S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6351
 
                        2019-2020 Regular Sessions
 
                           I N  A S S E M B L Y
 
                               March 6, 2019
                                ___________
 
 Introduced  by M. of A. GUNTHER -- read once and referred to the Commit-
   tee on Consumer Affairs and Protection
 
 AN ACT to amend the general business law and the state finance  law,  in
   relation  to  allowing  consumers the right to request from businesses
   the categories of  personal  information  the  business  has  sold  or
   disclosed to third parties
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The article heading of article 39-F of the general business
 law, as added by chapter 442 of the laws of 2005, is amended to read  as
 follows:
 
          [NOTIFICATION OF UNAUTHORIZED] ACQUISITION AND CONTROL
                    OF PRIVATE AND PERSONAL INFORMATION
 
   §  2. The general business law is amended by adding a new section 899-
 bb to read as follows:
   § 899-BB. CONSUMER CONTROL OF PERSONAL INFORMATION. 1. FOR PURPOSES OF
 THIS SECTION, THE FOLLOWING DEFINITIONS SHALL APPLY:
   (A) "BIOMETRIC DATA" MEANS AN INDIVIDUAL'S  PHYSIOLOGICAL,  BIOLOGICAL
 OR  BEHAVIORAL  CHARACTERISTICS,  INCLUDING AN INDIVIDUAL'S DEOXYRIBONU-
 CLEIC ACID THAT CAN BE USED, SINGLY OR IN COMBINATION WITH EACH OTHER OR
 WITH OTHER IDENTIFYING DATA TO ESTABLISH INDIVIDUAL IDENTITY.  BIOMETRIC
 DATA INCLUDES BUT IS NOT LIMITED TO IMAGERY OF THE IRIS, RETINA, FINGER-
 PRINT, FACE, HAND, PALM, VEIN PATTERNS, AND VOICE RECORDINGS, FROM WHICH
 AN  IDENTIFIER  TEMPLATE, SUCH AS A FACEPRINT, A MINUTIAE TEMPLATE, OR A
 VOICEPRINT, CAN BE EXTRACTED, AND KEYSTROKE PATTERNS  OR  RHYTHMS,  GAIT
 PATTERNS  OR  RHYTHMS,  AND SLEEP, HEALTH, OR EXERCISE DATA THAT CONTAIN
 IDENTIFYING INFORMATION.
   (B) "BUSINESS" MEANS:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD06756-01-9
              

 A. 6351                             2
 
   (1) A  SOLE-PROPRIETORSHIP,  PARTNERSHIP,  LIMITED-LIABILITY  COMPANY,
 CORPORATION,  ASSOCIATION,  OR  OTHER  LEGAL ENTITY THAT IS ORGANIZED OR
 OPERATED FOR THE PROFIT OR FINANCIAL  BENEFIT  OF  ITS  SHAREHOLDERS  OR
 OTHER  OWNERS,  THAT COLLECTS CONSUMERS' PERSONAL INFORMATION, THAT DOES
 BUSINESS  IN  THE STATE, AND THAT SATISFIES ONE OR MORE OF THE FOLLOWING
 THRESHOLDS: (A) HAS ANNUAL GROSS REVENUES IN  EXCESS  OF  FIFTY  MILLION
 DOLLARS,  AS  ADJUSTED PURSUANT TO SUBPARAGRAPH FIVE OF PARAGRAPH (A) OF
 SUBDIVISION FIFTEEN OF THIS SECTION; OR (B) ANNUALLY SELLS, ALONE OR  IN
 COMBINATION,  THE  PERSONAL  INFORMATION OF ONE HUNDRED THOUSAND OR MORE
 CONSUMERS OR DEVICES; OR (C) DERIVES FIFTY PERCENT OR MORE OF ITS ANNUAL
 REVENUES FROM SELLING CONSUMERS' PERSONAL INFORMATION; AND
   (2) ANY ENTITY THAT CONTROLS  OR  IS  CONTROLLED  BY  A  BUSINESS,  AS
 DEFINED  IN  PARAGRAPH  ONE  OF THIS SUBDIVISION, AND THAT SHARES COMMON
 BRANDING WITH THE BUSINESS.  "CONTROL" OR "CONTROLLED"  MEANS  OWNERSHIP
 OF,  OR  THE  POWER  TO VOTE, MORE THAN FIFTY PERCENT OF THE OUTSTANDING
 SHARES OF ANY CLASS OF VOTING SECURITY OF A  BUSINESS;  CONTROL  IN  ANY
 MANNER  OVER THE ELECTION OF A MAJORITY OF THE DIRECTORS, OR OF INDIVID-
 UALS EXERCISING SIMILAR FUNCTIONS; OR THE POWER TO EXERCISE, DIRECTLY OR
 INDIRECTLY, A CONTROLLING INFLUENCE OVER THE MANAGEMENT OR POLICIES OF A
 COMPANY.  "COMMON BRANDING" MEANS A SHARED NAME, SERVICEMARK, OR  TRADE-
 MARK.
   (C)  "BUSINESS  PURPOSE" MEANS THE USE OF PERSONAL INFORMATION FOR THE
 BUSINESS'S OPERATIONAL PURPOSES,  PROVIDED  THAT  THE  USE  OF  PERSONAL
 INFORMATION  SHALL  BE REASONABLY NECESSARY AND PROPORTIONATE TO ACHIEVE
 THE OPERATIONAL PURPOSE FOR WHICH IT IS SPECIFICALLY  PERMITTED.  UNREA-
 SONABLE  OR  DISPROPORTIONATE  USE  SHALL  NOT BE CONSIDERED A "BUSINESS
 PURPOSE".  BUSINESS PURPOSES ARE:
   (1) AUDITING RELATED TO A CURRENT INTERACTION WITH  THE  CONSUMER  AND
 CONCURRENT  TRANSACTIONS,  INCLUDING  BUT  NOT  LIMITED  TO, COUNTING AD
 IMPRESSIONS TO UNIQUE VISITORS, VERIFYING POSITIONING AND QUALITY OF  AD
 IMPRESSIONS  AND  AUDITING  COMPLIANCE WITH THIS SPECIFICATION AND OTHER
 STANDARDS;
   (2) DETECTING SECURITY INCIDENTS, PROTECTING AGAINST MALICIOUS, DECEP-
 TIVE, FRAUDULENT, OR ILLEGAL ACTIVITY, AND PROSECUTING THOSE RESPONSIBLE
 FOR SUCH ACTIVITY;
   (3) DEBUGGING TO IDENTIFY  AND  REPAIR  ERRORS  THAT  IMPAIR  EXISTING
 INTENDED FUNCTIONALITY;
   (4)  SHORT-TERM,  TRANSIENT  USE, PROVIDED THE PERSONAL INFORMATION IS
 NOT DISCLOSED TO ANOTHER PERSON AND IS NOT USED TO BUILD A PROFILE ABOUT
 A CONSUMER  OR  OTHERWISE  ALTER  AN  INDIVIDUAL  CONSUMER'S  EXPERIENCE
 OUTSIDE  THE  CURRENT  INTERACTION,  INCLUDING  BUT  NOT LIMITED TO, THE
 CONTEXTUAL CUSTOMIZATION OF ADS SHOWN AS PART OF THE  SAME  INTERACTION;
 AND
   (5) PERFORMING SERVICES ON BEHALF OF THE BUSINESS, INCLUDING MAINTAIN-
 ING  OR  SERVICING  ACCOUNTS,  PROVIDING CUSTOMER SERVICE, PROCESSING OR
 FULFILLING ORDERS  AND  TRANSACTIONS,  VERIFYING  CUSTOMER  INFORMATION,
 PROCESSING  PAYMENTS,  PROVIDING  FINANCING,  PROVIDING  ADVERTISING  OR
 MARKETING SERVICES, PROVIDING ANALYTICAL SERVICES, OR PROVIDING  SIMILAR
 SERVICES ON BEHALF OF THE BUSINESS.
   (D)  "CLEAR  AND CONSPICUOUS" MEANS (1) IN A COLOR THAT CONTRASTS WITH
 THE BACKGROUND COLOR OR IS OTHERWISE  DISTINGUISHABLE;  (2)  WRITTEN  IN
 LARGER TYPE THAN THE SURROUNDING TEXT AND IN A FASHION THAT CALLS ATTEN-
 TION TO THE LANGUAGE; AND (3) PROMINENTLY DISPLAYED SO THAT A REASONABLE
 VIEWER WOULD BE ABLE TO NOTICE, READ, AND UNDERSTAND IT.
   (E)  "COMMERCIAL  PURPOSES"  MEANS TO ADVANCE A PERSON'S COMMERCIAL OR
 ECONOMIC INTERESTS, SUCH AS BY INDUCING ANOTHER  PERSON  TO  BUY,  RENT,

