S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7236
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              April 12, 2017
                                ___________
 
 Introduced  by  M. of A. ZEBROWSKI, SKOUFIS, BUCHWALD, JAFFEE, MONTESANO
   -- Multi-Sponsored by -- M. of A.  CROUCH,  SIMON  --  read  once  and
   referred to the Committee on Consumer Affairs and Protection
 
 AN  ACT  to  amend  the  general  business law, in relation to requiring
   internet service providers to provide customers with a copy  of  their
   privacy  policy  and  to obtain written and explicit permission from a
   customer prior to sharing, using, selling  or  providing  to  a  third
   party any sensitive information of such customer
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 390-bb to read as follows:
   § 390-BB. INTERNET SERVICE PROVIDERS; CUSTOMER DATA  PRIVACY.  1.  FOR
 THE  PURPOSES OF THIS SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOW-
 ING MEANINGS:
   (A) "INTERNET SERVICE PROVIDER" MEANS ANY PERSON, BUSINESS, OR  ORGAN-
 IZATION  WHO IS QUALIFIED TO CONDUCT BUSINESS IN THE STATE THAT PROVIDES
 INDIVIDUALS, CORPORATIONS, OR OTHER ENTITIES WITH ACCESS TO THE INTERNET
 AS PART OF A SERVICE.
   (B) "CUSTOMER" MEANS ANY PERSON, CORPORATION OR ENTITY  WHICH  PAYS  A
 FEE  TO  AN INTERNET SERVICE PROVIDER FOR ACCESS TO THE INTERNET AS PART
 OF A SERVICE.
   (C) "SENSITIVE INFORMATION" MEANS ANY INFORMATION THAT WHICH CAN IDEN-
 TIFY THE CUSTOMER OR ANY OTHER INFORMATION THAT IS SPECIFICALLY  ATTRIB-
 UTABLE  TO  SUCH  CUSTOMER  INCLUDING,  BUT NOT LIMITED TO, FINANCIAL OR
 MEDICAL DATA, BIOGRAPHICAL INFORMATION, COMMUNICATION CONTENT,  BROWSING
 OR WEB HISTORY, OR INTERNET USAGE.
   (D)  "NON-SENSITIVE  INFORMATION" MEANS INFORMATION COLLECTED ON USERS
 THAT IS NOT SPECIFIC TO AN INDIVIDUAL CUSTOMER INCLUDING, BUT NOT LIMIT-
 ED TO, AGGREGATED USE, SUBSCRIPTION DATA OR OTHER MACRO  LEVEL  INFORMA-
 TION.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD10887-01-7

