WITH THE STATE OF
 NEW YORK OR ANY POLITICAL SUBDIVISION THEREOF, OR THAT  USES  FACILITIES
 THAT  ARE  SUBJECT  TO SUCH AGREEMENTS, EVEN IF IT IS NOT A PARTY TO THE
 AGREEMENT, SHALL NOT COLLECT NOR DISCLOSE PERSONAL  INFORMATION  FROM  A
 CONSUMER  RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR
 ISP WITHOUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER; AND
   (B) NO SUCH TELECOMMUNICATION OR  ISP  SHALL  REFUSE  TO  PROVIDE  ITS
 SERVICES TO A CONSUMER ON THE GROUNDS THAT THE CONSUMER HAS NOT APPROVED
 THE COLLECTION OR DISCLOSURE OF THE CONSUMER'S PERSONAL INFORMATION.
   3.  AN ISP MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION CONCERNING
 A CONSUMER:
   (A) PURSUANT TO A GRAND JURY SUBPOENA, IN ACCORDANCE WITH  SUBDIVISION
 EIGHT OF SECTION 190.30 OF THE CRIMINAL PROCEDURE LAW;
   (B)  PURSUANT  TO  A  WARRANT  ISSUED  IN  ACCORDANCE WITH ARTICLE SIX
 HUNDRED NINETY OR ARTICLE SEVEN HUNDRED OF THE CRIMINAL PROCEDURE LAW;
   (C) PURSUANT TO A COURT ORDER IN A PENDING CRIMINAL PROCEEDING UPON  A
 SHOWING  THAT  SUCH  PERSONALLY IDENTIFIABLE INFORMATION IS RELEVANT AND
 MATERIAL TO SUCH CRIMINAL ACTION OR PROCEEDING;
   (D) PURSUANT TO A COURT ORDER IN A PENDING  CIVIL  PROCEEDING  UPON  A
 SHOWING  OF COMPELLING NEED FOR SUCH INFORMATION THAT CANNOT BE ACCOMMO-
 DATED BY OTHER MEANS;
   (E) TO A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY  THE  ISP
 OR  IN  A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID SUBSCRIPTION FEES
 OR PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO  ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST UNAUTHORIZED DISCLOSURE;
   (F)  TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON WRIT-
 TEN OR ELECTRONIC REQUEST AND UPON PAYMENT OF ANY FEE NOT TO EXCEED  THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (G)  TO ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING VIOLATIONS
 OF THE PUBLISHED ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT  OF
 THE  ISP;  EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE THE PERSONALLY
 IDENTIFIABLE INFORMATION ONLY AS PROVIDED BY THIS CHAPTER; OR
   (H) TO ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER.
   4. (A) THE ISP SHALL  OBTAIN  THE  CONSUMER'S  AUTHORIZATION  FOR  THE
 DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION IN WRITING OR BY ELEC-
 TRONIC MEANS.
   (B)  THE  REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE THE TYPES
 OF PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE  DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C)  IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT BETWEEN
 AN ISP AND THE CONSUMER  MUST  STATE  THAT  THE  AUTHORIZATION  WILL  BE
 OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.

 A. 7191--B                          3
 
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E) AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH GUIDE-
 LINES  ISSUED  BY REPRESENTATIVES OF THE ISP OR ONLINE INDUSTRIES, OR IN
 ANY OTHER MANNER REASONABLY DESIGNED TO COMPLY WITH THIS SECTION.
   5. THE ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS  TO  MAINTAIN
 THE  SECURITY AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE INFOR-
 MATION.
   6. A CONSUMER WHO PREVAILS OR  SUBSTANTIALLY  PREVAILS  IN  AN  ACTION
 BROUGHT  UNDER  THIS  SECTION IS ENTITLED TO THE GREATER OF FIVE HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 FEES MAY BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION  OF  THIS
 SECTION.  THE  ACTION  AVAILABLE UNDER THIS SECTION IS EXEMPTED FROM ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP AND THE CONSUMER. IN A CIVIL ACTION UNDER THIS  SECTION,  IT  IS  AN
 AFFIRMATIVE  DEFENSE  THAT  SUCH  INFORMATION  WAS RELEASED OR OTHERWISE
 AVAILABLE IN VIOLATION OF THIS SECTION NOTWITHSTANDING REASONABLE  PRAC-
 TICES ESTABLISHED AND IMPLEMENTED BY THE DEFENDANT TO PREVENT VIOLATIONS
 OF THIS SECTION.
   7.  THIS  SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF THE PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A) NOTHING IN THIS SECTION SHALL BE DEEMED  TO  LIMIT  THE  AUTHORITY
 UNDER  OTHER  STATE OR FEDERAL LAW OF LAW ENFORCEMENT TO OBTAIN INFORMA-
 TION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE INFORMATION BY ISPS BUT DOES NOT PREEMPT STATE LAW  ON  THE
 SUBJECT, STATE LAW PREVAILS.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Assembly Bill A7191B

Share this bill

Sponsored By

WALLACE

Archive: Last Bill Status - In Senate Committee Rules Committee

Bill Amendments

co-Sponsors

Kenneth Zebrowski

Nily Rozic

Mark C. Johns

Phil Steck

multi-Sponsors

Vivian Cook

Clifford Crouch

2017-A7191 - Details

2017-A7191 - Summary

2017-A7191 - Bill Text download pdf

co-Sponsors

Kenneth Zebrowski

Nily Rozic

Mark C. Johns

Phil Steck

multi-Sponsors

Vivian Cook

Clifford Crouch

2017-A7191A - Details

2017-A7191A - Summary

2017-A7191A - Bill Text download pdf

co-Sponsors

Kenneth Zebrowski

Nily Rozic

Mark C. Johns

Phil Steck

multi-Sponsors

Vivian Cook

Clifford Crouch

2017-A7191B (ACTIVE) - Details

2017-A7191B (ACTIVE) - Summary

2017-A7191B (ACTIVE) - Bill Text download pdf

Comments