 A. 6351                             3
 
 LEASE, JOIN, SUBSCRIBE TO, PROVIDE, OR EXCHANGE PRODUCTS, GOODS, PROPER-
 TY,  INFORMATION,  OR  SERVICES,  OR  ENABLING OR EFFECTING, DIRECTLY OR
 INDIRECTLY, A COMMERCIAL TRANSACTION.  "COMMERCIAL  PURPOSES"  DOES  NOT
 INCLUDE  FOR  THE  PURPOSE  OF  ENGAGING IN SPEECH THAT STATE OR FEDERAL
 COURTS HAVE RECOGNIZED AS  NON-COMMERCIAL  SPEECH,  INCLUDING  POLITICAL
 SPEECH AND JOURNALISM.
   (F)  "COLLECTS",  "COLLECTED"  OR  "COLLECTION" MEANS BUYING, RENTING,
 GATHERING, OBTAINING, STORING, USING, MONITORING, ACCESSING,  OR  MAKING
 INFERENCES BASED UPON, ANY PERSONAL INFORMATION PERTAINING TO A CONSUMER
 BY ANY MEANS.
   (G) "CONSUMER" MEANS A NATURAL PERSON WHO IS A RESIDENT OF THE STATE.
   (H) "DE-IDENTIFIED" MEANS INFORMATION THAT CANNOT REASONABLY IDENTIFY,
 RELATE  TO, DESCRIBE, REFERENCE, BE CAPABLE OF BEING ASSOCIATED WITH, OR
 BE LINKED, DIRECTLY OR INDIRECTLY, TO A PARTICULAR CONSUMER  OR  DEVICE,
 PROVIDED  THAT  A  BUSINESS THAT USES DE-IDENTIFIED INFORMATION: (1) HAS
 IMPLEMENTED TECHNICAL SAFEGUARDS THAT PROHIBIT RE-IDENTIFICATION OF  THE
 CONSUMER  OR  CONSUMERS  TO  WHOM  THE  INFORMATION MAY PERTAIN; (2) HAS
 IMPLEMENTED BUSINESS PROCESSES THAT SPECIFICALLY PROHIBIT RE-IDENTIFICA-
 TION OF THE INFORMATION;  (3)  HAS  IMPLEMENTED  BUSINESS  PROCESSES  TO
 PREVENT  INADVERTENT RELEASE OF DE-IDENTIFIED INFORMATION; AND (4) MAKES
 NO ATTEMPT TO RE-IDENTIFY THE INFORMATION.
   (I) "DESIGNATED METHODS  FOR  SUBMITTING  REQUESTS"  MEANS  A  MAILING
 ADDRESS,  E-MAIL  ADDRESS,  WEB  PAGE,  WEB  PORTAL, TOLL-FREE TELEPHONE
 NUMBER, OR OTHER APPLICABLE CONTACT INFORMATION, WHEREBY  CONSUMERS  MAY
 SUBMIT  A  REQUEST OR DIRECTION UNDER THIS ACT. IF THE CONSUMER DOES NOT
 MAINTAIN AN ACCOUNT WITH THE BUSINESS, THE  BUSINESS  SHALL  PROVIDE  AN
 OPPORTUNITY FOR THE CONSUMER TO DESIGNATE WHETHER THE CONSUMER WISHES TO
 RECEIVE  THE  INFORMATION  REQUIRED TO BE DISCLOSED PURSUANT TO SUBDIVI-
 SIONS TWO AND THREE OF THIS SECTION BY MAIL OR  ELECTRONICALLY,  AT  THE
 CONSUMER'S OPTION.
   (J)  "HOMEPAGE"  MEANS  THE  INTRODUCTORY  PAGE  OF  A WEBSITE AND ANY
 WEBPAGE WHERE PERSONAL INFORMATION IS  COLLECTED.  IN  THE  CASE  OF  AN
 ONLINE  SERVICE, SUCH AS A MOBILE APPLICATION, HOMEPAGE MEANS THE APPLI-
 CATION'S PLATFORM PAGE, A LINK WITHIN THE APPLICATION, SUCH AS FROM  THE
 APPLICATION CONFIGURATION, "ABOUT", "INFORMATION", OR SETTINGS PAGE, AND
 ANY  OTHER  LOCATION THAT ALLOWS CONSUMERS TO REVIEW THE NOTICE REQUIRED
 BY PARAGRAPH (A) OF SUBDIVISION SEVEN OF THIS SECTION, INCLUDING BUT NOT
 LIMITED TO, BEFORE DOWNLOADING THE APPLICATION.
   (K) "INFER" OR "INFERENCE" MEANS THE DERIVATION OF INFORMATION,  DATA,
 ASSUMPTIONS,  OR  CONCLUSIONS FROM FACTS, EVIDENCE, OR ANOTHER SOURCE OF
 INFORMATION OR DATA.
   (L) "PERSON" MEANS AN INDIVIDUAL, PROPRIETORSHIP,  FIRM,  PARTNERSHIP,
 JOINT  VENTURE, SYNDICATE, BUSINESS TRUST, COMPANY, CORPORATION, LIMITED
 LIABILITY COMPANY, ASSOCIATION, COMMITTEE, AND ANY OTHER ORGANIZATION OR
 GROUP OF PERSONS ACTING IN CONCERT.
   (M)  (1)"PERSONAL  INFORMATION"  MEANS  INFORMATION  THAT  IDENTIFIES,
 RELATES  TO, DESCRIBES, REFERENCES, IS CAPABLE OF BEING ASSOCIATED WITH,
 OR COULD REASONABLY BE LINKED, DIRECTLY OR INDIRECTLY, WITH A PARTICULAR
 CONSUMER OR DEVICE, INCLUDING, BUT NOT LIMITED TO:
   (A) ANY INFORMATION THAT IDENTIFIES,  RELATES  TO,  DESCRIBES,  OR  IS
 CAPABLE  OF  BEING  ASSOCIATED WITH, A PARTICULAR INDIVIDUAL, INCLUDING,
 BUT NOT LIMITED TO, HIS OR HER NAME, ALIAS, SIGNATURE,  SOCIAL  SECURITY
 NUMBER,  PHYSICAL  CHARACTERISTICS  OR  DESCRIPTION, ADDRESS, ELECTRONIC
 MAIL ADDRESS, INTERNET  PROTOCOL  ADDRESS,  UNIQUE  IDENTIFIER,  ACCOUNT
 NAME, TELEPHONE NUMBER, PASSPORT NUMBER, DRIVER'S LICENSE OR STATE IDEN-
 TIFICATION  CARD NUMBER, INSURANCE POLICY NUMBER, EDUCATION, EMPLOYMENT,

 A. 6351                             4
 
 EMPLOYMENT HISTORY, BANK ACCOUNT NUMBER, CREDIT CARD NUMBER, DEBIT  CARD
 NUMBER,  OR  ANY  OTHER  FINANCIAL  INFORMATION, MEDICAL INFORMATION, OR
 HEALTH INSURANCE INFORMATION;
   (B) CHARACTERISTICS OF PROTECTED CLASSIFICATIONS UNDER STATE OR FEDER-
 AL LAW;
   (C) COMMERCIAL INFORMATION, INCLUDING RECORDS OF PROPERTY, PRODUCTS OR
 SERVICES  PROVIDED,  OBTAINED,  OR  CONSIDERED,  OR  OTHER PURCHASING OR
 CONSUMING HISTORIES OR TENDENCIES;
   (D) BIOMETRIC DATA;
   (E) INTERNET OR OTHER ELECTRONIC NETWORK ACTIVITY INFORMATION, INCLUD-
 ING BUT NOT LIMITED TO, BROWSING HISTORY, SEARCH HISTORY,  AND  INFORMA-
 TION  REGARDING A CONSUMER'S INTERACTION WITH A WEBSITE, APPLICATION, OR
 ADVERTISEMENT;
   (F) GEOLOCATION DATA;
   (G) AUDIO, ELECTRONIC, VISUAL, THERMAL, OLFACTORY, OR SIMILAR INFORMA-
 TION;
   (H) PSYCHOMETRIC INFORMATION;
   (I) PROFESSIONAL OR EMPLOYMENT-RELATED INFORMATION;
   (J) INFERENCES DRAWN FROM ANY OF THE INFORMATION IDENTIFIED ABOVE; AND
   (K) ANY OF THE CATEGORIES OF INFORMATION SET FORTH IN THIS SUBDIVISION
 AS THEY PERTAIN TO THE MINOR CHILDREN OF THE CONSUMER.
   (2) "PERSONAL  INFORMATION"  DOES  NOT  INCLUDE  INFORMATION  THAT  IS
 PUBLICLY AVAILABLE OR THAT IS DE-IDENTIFIED.
   (N)  "PROBABILISTIC IDENTIFIER" MEANS THE IDENTIFICATION OF A CONSUMER
 OR A DEVICE TO A DEGREE OF CERTAINTY OF MORE PROBABLE THAN NOT BASED  ON
 ANY  CATEGORIES  OF PERSONAL INFORMATION INCLUDED IN, OR SIMILAR TO, THE
 CATEGORIES ENUMERATED IN SUBPARAGRAPH  ONE  OF  PARAGRAPH  (M)  OF  THIS
 SUBDIVISION.
   (O)  "PSYCHOMETRIC  INFORMATION"  MEANS INFORMATION DERIVED OR CREATED
 FROM THE USE OR APPLICATION OF  PSYCHOMETRIC  THEORY  OR  PSYCHOMETRICS,
 WHEREBY THROUGH THE USE OF ANY METHOD, MODEL, TOOL, OR FORMULA, OBSERVA-
 BLE  PHENOMENA,  SUCH  AS  ACTIONS  OR  EVENTS, ARE CONNECTED, MEASURED,
 ASSESSED, OR RELATED TO A  CONSUMER'S  ATTRIBUTES,  INCLUDING,  BUT  NOT
 LIMITED  TO,  PSYCHOLOGICAL TRENDS, PREFERENCES, PREDISPOSITIONS, BEHAV-
 IOR, ATTITUDES, INTELLIGENCE, ABILITIES, AND APTITUDES.
   (P) "PUBLICLY AVAILABLE"  MEANS  INFORMATION  THAT  IS  LAWFULLY  MADE
 AVAILABLE  FROM  FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS.  "PUBLICLY
 AVAILABLE" DOES NOT MEAN BIOMETRIC INFORMATION COLLECTED BY  A  BUSINESS
 ABOUT A CONSUMER WITHOUT THE CONSUMER'S KNOWLEDGE.
   (Q)(1)  "SELL",  "SELLING", "SALE" OR "SOLD" MEANS: (A) SELLING, RENT-
 ING, RELEASING,  DISCLOSING,  DISSEMINATING,  MAKING  AVAILABLE,  TRANS-
 FERRING, OR OTHERWISE COMMUNICATING ORALLY, IN WRITING, OR BY ELECTRONIC
 OR  OTHER  MEANS, A CONSUMER'S PERSONAL INFORMATION BY THE BUSINESS TO A
 THIRD PARTY FOR VALUABLE CONSIDERATION; OR (B) SHARING ORALLY, IN  WRIT-
 ING,  OR BY ELECTRONIC OR OTHER MEANS, A CONSUMER'S PERSONAL INFORMATION
 WITH A THIRD PARTY, WHETHER FOR VALUABLE CONSIDERATION OR FOR NO CONSID-
 ERATION, FOR THE THIRD PARTY'S COMMERCIAL PURPOSES.
   (2) FOR PURPOSES OF THIS SECTION, A BUSINESS DOES  NOT  SELL  PERSONAL
 INFORMATION WHEN:
   (A)  A  CONSUMER  USES  THE  BUSINESS:  (I)  TO INTENTIONALLY DISCLOSE
 PERSONAL INFORMATION, OR (II) TO INTENTIONALLY  INTERACT  WITH  A  THIRD
 PARTY.  AN  INTENTIONAL  INTERACTION OCCURS WHEN THE CONSUMER INTENDS TO
 INTERACT WITH THE THIRD PARTY VIA ONE OR MORE  DELIBERATE  INTERACTIONS.
 HOVERING OVER, MUTING, PAUSING, OR CLOSING A GIVEN PIECE OF CONTENT DOES
 NOT CONSTITUTE A CONSUMER'S INTENT TO INTERACT WITH A THIRD PARTY; OR