 A. 7236                             2
 
   2. EACH INTERNET SERVICE PROVIDER SHALL PROVIDE CUSTOMERS WITH A COPY,
 EITHER  IN  WRITING  OR IN ELECTRONIC FORM, OF THEIR PRIVACY POLICY THAT
 SHALL INCLUDE  ITS  DATA  COLLECTION  AND  USE  PRACTICES,  THIRD  PARTY
 RELATIONSHIPS,  PURPOSE OF THE DATA COLLECTION AND PROCESS FOR CUSTOMERS
 TO  EXERCISE CONTROL OVER THEIR INFORMATION AS PROVIDED IN THIS SECTION.
 THE PRIVACY POLICY SHALL BE PROVIDED TO CUSTOMERS UPON ENTERING  INTO  A
 CONTRACT  WITH  THE  INTERNET SERVICE PROVIDER AND SUBSEQUENTLY UPON ANY
 SIGNIFICANT CHANGES MADE TO SUCH POLICY.
   3. AN INTERNET SERVICE PROVIDER  SHALL  OBTAIN  WRITTEN  AND  EXPLICIT
 PERMISSION FROM A CUSTOMER PRIOR TO SHARING, USING, SELLING OR PROVIDING
 TO  A THIRD PARTY ANY SENSITIVE INFORMATION OF SUCH CUSTOMER. THE INTER-
 NET SERVICE PROVIDER SHALL PROVIDE TO THE CUSTOMER A CLEAR AND CONSPICU-
 OUS DESCRIPTION OF THE INTENDED USE OF THEIR INFORMATION, INCLUDING, BUT
 NOT LIMITED TO, TYPE OF INFORMATION THAT MAY BE  DISCLOSED,  PURPOSE  OF
 SUCH  DISCLOSURE,  AND ALL THIRD PARTY ENTITIES THAT MAY BE RECEIVING OR
 USING THE INFORMATION.
   4. A CUSTOMER SHALL HAVE THE OPTION TO REMOVE THEIR  CONSENT  FOR  THE
 USE  OR  DISCLOSURE  OF  NON-SENSITIVE INFORMATION. THE INTERNET SERVICE
 PROVIDER SHALL DEVELOP A PROCESS FOR A CUSTOMER TO EASILY  REMOVE  THEIR
 CONSENT  FOR THE USE OF ANY NON-SENSITIVE INFORMATION. THE PROCESS SHALL
 INCLUDE A DETAILED DESCRIPTION OF THE INTENDED USE OF THEIR INFORMATION,
 INCLUDING,  BUT  NOT  LIMITED  TO,  TYPE  OF  INFORMATION  THAT  MAY  BE
 DISCLOSED, PURPOSE OF SUCH DISCLOSURE, AND ALL THIRD PARTY ENTITIES THAT
 MAY BE RECEIVING OR USING THE INFORMATION.
   5.  AN  INTERNET  SERVICE  PROVIDER  SHALL  NOT, AS A CONDITION OF THE
 SERVICE, REQUIRE CONSENT FROM A CUSTOMER FOR USE OF THEIR  SENSITIVE  OR
 NON-SENSITIVE INFORMATION.
   6.  AN  INTERNET  SERVICE  PROVIDER MAY USE SENSITIVE OR NON-SENSITIVE
 INFORMATION WITHOUT CONSENT FROM THE CUSTOMER  IF  SUCH  INFORMATION  IS
 NECESSARY  IN  PROVIDING THE SERVICE TO THE CUSTOMER, INCLUDING, BUT NOT
 LIMITED TO, BILLING, INSTALLATION, AND SUPPORT.
   7. WHENEVER THERE SHALL BE A VIOLATION OF THIS SECTION, AN APPLICATION
 MAY BE MADE BY THE ATTORNEY GENERAL IN THE NAME OF  THE  PEOPLE  OF  THE
 STATE OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION BY A SPECIAL
 PROCEEDING  TO  ISSUE AN INJUNCTION, AND UPON NOTICE TO THE DEFENDANT OF
 NOT LESS THAN FIVE DAYS, TO ENJOIN AND RESTRAIN THE CONTINUANCE OF  SUCH
 VIOLATION;  AND  IF  IT SHALL APPEAR TO THE SATISFACTION OF THE COURT OR
 JUSTICE THAT THE DEFENDANT HAS,  IN  FACT,  VIOLATED  THIS  SECTION,  AN
 INJUNCTION  MAY  BE  ISSUED  BY  SUCH  COURT  OR  JUSTICE, ENJOINING AND
 RESTRAINING ANY FURTHER VIOLATION,  WITHOUT  REQUIRING  PROOF  THAT  ANY
 PERSON  HAS,  IN  FACT,  BEEN  INJURED  OR  DAMAGED THEREBY. IN ANY SUCH
 PROCEEDING, THE COURT MAY MAKE ALLOWANCES TO  THE  ATTORNEY  GENERAL  AS
 PROVIDED  IN  PARAGRAPH  SIX  OF SUBDIVISION (A) OF SECTION EIGHTY-THREE
 HUNDRED THREE OF THE CIVIL PRACTICE LAW AND RULES, AND  DIRECT  RESTITU-
 TION.  WHENEVER  THE  COURT  SHALL  DETERMINE  THAT  A VIOLATION OF THIS
 SECTION  HAS OCCURRED, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT  MORE
 THAN FIVE HUNDRED DOLLARS FOR A SINGLE VIOLATION AND NOT MORE THAN FIFTY
 THOUSAND  DOLLARS FOR MULTIPLE VIOLATIONS RESULTING FROM A SINGLE ACT OR
 INCIDENT. IN CONNECTION WITH ANY SUCH PROPOSED APPLICATION, THE ATTORNEY
 GENERAL IS AUTHORIZED TO TAKE PROOF AND  MAKE  A  DETERMINATION  OF  THE
 RELEVANT FACTS AND ISSUE SUBPOENAS IN ACCORDANCE WITH THE CIVIL PRACTICE
 LAW AND RULES.
   §  2.  This  act  shall take effect on the sixtieth day after it shall
 have become a law.