 A. 6351                             5
 
   (B)  THE  BUSINESS USES AN IDENTIFIER FOR A CONSUMER WHO HAS OPTED OUT
 OF THE SALE OF THE CONSUMER'S PERSONAL INFORMATION FOR THE  PURPOSES  OF
 ALERTING  THIRD  PARTIES  THAT THE CONSUMER HAS OPTED OUT OF THE SALE OF
 THE CONSUMER'S PERSONAL INFORMATION.
   (R) "SERVICE" OR "SERVICES" MEANS WORK, LABOR, AND SERVICES, INCLUDING
 SERVICES FURNISHED IN CONNECTION WITH THE SALE OR REPAIR OF GOODS.
   (S) "THIRD PARTY" MEANS ANY PERSON WHO IS NOT:
   (1)  THE  BUSINESS  THAT  COLLECTS PERSONAL INFORMATION FROM CONSUMERS
 UNDER THIS SECTION; OR
   (2) A PERSON TO WHOM THE  BUSINESS  DISCLOSES  A  CONSUMER'S  PERSONAL
 INFORMATION  FOR  A  BUSINESS  PURPOSE  PURSUANT  TO A WRITTEN CONTRACT,
 PROVIDED THAT THE CONTRACT:
   (A) PROHIBITS THE PERSON RECEIVING THE PERSONAL INFORMATION FROM:  (I)
 SELLING  THE  PERSONAL INFORMATION; (II) RETAINING, USING, OR DISCLOSING
 THE PERSONAL INFORMATION FOR ANY PURPOSE OTHER  THAN  FOR  THE  SPECIFIC
 PURPOSE  OF PERFORMING THE SERVICES SPECIFIED IN THE CONTRACT, INCLUDING
 RETAINING, USING, OR DISCLOSING THE PERSONAL INFORMATION FOR  A  COMMER-
 CIAL  PURPOSE  OTHER  THAN  PROVIDING  THE  SERVICES  SPECIFIED  IN  THE
 CONTRACT; AND (III) RETAINING,  USING,  OR  DISCLOSING  THE  INFORMATION
 OUTSIDE  OF  THE DIRECT BUSINESS RELATIONSHIP BETWEEN THE PERSON AND THE
 BUSINESS; AND
   (B) INCLUDES A CERTIFICATION MADE BY THE PERSON RECEIVING THE PERSONAL
 INFORMATION THAT THE PERSON UNDERSTANDS THE RESTRICTIONS IN  CLAUSE  (A)
 OF THIS SUBPARAGRAPH AND WILL COMPLY WITH THEM. A PERSON COVERED BY THIS
 SUBPARAGRAPH  THAT  VIOLATES  ANY  OF THE RESTRICTIONS SET FORTH IN THIS
 SECTION SHALL BE LIABLE FOR SUCH VIOLATIONS UNDER THIS SECTION. A  BUSI-
 NESS  THAT  DISCLOSES  PERSONAL  INFORMATION TO A PERSON COVERED BY THIS
 SUBPARAGRAPH IN COMPLIANCE WITH SUCH SUBPARAGRAPH SHALL  NOT  BE  LIABLE
 UNDER THIS SECTION IF THE PERSON RECEIVING THE PERSONAL INFORMATION USES
 IT  IN VIOLATION OF THE RESTRICTIONS SET FORTH IN THIS SECTION, PROVIDED
 THAT, AT THE TIME OF DISCLOSING THE PERSONAL INFORMATION,  THE  BUSINESS
 DOES  NOT  HAVE  ACTUAL KNOWLEDGE, OR REASON TO BELIEVE, THAT THE PERSON
 INTENDS TO COMMIT SUCH A VIOLATION.
   (T) "UNIQUE IDENTIFIER" MEANS A PERSISTENT IDENTIFIER THAT CAN BE USED
 TO RECOGNIZE A CONSUMER OR A  DEVICE  OVER  TIME  AND  ACROSS  DIFFERENT
 SERVICES,  INCLUDING  BUT  NOT LIMITED TO, A DEVICE IDENTIFIER; INTERNET
 PROTOCOL ADDRESS; COOKIES, BEACONS, PIXEL TAGS, MOBILE  AD  IDENTIFIERS,
 OR SIMILAR TECHNOLOGY; CUSTOMER NUMBER, UNIQUE PSEUDONYM, OR USER ALIAS;
 AND  TELEPHONE  NUMBERS,  OR  OTHER FORMS OF PERSISTENT OR PROBABILISTIC
 IDENTIFIERS THAT CAN BE  USED  TO  IDENTIFY  A  PARTICULAR  CONSUMER  OR
 DEVICE.
   (U)  "VERIFIABLE  REQUEST"  MEANS  A  REQUEST  THAT:  (1) IS MADE BY A
 CONSUMER, BY A CONSUMER ON BEHALF OF THE CONSUMER'S MINOR CHILD, OR BY A
 PERSON AUTHORIZED BY THE CONSUMER TO ACT ON THE CONSUMER'S  BEHALF;  AND
 (2)  THE  BUSINESS  HAS VERIFIED, PURSUANT TO REGULATIONS ADOPTED BY THE
 ATTORNEY GENERAL PURSUANT TO SUBPARAGRAPH  SEVEN  OF  PARAGRAPH  (A)  OF
 SUBDIVISION  FIFTEEN  OF THIS SECTION, TO BE THE CONSUMER ABOUT WHOM THE
 BUSINESS HAS COLLECTED PERSONAL INFORMATION. A BUSINESS IS NOT OBLIGATED
 TO PROVIDE INFORMATION TO THE CONSUMER PURSUANT TO SUBDIVISIONS TWO  AND
 THREE  OF  THIS  SECTION IF THE BUSINESS CANNOT VERIFY, PURSUANT TO THIS
 SUBDIVISION AND REGULATIONS ADOPTED BY THE ATTORNEY GENERAL PURSUANT  TO
 SUBPARAGRAPH  SEVEN  OF  PARAGRAPH  (A)  OF  SUBDIVISION FIFTEEN OF THIS
 SECTION, THAT THE CONSUMER MAKING THE REQUEST IS THE CONSUMER ABOUT WHOM
 THE BUSINESS HAS COLLECTED INFORMATION.
   2. (A) A CONSUMER SHALL HAVE THE RIGHT TO REQUEST THAT A BUSINESS THAT
 COLLECTS PERSONAL INFORMATION ABOUT THE CONSUMER DISCLOSE TO THE CONSUM-

 A. 6351                             6

 ER THE CATEGORIES OF PERSONAL INFORMATION IT HAS  COLLECTED  ABOUT  THAT
 CONSUMER.
   (B)  A  BUSINESS  THAT  COLLECTS PERSONAL INFORMATION ABOUT A CONSUMER
 SHALL DISCLOSE TO THE CONSUMER, PURSUANT TO SUBPARAGRAPH THREE OF  PARA-
 GRAPH  (A) OF SUBDIVISION SIX OF THIS SECTION, THE INFORMATION SPECIFIED
 IN PARAGRAPH (A) OF SUBDIVISION ONE OF THIS SECTION UPON  RECEIPT  OF  A
 VERIFIABLE REQUEST FROM THE CONSUMER.
   (C)  A  BUSINESS  THAT  COLLECTS  PERSONAL INFORMATION ABOUT CONSUMERS
 SHALL DISCLOSE, PURSUANT TO CLAUSE (B) OF SUBPARAGRAPH FIVE OF PARAGRAPH
 (A) OF SUBDIVISION SIX OF  THIS  SECTION,  THE  CATEGORIES  OF  PERSONAL
 INFORMATION IT HAS COLLECTED ABOUT CONSUMERS.
   3. (A) A CONSUMER SHALL HAVE THE RIGHT TO REQUEST THAT A BUSINESS THAT
 SELLS  THE  CONSUMER'S  PERSONAL INFORMATION, OR THAT DISCLOSES IT FOR A
 BUSINESS PURPOSE, DISCLOSE TO  THAT  CONSUMER:  (1)  THE  CATEGORIES  OF
 PERSONAL  INFORMATION  THAT THE BUSINESS SOLD ABOUT THE CONSUMER AND THE
 IDENTITY OF THE THIRD PARTIES TO  WHOM  SUCH  PERSONAL  INFORMATION  WAS
 SOLD,  BY  CATEGORY OR CATEGORIES OF PERSONAL INFORMATION FOR EACH THIRD
 PARTY TO WHOM SUCH PERSONAL INFORMATION WAS SOLD; AND (2) THE CATEGORIES
 OF PERSONAL INFORMATION THAT THE BUSINESS DISCLOSED ABOUT  THE  CONSUMER
 FOR  A  BUSINESS  PURPOSE  AND  THE IDENTITY OF THE PERSONS TO WHOM SUCH
 PERSONAL INFORMATION WAS DISCLOSED FOR A BUSINESS PURPOSE,  BY  CATEGORY
 OR  CATEGORIES  OF  PERSONAL  INFORMATION  FOR  EACH PERSON TO WHOM SUCH
 PERSONAL INFORMATION WAS DISCLOSED FOR A BUSINESS PURPOSE.
   (B) A BUSINESS THAT SELLS PERSONAL INFORMATION ABOUT  A  CONSUMER,  OR
 THAT DISCLOSES A CONSUMER'S PERSONAL INFORMATION FOR A BUSINESS PURPOSE,
 SHALL DISCLOSE, PURSUANT TO SUBPARAGRAPH FOUR OF PARAGRAPH (A) OF SUBDI-
 VISION  SIX  OF THIS SECTION, THE INFORMATION SPECIFIED IN PARAGRAPH (A)
 OF THIS SUBDIVISION TO THE CONSUMER UPON RECEIPT OF A VERIFIABLE REQUEST
 FROM THE CONSUMER.
   (C) A BUSINESS THAT SELLS CONSUMERS'  PERSONAL  INFORMATION,  OR  THAT
 DISCLOSES  CONSUMERS' PERSONAL INFORMATION FOR A BUSINESS PURPOSE, SHALL
 DISCLOSE, PURSUANT TO CLAUSE (C) OF SUBPARAGRAPH FIVE OF  PARAGRAPH  (A)
 OF  SUBDIVISION  SIX  OF THIS SECTION: (1) THE CATEGORY OR CATEGORIES OF
 CONSUMERS' PERSONAL INFORMATION IT HAS SOLD; OR IF THE BUSINESS HAS  NOT
 SOLD  CONSUMERS'  PERSONAL INFORMATION, IT SHALL DISCLOSE THAT FACT; AND
 (2) THE CATEGORY OR CATEGORIES OF CONSUMERS' PERSONAL INFORMATION IT HAS
 DISCLOSED FOR A BUSINESS PURPOSE; OR IF THE BUSINESS HAS  NOT  DISCLOSED
 CONSUMERS'  PERSONAL  INFORMATION  FOR  A  BUSINESS  PURPOSE,  IT  SHALL
 DISCLOSE THAT FACT.
   4. (A) A CONSUMER SHALL HAVE THE RIGHT, AT ANY TIME, TO DIRECT A BUSI-
 NESS THAT SELLS PERSONAL INFORMATION ABOUT THE CONSUMER NOT TO SELL  THE
 CONSUMER'S  PERSONAL  INFORMATION.  THIS RIGHT MAY BE REFERRED TO AS THE
 RIGHT TO OPT OUT.
   (B) NOTWITHSTANDING PARAGRAPH (A)  OF  THIS  SUBDIVISION,  A  BUSINESS
 SHALL NOT SELL THE PERSONAL INFORMATION OF CONSUMERS IF THE BUSINESS HAS
 ACTUAL  KNOWLEDGE,  OR  WILLFULLY  DISREGARDS, THAT THE CONSUMER IS LESS
 THAN SIXTEEN YEARS OF AGE, UNLESS THE CONSUMER, IN THE CASE OF CONSUMERS
 THIRTEEN, FOURTEEN AND FIFTEEN YEARS OF AGE, OR THE CONSUMER'S PARENT OR
 GUARDIAN, IN THE CASE OF CONSUMERS WHO ARE LESS THAN THIRTEEN  YEARS  OF
 AGE,  HAS  AFFIRMATIVELY  AUTHORIZED THE SALE OF THE CONSUMER'S PERSONAL
 INFORMATION. THIS RIGHT MAY BE REFERRED TO AS THE RIGHT TO OPT IN.
   (C) A  BUSINESS  THAT  SELLS  CONSUMERS'  PERSONAL  INFORMATION  SHALL
 PROVIDE  NOTICE  TO  CONSUMERS, PURSUANT TO PARAGRAPH (A) OF SUBDIVISION
 SEVEN OF THIS SECTION, THAT  SUCH  INFORMATION  MAY  BE  SOLD  AND  THAT
 CONSUMERS HAVE THE RIGHT TO OPT OUT OF THE SALE OF THEIR PERSONAL INFOR-
 MATION.

 A. 6351                             7
 
   (D) A BUSINESS THAT HAS RECEIVED DIRECTION FROM A CONSUMER NOT TO SELL
 THE  CONSUMER'S PERSONAL INFORMATION, OR, IN THE CASE OF A MINOR CONSUM-
 ER'S PERSONAL INFORMATION, HAS NOT RECEIVED CONSENT TO  SELL  THE  MINOR
 CONSUMER'S  PERSONAL  INFORMATION,  SHALL  BE  PROHIBITED,  PURSUANT  TO
 SUBPARAGRAPH FOUR OF PARAGRAPH (A) OF SUBDIVISION SEVEN OF THIS SECTION,
 FROM  SELLING  THE  CONSUMER'S PERSONAL INFORMATION AFTER ITS RECEIPT OF
 THE CONSUMER'S DIRECTION,  UNLESS  THE  CONSUMER  SUBSEQUENTLY  PROVIDES
 EXPRESS  AUTHORIZATION  FOR THE SALE OF THE CONSUMER'S PERSONAL INFORMA-
 TION.
   5. A BUSINESS  SHALL  BE  PROHIBITED  FROM  DISCRIMINATING  AGAINST  A
 CONSUMER BECAUSE THE CONSUMER REQUESTED INFORMATION PURSUANT TO SUBDIVI-
 SIONS  TWO  AND  THREE OF THIS SECTION, OR BECAUSE THE CONSUMER DIRECTED
 THE BUSINESS NOT TO SELL THE CONSUMER'S PERSONAL INFORMATION PURSUANT TO
 SUBDIVISION FOUR OF THIS SECTION,  OR  BECAUSE  THE  CONSUMER  OTHERWISE
 EXERCISED RIGHTS UNDER THIS TITLE, OR EXERCISED THE CONSUMER'S RIGHTS TO
 ENFORCE THIS ACT, INCLUDING BUT NOT LIMITED TO, BY: (A) DENYING GOODS OR
 SERVICES  TO  THE  CONSUMER;  (B) CHARGING DIFFERENT PRICES OR RATES FOR
 GOODS OR SERVICES, INCLUDING THROUGH THE USE OF DISCOUNTS OR OTHER BENE-
 FITS OR IMPOSING PENALTIES; (C) PROVIDING A DIFFERENT LEVEL  OR  QUALITY
 OF GOODS OR SERVICES TO THE CONSUMER; OR (D) SUGGESTING THAT THE CONSUM-
 ER  WILL  RECEIVE  A DIFFERENT PRICE OR RATE FOR GOODS OR SERVICES, OR A
 DIFFERENT LEVEL OR QUALITY OF GOODS OR SERVICES, IF THE  CONSUMER  EXER-
 CISES THE CONSUMER'S RIGHTS UNDER THIS SECTION.
   6.  (A)  IN  ORDER  TO COMPLY WITH SUBDIVISIONS TWO, THREE AND FIVE OF
 THIS SECTION, A BUSINESS SHALL:
   (1) MAKE AVAILABLE TO CONSUMERS TWO OR  MORE  DESIGNATED  METHODS  FOR
 SUBMITTING REQUESTS FOR INFORMATION REQUIRED TO BE DISCLOSED PURSUANT TO
 SUBDIVISIONS  TWO  AND THREE OF THIS SECTION, INCLUDING, AT A MINIMUM, A
 TOLL-FREE TELEPHONE NUMBER, AND IF THE BUSINESS MAINTAINS A  WEBSITE,  A
 WEBSITE ADDRESS.
   (2)  DISCLOSE  AND DELIVER THE REQUIRED INFORMATION TO A CONSUMER FREE
 OF CHARGE WITHIN FORTY-FIVE DAYS OF RECEIVING A VERIFIABLE REQUEST  FROM
 THE CONSUMER. THE BUSINESS SHALL PROMPTLY TAKE STEPS TO DETERMINE WHETH-
 ER  THE  REQUEST  IS A VERIFIABLE REQUEST, BUT THIS SHALL NOT EXTEND THE
 BUSINESS'S DUTY TO DISCLOSE AND DELIVER THE  INFORMATION  WITHIN  FORTY-
 FIVE  DAYS  OF  RECEIPT  OF THE CONSUMER'S REQUEST. THE DISCLOSURE SHALL
 COVER THE TWELVE-MONTH PERIOD PRECEDING THE BUSINESS'S  RECEIPT  OF  THE
 VERIFIABLE  REQUEST  AND  SHALL BE MADE IN WRITING AND DELIVERED THROUGH
 THE CONSUMER'S ACCOUNT WITH THE BUSINESS, IF THE CONSUMER  MAINTAINS  AN
 ACCOUNT  WITH  THE BUSINESS, OR BY MAIL OR ELECTRONICALLY AT THE CONSUM-
 ER'S OPTION IF THE CONSUMER DOES NOT MAINTAIN AN ACCOUNT WITH THE  BUSI-
 NESS.  THE  BUSINESS SHALL NOT REQUIRE THE CONSUMER TO CREATE AN ACCOUNT
 WITH THE BUSINESS IN ORDER TO MAKE A VERIFIABLE REQUEST.
   (3) FOR PURPOSES OF PARAGRAPH (B) OF SUBDIVISION TWO OF THIS  SECTION:
 (A)  IDENTIFY  THE  CONSUMER,  ASSOCIATE THE INFORMATION PROVIDED BY THE
 CONSUMER IN THE VERIFIABLE REQUEST TO ANY PERSONAL INFORMATION PREVIOUS-
 LY COLLECTED BY THE BUSINESS ABOUT THE CONSUMER;  AND  (B)  IDENTIFY  BY
 CATEGORY  OR  CATEGORIES  THE  PERSONAL  INFORMATION COLLECTED ABOUT THE
 CONSUMER IN THE PRECEDING TWELVE MONTHS BY REFERENCE TO  THE  ENUMERATED
 CATEGORY  OR  CATEGORIES  IN PARAGRAPH (C) OF THIS SUBDIVISION THAT MOST
 CLOSELY DESCRIBES THE PERSONAL INFORMATION COLLECTED.
   (4) FOR PURPOSES  OF  PARAGRAPH  (B)  OF  SUBDIVISION  THREE  OF  THIS
 SECTION:  (A)  IDENTIFY THE CONSUMER, ASSOCIATE THE INFORMATION PROVIDED
 BY THE CONSUMER IN THE VERIFIABLE REQUEST TO  ANY  PERSONAL  INFORMATION
 PREVIOUSLY COLLECTED BY THE BUSINESS ABOUT THE CONSUMER; (B) IDENTIFY BY
 CATEGORY OR CATEGORIES THE PERSONAL INFORMATION OF THE CONSUMER THAT THE

 A. 6351                             8
 
 BUSINESS SOLD IN THE PRECEDING TWELVE MONTHS BY REFERENCE TO THE ENUMER-
 ATED  CATEGORY  OR  CATEGORIES IN PARAGRAPH (C) OF THIS SUBDIVISION THAT
 MOST CLOSELY DESCRIBES THE PERSONAL INFORMATION,  AND  PROVIDE  ACCURATE
 NAMES  AND CONTACT INFORMATION FOR THE THIRD PARTIES TO WHOM THE CONSUM-
 ER'S PERSONAL INFORMATION WAS SOLD IN THE  PRECEDING  TWELVE  MONTHS  BY
 REFERENCE  TO  THE ENUMERATED CATEGORY OR CATEGORIES IN PARAGRAPH (C) OF
 THIS SUBDIVISION THAT MOST CLOSELY DESCRIBES  THE  PERSONAL  INFORMATION
 SOLD  FOR  EACH  THIRD PARTY; AND (C) IDENTIFY BY CATEGORY OR CATEGORIES
 THE PERSONAL INFORMATION OF THE CONSUMER THAT THE BUSINESS DISCLOSED FOR
 A BUSINESS PURPOSE IN THE PRECEDING TWELVE MONTHS BY  REFERENCE  TO  THE
 ENUMERATED  CATEGORY  OR CATEGORIES IN PARAGRAPH (C) OF THIS SUBDIVISION
 THAT MOST CLOSELY DESCRIBES THE PERSONAL INFORMATION, AND PROVIDE  ACCU-
 RATE  NAMES  AND CONTACT INFORMATION FOR THE PERSONS TO WHOM THE CONSUM-
 ER'S PERSONAL INFORMATION WAS DISCLOSED FOR A BUSINESS  PURPOSE  IN  THE
 PRECEDING TWELVE MONTHS BY REFERENCE TO THE ENUMERATED CATEGORY OR CATE-
 GORIES  IN  PARAGRAPH  (C) OF THIS SUBDIVISION OF THIS SECTION THAT MOST
 CLOSELY DESCRIBES THE PERSONAL INFORMATION DISCLOSED  FOR  EACH  PERSON.
 THE  BUSINESS SHALL DISCLOSE THE INFORMATION REQUIRED BY CLAUSES (B) AND
 (C) OF THIS SUBPARAGRAPH IN TWO SEPARATE LISTS.
   (5) DISCLOSE THE FOLLOWING INFORMATION IN ITS ONLINE PRIVACY POLICY OR
 POLICIES IF THE BUSINESS HAS AN ONLINE PRIVACY POLICY OR POLICIES AND IN
 ANY NEW YORK-SPECIFIC DESCRIPTION OF CONSUMERS' PRIVACY  RIGHTS,  OR  IF
 THE BUSINESS DOES NOT MAINTAIN SUCH POLICIES, ON ITS WEBSITE, AND UPDATE
 SUCH INFORMATION AT LEAST ONCE EVERY TWELVE MONTHS:
   (A) A DESCRIPTION OF A CONSUMER'S RIGHTS PURSUANT TO SUBDIVISIONS TWO,
 THREE  AND  FIVE OF THIS SECTION, AND ONE OR MORE DESIGNATED METHODS FOR
 SUBMITTING REQUESTS;
   (B) FOR PURPOSES OF PARAGRAPH (C) OF SUBDIVISION TWO OF THIS  SECTION,
 A  LIST OF THE CATEGORIES OF PERSONAL INFORMATION IT HAS COLLECTED ABOUT
 CONSUMERS IN THE PRECEDING TWELVE MONTHS BY REFERENCE TO THE  ENUMERATED
 CATEGORY  OR  CATEGORIES  IN PARAGRAPH (C) OF THIS SUBDIVISION THAT MOST
 CLOSELY DESCRIBES THE PERSONAL INFORMATION COLLECTED; AND
   (C) FOR PURPOSES OF SUBPARAGRAPHS ONE AND  TWO  OF  PARAGRAPH  (C)  OF
 SUBDIVISION THREE OF THIS SECTION, TWO SEPARATE LISTS: (I) A LIST OF THE
 CATEGORIES  OF  PERSONAL  INFORMATION IT HAS SOLD ABOUT CONSUMERS IN THE
 PRECEDING TWELVE MONTHS BY REFERENCE TO THE ENUMERATED CATEGORY OR CATE-
 GORIES IN PARAGRAPH (C) OF THIS SUBDIVISION THAT MOST CLOSELY  DESCRIBES
 THE  PERSONAL  INFORMATION SOLD, OR IF THE BUSINESS HAS NOT SOLD CONSUM-
 ERS' PERSONAL INFORMATION IN THE PRECEDING TWELVE MONTHS,  THE  BUSINESS
 SHALL  DISCLOSE THAT FACT; AND (II) A LIST OF THE CATEGORIES OF PERSONAL
 INFORMATION IT HAS DISCLOSED ABOUT CONSUMERS FOR A BUSINESS  PURPOSE  IN
 THE  PRECEDING  TWELVE MONTHS BY REFERENCE TO THE ENUMERATED CATEGORY OR
 CATEGORIES IN PARAGRAPH  (C)  OF  THIS  SUBDIVISION  THAT  MOST  CLOSELY
 DESCRIBES THE PERSONAL INFORMATION DISCLOSED, OR IF THE BUSINESS HAS NOT
 DISCLOSED  CONSUMERS' PERSONAL INFORMATION FOR A BUSINESS PURPOSE IN THE
 PRECEDING TWELVE MONTHS, THE BUSINESS SHALL DISCLOSE THAT FACT.
   (6) ENSURE THAT ALL  INDIVIDUALS  RESPONSIBLE  FOR  HANDLING  CONSUMER
 INQUIRIES  ABOUT  THE  BUSINESS'S  PRIVACY  PRACTICES  OR THE BUSINESS'S
 COMPLIANCE WITH THIS SECTION ARE INFORMED OF ALL  REQUIREMENTS  IN  THIS
 SUBDIVISION,  AS  WELL  AS  IN  SUBDIVISIONS TWO, THREE AND FIVE OF THIS
 SECTION, AND HOW TO DIRECT CONSUMERS  TO  EXERCISE  THEIR  RIGHTS  UNDER
 THOSE SECTIONS; AND
   (7)  USE  ANY  PERSONAL  INFORMATION  COLLECTED  FROM  THE CONSUMER IN
 CONNECTION WITH THE BUSINESS'S VERIFICATION OF  THE  CONSUMER'S  REQUEST
 SOLELY FOR THE PURPOSES OF VERIFICATION.

 A. 6351                             9

   (B) A BUSINESS IS NOT OBLIGATED TO PROVIDE THE INFORMATION REQUIRED BY
 SUBDIVISIONS  TWO  AND  THREE  OF THIS SECTION TO THE SAME CONSUMER MORE
 THAN ONCE IN A TWELVE-MONTH PERIOD.
   (C)  THE  CATEGORIES  OF PERSONAL INFORMATION REQUIRED TO BE DISCLOSED
 PURSUANT TO SUBDIVISIONS TWO AND THREE OF THIS SECTION ARE  ALL  OF  THE
 FOLLOWING:
   (1)  IDENTIFIERS  SUCH  AS  A REAL NAME, ALIAS, POSTAL ADDRESS, UNIQUE
 IDENTIFIER, INTERNET PROTOCOL ADDRESS, ELECTRONIC MAIL ADDRESS,  ACCOUNT
 NAME,  SOCIAL SECURITY NUMBER, DRIVER'S LICENSE NUMBER, PASSPORT NUMBER,
 OR OTHER SIMILAR IDENTIFIERS;
   (2) ALL CATEGORIES OF PERSONAL INFORMATION ENUMERATED IN PARAGRAPH (A)
 OF SUBDIVISION ONE OF THIS SECTION;
   (3) ALL CATEGORIES OF PERSONAL INFORMATION RELATING TO CHARACTERISTICS
 OF PROTECTED CLASSIFICATIONS UNDER STATE OR FEDERAL LAW,  WITH  SPECIFIC
 REFERENCE  TO  THE CATEGORY OF INFORMATION THAT HAS BEEN COLLECTED, SUCH
 AS RACE, ETHNICITY, OR GENDER;
   (4) COMMERCIAL INFORMATION, INCLUDING RECORDS OF PROPERTY, PRODUCTS OR
 SERVICES PROVIDED, OBTAINED,  OR  CONSIDERED,  OR  OTHER  PURCHASING  OR
 CONSUMING HISTORIES OR TENDENCIES;
   (5) BIOMETRIC DATA;
   (6) INTERNET OR OTHER ELECTRONIC NETWORK ACTIVITY INFORMATION, INCLUD-
 ING  BUT  NOT LIMITED TO, BROWSING HISTORY, SEARCH HISTORY, AND INFORMA-
 TION REGARDING A CONSUMER'S INTERACTION WITH A WEBSITE, APPLICATION,  OR
 ADVERTISEMENT;
   (7) GEOLOCATION DATA;
   (8) AUDIO, ELECTRONIC, VISUAL, THERMAL, OLFACTORY, OR SIMILAR INFORMA-
 TION;
   (9) PSYCHOMETRIC INFORMATION;
   (10) PROFESSIONAL OR EMPLOYMENT-RELATED INFORMATION;
   (11)  INFERENCES  DRAWN  FROM ANY OF THE INFORMATION IDENTIFIED ABOVE;
 AND
   (12) ANY OF THE CATEGORIES OF INFORMATION SET FORTH IN THIS  PARAGRAPH
 AS THEY PERTAIN TO THE MINOR CHILDREN OF THE CONSUMER.
   7.  (A) A BUSINESS THAT IS REQUIRED TO COMPLY WITH SUBDIVISION FOUR OF
 THIS SECTION SHALL:
   (1) PROVIDE A CLEAR AND CONSPICUOUS LINK ON THE  BUSINESS'S  HOMEPAGE,
 TITLED  "DO NOT SELL MY PERSONAL INFORMATION", TO A WEBPAGE THAT ENABLES
 A CONSUMER, OR A PERSON AUTHORIZED BY THE CONSUMER, TO OPT  OUT  OF  THE
 SALE  OF  THE  CONSUMER'S  PERSONAL  INFORMATION.  A  BUSINESS SHALL NOT
 REQUIRE A CONSUMER TO CREATE AN ACCOUNT IN ORDER TO DIRECT THE  BUSINESS
 NOT TO SELL THE CONSUMER'S PERSONAL INFORMATION;
   (2)  INCLUDE A DESCRIPTION OF A CONSUMER'S RIGHTS PURSUANT TO SUBDIVI-
 SION FOUR OF THIS SECTION, ALONG WITH A SEPARATE LINK  TO  THE  "DO  NOT
 SELL  MY PERSONAL INFORMATION" WEBPAGE IN: (A) ITS ONLINE PRIVACY POLICY
 OR POLICIES IF THE BUSINESS HAS AN ONLINE PRIVACY  POLICY  OR  POLICIES,
 AND (B) ANY STATE SPECIFIC DESCRIPTION OF CONSUMERS' PRIVACY RIGHTS;
   (3)  ENSURE  THAT  ALL  INDIVIDUALS  RESPONSIBLE FOR HANDLING CONSUMER
 INQUIRIES ABOUT THE  BUSINESS'S  PRIVACY  PRACTICES  OR  THE  BUSINESS'S
 COMPLIANCE  WITH  THIS  SECTION ARE INFORMED OF ALL REQUIREMENTS IN THIS
 SUBDIVISION AS WELL AS SUBDIVISION FOUR OF  THIS  SECTION,  AND  HOW  TO
 DIRECT CONSUMERS TO EXERCISE THEIR RIGHTS UNDER THOSE SECTIONS;
   (4)  FOR  CONSUMERS WHO EXERCISE THEIR RIGHT TO OPT OUT OF THE SALE OF
 THEIR PERSONAL INFORMATION, REFRAIN FROM  SELLING  PERSONAL  INFORMATION
 COLLECTED BY THE BUSINESS ABOUT THE CONSUMER;
   (5)  FOR  A  CONSUMER  WHO HAS OPTED OUT OF THE SALE OF THE CONSUMER'S
 PERSONAL INFORMATION, RESPECT THE CONSUMER'S DECISION TO OPT OUT FOR  AT

 A. 6351                            10
 
 LEAST  TWELVE  MONTHS  BEFORE REQUESTING THAT THE CONSUMER AUTHORIZE THE
 SALE OF THE CONSUMER'S PERSONAL INFORMATION; AND
   (6)  USE  ANY  PERSONAL  INFORMATION  COLLECTED  FROM  THE CONSUMER IN
 CONNECTION WITH THE SUBMISSION OF THE CONSUMER'S OPT OUT REQUEST  SOLELY
 FOR THE PURPOSES OF COMPLYING WITH THE OPT OUT REQUEST.
   (B)  A CONSUMER MAY AUTHORIZE ANOTHER PERSON TO OPT OUT ON THE CONSUM-
 ER'S BEHALF, AND A  BUSINESS  SHALL  COMPLY  WITH  AN  OPT  OUT  REQUEST
 RECEIVED  FROM A PERSON AUTHORIZED BY THE CONSUMER TO ACT ON THE CONSUM-
 ER'S BEHALF.
   8. (A) THE OBLIGATIONS IMPOSED ON BUSINESSES BY SUBDIVISIONS  TWO  AND
 SEVEN OF THIS SECTION SHALL NOT RESTRICT A BUSINESS'S ABILITY TO:
   (1) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS;
   (2)  COMPLY  WITH  A  CIVIL,  CRIMINAL, OR REGULATORY INVESTIGATION OR
 SUBPOENA OR SUMMONS BY FEDERAL, STATE, OR LOCAL AUTHORITIES;
   (3) COOPERATE WITH LAW  ENFORCEMENT  AGENCIES  CONCERNING  CONDUCT  OR
 ACTIVITY  THAT  THE  BUSINESS  REASONABLY AND IN GOOD FAITH BELIEVES MAY
 VIOLATE FEDERAL, STATE, OR LOCAL LAW; OR
   (4) COLLECT AND SELL A CONSUMER'S PERSONAL INFORMATION IF EVERY ASPECT
 OF SUCH COMMERCIAL CONDUCT TAKES PLACE WHOLLY OUTSIDE OF THE STATE.  FOR
 PURPOSES  OF THIS SECTION, COMMERCIAL CONDUCT TAKES PLACE WHOLLY OUTSIDE
 OF THE STATE IF  THE  BUSINESS  COLLECTED  SUCH  INFORMATION  WHILE  THE
 CONSUMER WAS OUTSIDE OF THE STATE, NO PART OF THE SALE OF THE CONSUMER'S
 PERSONAL  INFORMATION OCCURRED IN THE STATE, AND NO PERSONAL INFORMATION
 COLLECTED WHILE THE CONSUMER WAS IN THE STATE IS SOLD.
   (B) THE OBLIGATIONS IMPOSED ON  BUSINESSES  BY  SUBDIVISIONS  TWO  AND
 SEVEN  OF  THIS SECTION SHALL NOT APPLY WHERE COMPLIANCE BY THE BUSINESS
 WITH THIS SECTION WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER STATE LAW
 AND SHALL NOT PREVENT A BUSINESS FROM PROVIDING THE PERSONAL INFORMATION
 OF A CONSUMER TO A PERSON COVERED  BY  AN  EVIDENTIARY  PRIVILEGE  UNDER
 STATE LAW AS PART OF A PRIVILEGED COMMUNICATION.
   (C)  THIS SECTION SHALL NOT APPLY TO PROTECTED HEALTH INFORMATION THAT
 IS COLLECTED BY A COVERED ENTITY GOVERNED BY  THE  MEDICAL  PRIVACY  AND
 SECURITY  RULES  ISSUED  BY  THE  FEDERAL DEPARTMENT OF HEALTH AND HUMAN
 SERVICES, PARTS 160 AND 164 OF TITLE 45 OF THE  CODE  OF  FEDERAL  REGU-
 LATIONS,  ESTABLISHED  PURSUANT  TO THE HEALTH INSURANCE PORTABILITY AND
 AVAILABILITY ACT OF 1996 (HIPAA). FOR PURPOSES OF THIS SUBDIVISION,  THE
 DEFINITIONS  OF "PROTECTED HEALTH INFORMATION" AND "COVERED ENTITY" FROM
 THE FEDERAL PRIVACY RULE SHALL APPLY.
   (D) THIS SECTION SHALL NOT APPLY TO THE SALE OF  PERSONAL  INFORMATION
 TO  OR  FROM  A  CONSUMER  REPORTING AGENCY IF THAT INFORMATION IS TO BE
 REPORTED IN, OR USED TO GENERATE, A CONSUMER REPORT AS DEFINED BY SUBDI-
 VISION (D) OF SECTION 1681(A) OF TITLE 15 OF THE UNITED STATES CODE, AND
 USE OF THAT INFORMATION IS LIMITED BY THE FEDERAL FAIR CREDIT  REPORTING
 ACT, 15 U.S.C. § 1681, ET SEQ.
   9.  (A)  A  CONSUMER  WHO HAS SUFFERED A VIOLATION OF THIS SECTION MAY
 BRING AN ACTION FOR STATUTORY DAMAGES. A VIOLATION OF THIS SECTION SHALL
 BE DEEMED TO CONSTITUTE AN INJURY  IN  FACT  TO  THE  CONSUMER  WHO  HAS
 SUFFERED THE VIOLATION, AND THE CONSUMER NEED NOT SUFFER A LOSS OF MONEY
 OR PROPERTY AS A RESULT OF THE VIOLATION IN ORDER TO BRING AN ACTION FOR
 A VIOLATION OF THIS SECTION.
   (B)(1)  ANY  CONSUMER  WHO  SUFFERS AN INJURY IN FACT, AS DESCRIBED IN
 PARAGRAPH (A) OF THIS SUBDIVISION, SHALL RECOVER  STATUTORY  DAMAGES  IN
 THE  AMOUNT  OF  ONE  THOUSAND  DOLLARS  OR ACTUAL DAMAGES, WHICHEVER IS
 GREATER, FOR EACH VIOLATION FROM THE BUSINESS OR PERSON RESPONSIBLE  FOR
 THE  VIOLATION,  EXCEPT  THAT  IN  THE  CASE  OF  A  KNOWING AND WILLFUL
 VIOLATION BY A BUSINESS OR PERSON, AN INDIVIDUAL SHALL RECOVER STATUTORY

 A. 6351                            11
 
 DAMAGES OF NOT LESS THAN ONE THOUSAND DOLLARS AND NOT  MORE  THAN  THREE
 THOUSAND  DOLLARS,  OR  ACTUAL  DAMAGES,  WHICHEVER IS GREATER, FOR EACH
 VIOLATION FROM THE BUSINESS OR PERSON RESPONSIBLE FOR THE VIOLATION.
   (2)  IN  ASSESSING  THE  AMOUNT  OF STATUTORY DAMAGES, THE COURT SHALL
 CONSIDER ANY ONE OR MORE OF THE RELEVANT CIRCUMSTANCES PRESENTED BY  ANY
 OF  THE  PARTIES TO THE CASE, INCLUDING, BUT NOT LIMITED TO, THE FOLLOW-
 ING: THE NATURE  AND  SERIOUSNESS  OF  THE  MISCONDUCT,  THE  NUMBER  OF
 VIOLATIONS,  THE  PERSISTENCE OF THE MISCONDUCT, THE LENGTH OF TIME OVER
 WHICH THE  MISCONDUCT  OCCURRED,  THE  WILLFULNESS  OF  THE  DEFENDANT'S
 MISCONDUCT, AND THE DEFENDANT'S ASSETS, LIABILITIES, AND NET WORTH.
   (C)  NOTWITHSTANDING ANY OTHER LAW, WHENEVER A JUDGMENT, INCLUDING ANY
 CONSENT JUDGMENT, DECREE, OR SETTLEMENT AGREEMENT, IS  APPROVED  BY  THE
 COURT  IN  A  CLASS  ACTION BASED ON A VIOLATION OF THIS SECTION, ANY CY
 PRES AWARD, UNPAID CASH RESIDUE, OR UNCLAIMED OR ABANDONED CLASS  MEMBER
 FUNDS  ATTRIBUTABLE  TO A VIOLATION OF THIS SECTION SHALL BE DISTRIBUTED
 EXCLUSIVELY TO ONE OR MORE NONPROFIT ORGANIZATIONS TO  SUPPORT  PROJECTS
 THAT  WILL  BENEFIT THE CLASS OR SIMILARLY SITUATED PERSONS, FURTHER THE
 OBJECTIVES AND PURPOSES OF THE  UNDERLYING  CLASS  ACTION  OR  CAUSE  OF
 ACTION,  OR  PROMOTE THE LAW CONSISTENT WITH THE OBJECTIVES AND PURPOSES
 OF THE UNDERLYING CLASS ACTION OR CAUSE OF ACTION, UNLESS FOR GOOD CAUSE
 SHOWN THE COURT MAKES A SPECIFIC FINDING THAT  AN  ALTERNATIVE  DISTRIB-
 UTION  WOULD  BETTER  SERVE  THE PUBLIC INTEREST OR THE INTERESTS OF THE
 CLASS. IF NOT SPECIFIED IN THE JUDGMENT, THE COURT SHALL SET A DATE WHEN
 THE PARTIES SHALL SUBMIT A REPORT TO THE COURT REGARDING A PLAN FOR  THE
 DISTRIBUTION OF ANY MONEYS PURSUANT TO THIS SUBDIVISION.
   (D)  THE  REMEDIES PROVIDED BY THIS SUBDIVISION ARE CUMULATIVE TO EACH
 OTHER AND TO THE REMEDIES OR PENALTIES AVAILABLE UNDER ALL OTHER LAWS OF
 THE STATE.
   10. (A) ANY BUSINESS OR PERSON THAT VIOLATES  THIS  SECTION  SHALL  BE
 LIABLE  FOR A CIVIL PENALTY IN A CIVIL ACTION BROUGHT IN THE NAME OF THE
 PEOPLE OF THE STATE OF NEW YORK BY THE ATTORNEY GENERAL.
   (B) NOTWITHSTANDING ANY OTHER LAW TO THE CONTRARY, ANY PERSON OR BUSI-
 NESS THAT INTENTIONALLY VIOLATES THIS SECTION MAY BE LIABLE FOR A  CIVIL
 PENALTY OF UP TO SEVEN THOUSAND FIVE HUNDRED DOLLARS FOR EACH VIOLATION.
   (C)  NOTWITHSTANDING  ANY OTHER LAW TO THE CONTRARY, ANY CIVIL PENALTY
 ASSESSED FOR A VIOLATION OF  THIS  SECTION,  AND  THE  PROCEEDS  OF  ANY
 SETTLEMENT OF AN ACTION BROUGHT PURSUANT TO PARAGRAPH (A) OF THIS SUBDI-
 VISION, SHALL BE ALLOCATED AS FOLLOWS:
   (1)  TWENTY  PERCENT TO THE CONSUMER PRIVACY FUND, CREATED PURSUANT TO
 SECTION NINETY-NINE-FF OF THE STATE FINANCE  LAW,  WITH  THE  INTENT  TO
 FULLY  OFFSET  ANY  COSTS  INCURRED BY THE STATE COURTS AND THE ATTORNEY
 GENERAL IN CONNECTION WITH THIS SECTION; AND
   (2) EIGHTY PERCENT TO THE JURISDICTION  ON  WHOSE  BEHALF  THE  ACTION
 LEADING TO THE CIVIL PENALTY WAS BROUGHT.
   (D)  THE  LEGISLATURE  SHALL ADJUST THE PERCENTAGES SPECIFIED IN PARA-
 GRAPH (C) OF THIS SUBDIVISION AND IN SUBDIVISION ELEVEN OF THIS SECTION,
 AS NECESSARY TO ENSURE THAT ANY CIVIL PENALTIES ASSESSED FOR A VIOLATION
 OF THIS SECTION FULLY OFFSET ANY COSTS INCURRED BY THE STATE COURTS  AND
 THE ATTORNEY GENERAL IN CONNECTION WITH THIS SECTION, INCLUDING A SUFFI-
 CIENT AMOUNT TO COVER ANY DEFICIT FROM A PRIOR FISCAL YEAR. THE LEGISLA-
 TURE  SHALL  NOT DIRECT A GREATER PERCENTAGE OF ASSESSED CIVIL PENALTIES
 TO THE CONSUMER PRIVACY FUND THAN REASONABLY NECESSARY TO  FULLY  OFFSET
 ANY  COSTS  INCURRED  BY  THE  STATE  COURTS AND THE ATTORNEY GENERAL IN
 CONNECTION WITH THIS SECTION.
   11. (A) ANY PERSON WHO BECOMES AWARE, BASED ON NON-PUBLIC INFORMATION,
 THAT A PERSON OR BUSINESS HAS VIOLATED THIS SECTION  MAY  FILE  A  CIVIL

 A. 6351                            12
 
 ACTION  FOR CIVIL PENALTIES PURSUANT TO SUBDIVISION TEN OF THIS SECTION,
 IF PRIOR TO FILING SUCH ACTION,  THE  PERSON  FILES  WITH  THE  ATTORNEY
 GENERAL  A  WRITTEN  REQUEST  FOR  THE  ATTORNEY GENERAL TO COMMENCE THE
 ACTION.  THE  REQUEST SHALL INCLUDE A CLEAR AND CONCISE STATEMENT OF THE
 GROUNDS FOR BELIEVING A CAUSE OF ACTION EXISTS. THE  PERSON  SHALL  MAKE
 THE  NON-PUBLIC  INFORMATION  AVAILABLE  TO  THE  ATTORNEY  GENERAL UPON
 REQUEST.
   (1) IF THE ATTORNEY GENERAL FILES SUIT WITHIN NINETY DAYS FROM RECEIPT
 OF THE WRITTEN REQUEST TO COMMENCE THE ACTION, NO OTHER  ACTION  MAY  BE
 BROUGHT  UNLESS  THE ACTION BROUGHT BY THE ATTORNEY GENERAL IS DISMISSED
 WITHOUT PREJUDICE.
   (2) IF THE ATTORNEY GENERAL DOES NOT FILE SUIT WITHIN NINETY DAYS FROM
 RECEIPT OF THE WRITTEN  REQUEST  TO  COMMENCE  THE  ACTION,  THE  PERSON
 REQUESTING THE ACTION MAY PROCEED TO FILE A CIVIL ACTION.
   (3)  THE  TIME  PERIOD  WITHIN WHICH A CIVIL ACTION SHALL BE COMMENCED
 SHALL BE TOLLED FROM THE DATE OF RECEIPT BY THE ATTORNEY GENERAL OF  THE
 WRITTEN  REQUEST  TO  EITHER THE DATE THAT THE CIVIL ACTION IS DISMISSED
 WITHOUT PREJUDICE, OR FOR ONE HUNDRED FIFTY DAYS,  WHICHEVER  IS  LATER,
 BUT  ONLY  FOR  A  CIVIL  ACTION BROUGHT BY THE PERSON WHO REQUESTED THE
 ATTORNEY GENERAL TO COMMENCE THE ACTION.
   (B) NOTWITHSTANDING PARAGRAPH (C) OF SUBDIVISION TEN OF THIS  SECTION,
 IF  A  JUDGMENT  IS  ENTERED  AGAINST  THE DEFENDANT OR DEFENDANTS IN AN
 ACTION BROUGHT PURSUANT TO THIS SUBDIVISION, OR THE MATTER  IS  SETTLED,
 AMOUNTS  RECEIVED  AS CIVIL PENALTIES OR PURSUANT TO A SETTLEMENT OF THE
 ACTION SHALL BE ALLOCATED AS FOLLOWS:
   (1) IF THE ACTION WAS BROUGHT BY THE ATTORNEY GENERAL UPON  A  REQUEST
 MADE  BY  A  PERSON  PURSUANT  TO PARAGRAPH (A) OF THIS SUBDIVISION, THE
 PERSON WHO MADE THE REQUEST SHALL BE ENTITLED TO FIFTEEN PERCENT OF  THE
 CIVIL  PENALTIES,  AND  THE REMAINING PROCEEDS SHALL BE DEPOSITED IN THE
 CONSUMER PRIVACY FUND PURSUANT TO SECTION NINETY-NINE-FF  OF  THE  STATE
 FINANCE LAW.
   (2)  IF  THE  ACTION  WAS  BROUGHT  BY THE PERSON WHO MADE THE REQUEST
 PURSUANT TO PARAGRAPH (A) OF THIS SUBDIVISION, THAT PERSON SHALL RECEIVE
 AN AMOUNT THE COURT DETERMINES IS REASONABLE FOR  COLLECTING  THE  CIVIL
 PENALTIES ON BEHALF OF THE GOVERNMENT. THE AMOUNT SHALL BE NOT LESS THAN
 TWENTY-FIVE  PERCENT  AND NOT MORE THAN FIFTY PERCENT OF THE PROCEEDS OF
 THE ACTION AND SHALL BE PAID OUT OF THE PROCEEDS. THE REMAINING PROCEEDS
 SHALL BE DEPOSITED IN THE CONSUMER  PRIVACY  FUND  PURSUANT  TO  SECTION
 NINETY-NINE-FF OF THE STATE FINANCE LAW.
   (C)  FOR  PURPOSES  OF  THIS  SECTION,  "NON-PUBLIC INFORMATION" MEANS
 INFORMATION THAT HAS NOT BEEN DISCLOSED IN A CRIMINAL, CIVIL, OR  ADMIN-
 ISTRATIVE  PROCEEDING,  IN A GOVERNMENT INVESTIGATION, REPORT, OR AUDIT,
 OR BY THE NEWS MEDIA OR OTHER PUBLIC SOURCE OF INFORMATION, AND THAT WAS
 NOT OBTAINED IN VIOLATION OF THE LAW.
   12. A BUSINESS THAT SUFFERS A BREACH OF THE  SECURITY  OF  THE  SYSTEM
 INVOLVING  CONSUMERS'  PERSONAL  INFORMATION  SHALL  BE  DEEMED  TO HAVE
 VIOLATED THIS SECTION AND MAY BE  HELD  LIABLE  FOR  SUCH  VIOLATION  OR
 VIOLATIONS  UNDER  SUBDIVISIONS NINE, TEN AND ELEVEN OF THIS SECTION, IF
 THE BUSINESS HAS FAILED TO IMPLEMENT AND  MAINTAIN  REASONABLE  SECURITY
 PROCEDURES  AND PRACTICES, APPROPRIATE TO THE NATURE OF THE INFORMATION,
 TO PROTECT THE PERSONAL INFORMATION FROM UNAUTHORIZED DISCLOSURE.
   13. THIS SECTION IS INTENDED TO FURTHER THE  CONSTITUTIONAL  RIGHT  OF
 PRIVACY  AND TO SUPPLEMENT EXISTING LAWS RELATING TO CONSUMERS' PERSONAL
 INFORMATION. THE PROVISIONS OF THIS SECTION ARE NOT LIMITED TO  INFORMA-
 TION  COLLECTED  ELECTRONICALLY  OR  OVER THE INTERNET, BUT APPLY TO THE
 COLLECTION AND SALE OF ALL PERSONAL INFORMATION COLLECTED BY A  BUSINESS

 A. 6351                            13
 
 FROM  CONSUMERS.  WHEREVER POSSIBLE, EXISTING LAW RELATING TO CONSUMERS'
 PERSONAL  INFORMATION  SHOULD  BE  CONSTRUED  TO  HARMONIZE   WITH   THE
 PROVISIONS  OF THIS SECTION, BUT IN THE EVENT OF CONFLICT BETWEEN EXIST-
 ING  LAW  AND  THE PROVISIONS OF THIS SECTION, THE PROVISIONS OF THE LAW
 THAT AFFORD THE GREATEST PROTECTION FOR THE RIGHT OF PRIVACY FOR CONSUM-
 ERS SHALL CONTROL.
   14. NOTHING IN THIS SECTION SHALL PREVENT A  CITY,  COUNTY,  CITY  AND
 COUNTY,  MUNICIPALITY,  OR  LOCAL AGENCY FROM SAFEGUARDING THE CONSTITU-
 TIONAL RIGHT OF PRIVACY BY IMPOSING  ADDITIONAL  REQUIREMENTS  ON  BUSI-
 NESSES REGARDING THE COLLECTION AND SALE OF CONSUMERS' PERSONAL INFORMA-
 TION  BY  BUSINESSES  PROVIDED  THAT  THE REQUIREMENT DOES NOT PREVENT A
 PERSON OR BUSINESS FROM COMPLYING WITH THIS SECTION.
   15. (A) THE ATTORNEY GENERAL SHALL ADOPT REGULATIONS IN THE  FOLLOWING
 AREAS TO FURTHER THE PURPOSES OF THIS SECTION:
   (1)  ADDING ADDITIONAL CATEGORIES TO THOSE ENUMERATED IN PARAGRAPH (C)
 OF SUBDIVISION SIX AND PARAGRAPH (M) OF SUBDIVISION ONE OF THIS  SECTION
 IN  ORDER  TO  ADDRESS CHANGES IN TECHNOLOGY, DATA COLLECTION PRACTICES,
 OBSTACLES TO IMPLEMENTATION, AND PRIVACY  CONCERNS.  IN  ADDITION,  UPON
 RECEIPT OF A REQUEST MADE BY A CITY ATTORNEY OR DISTRICT ATTORNEY TO ADD
 A  NEW  CATEGORY  OR CATEGORIES, THE ATTORNEY GENERAL SHALL PROMULGATE A
 REGULATION TO ADD SUCH CATEGORY OR CATEGORIES UNLESS THE ATTORNEY GENER-
 AL CONCLUDES, BASED ON FACTUAL  OR  LEGAL  FINDINGS,  THAT  THERE  IS  A
 COMPELLING  REASON  NOT  TO ADD THE CATEGORY OR CATEGORIES. THE ATTORNEY
 GENERAL MAY ALSO ADD ADDITIONAL CATEGORIES TO THOSE ENUMERATED IN  PARA-
 GRAPH  (C)  OF  SUBDIVISION  SIX AND PARAGRAPH (M) OF SUBDIVISION ONE OF
 THIS SECTION IN RESPONSE TO A PETITION FILED;
   (2) ADDING ADDITIONAL ITEMS TO THE DEFINITION OF "UNIQUE  IDENTIFIERS"
 TO  ADDRESS  CHANGES IN TECHNOLOGY, DATA COLLECTION, OBSTACLES TO IMPLE-
 MENTATION, AND PRIVACY CONCERNS, AND ADDITIONAL CATEGORIES TO THE  DEFI-
 NITION  OF  "DESIGNATED METHODS FOR SUBMITTING REQUESTS" TO FACILITATE A
 CONSUMER'S ABILITY TO OBTAIN INFORMATION FROM  A  BUSINESS  PURSUANT  TO
 SUBDIVISION SIX OF THIS SECTION;
   (3)  ESTABLISHING  ANY  EXCEPTIONS  NECESSARY  TO COMPLY WITH STATE OR
 FEDERAL LAW;
   (4) ESTABLISHING RULES AND PROCEDURES: (A) TO  FACILITATE  AND  GOVERN
 THE SUBMISSION OF A REQUEST BY A CONSUMER, AND BY AN AUTHORIZED AGENT OF
 THE CONSUMER, TO OPT OUT OF THE SALE OF PERSONAL INFORMATION PURSUANT TO
 SUBPARAGRAPH  ONE OF PARAGRAPH (A) OF SUBDIVISION SEVEN OF THIS SECTION;
 (B) TO GOVERN A BUSINESS'S COMPLIANCE WITH A CONSUMER'S OPT OUT REQUEST;
 AND (C) FOR THE DEVELOPMENT AND USE OF A RECOGNIZABLE  AND  UNIFORM  OPT
 OUT  LOGO  OR  BUTTON BY ALL BUSINESSES TO PROMOTE CONSUMER AWARENESS OF
 THE OPPORTUNITY TO OPT OUT OF THE SALE OF PERSONAL INFORMATION;
   (5) ADJUSTING THE MONETARY THRESHOLD IN CLAUSE (A) OF SUBPARAGRAPH ONE
 OF PARAGRAPH (B) OF SUBDIVISION ONE OF THIS SECTION IN JANUARY OF  EVERY
 ODD-NUMBERED YEAR TO REFLECT ANY INCREASE IN THE CONSUMER PRICE INDEX;
   (6)  ESTABLISHING  RULES,  PROCEDURES, AND ANY EXCEPTIONS NECESSARY TO
 ENSURE THAT THE NOTICES AND INFORMATION THAT BUSINESSES ARE REQUIRED  TO
 PROVIDE  PURSUANT  TO  THIS SECTION ARE PROVIDED IN A MANNER SO AS TO BE
 EASILY UNDERSTOOD BY THE AVERAGE CONSUMER, ARE ACCESSIBLE  TO  CONSUMERS
 WITH  DISABILITIES,  AND ARE AVAILABLE IN THE LANGUAGE PRIMARILY USED TO
 INTERACT WITH THE CONSUMER;
   (7) ESTABLISHING RULES AND  PROCEDURES  TO  FURTHER  THE  PURPOSES  OF
 SUBDIVISIONS  TWO  AND THREE OF THIS SECTION AND TO FACILITATE A CONSUM-
 ER'S OR THE CONSUMER'S AUTHORIZED AGENT'S ABILITY TO OBTAIN  INFORMATION
 PURSUANT TO SUBDIVISION SIX OF THIS SECTION, WITH THE GOAL OF MINIMIZING
 THE  ADMINISTRATIVE  BURDEN  ON CONSUMERS, TAKING INTO ACCOUNT AVAILABLE

 A. 6351                            14
 
 TECHNOLOGY, SECURITY CONCERNS, AND THE BURDEN ON THE BUSINESS, TO GOVERN
 A BUSINESS'S DETERMINATION THAT A REQUEST FOR INFORMATION RECEIVED BY  A
 CONSUMER IS A VERIFIABLE REQUEST, INCLUDING TREATING A REQUEST SUBMITTED
 THROUGH A PASSWORD PROTECTED ACCOUNT MAINTAINED BY THE CONSUMER WITH THE
 BUSINESS  WHILE  THE CONSUMER IS LOGGED INTO THE ACCOUNT AS A VERIFIABLE
 REQUEST AND PROVIDING A MECHANISM FOR A CONSUMER WHO DOES  NOT  MAINTAIN
 AN  ACCOUNT  WITH  THE BUSINESS TO REQUEST INFORMATION THROUGH THE BUSI-
 NESS'S AUTHENTICATION OF THE CONSUMER'S IDENTITY;
   (8) DEFINING THE TERM "VALUABLE CONSIDERATION" AS USED IN SUBPARAGRAPH
 ONE OF PARAGRAPH (Q) OF SUBDIVISION ONE OF THIS SECTION TO ENSURE THAT A
 BUSINESS THAT DISCLOSES, EXCEPT AS PERMITTED BY THIS SECTION, A  CONSUM-
 ER'S  PERSONAL  INFORMATION TO A THIRD PARTY, INCLUDING THROUGH A SERIES
 OF TRANSACTIONS INVOLVING MULTIPLE THIRD PARTIES, IN  EXCHANGE  FOR  ANY
 ECONOMIC  BENEFIT  IS  SUBJECT  TO THIS SECTION, AND TO INCLUDE BUSINESS
 PRACTICES INVOLVING THE DISCLOSURE OF PERSONAL INFORMATION  IN  EXCHANGE
 FOR  SOMETHING  OF  VALUE.  VALUABLE  CONSIDERATION DOES NOT INCLUDE THE
 EXCHANGE OF VALUE IN A TRANSACTION INVOLVING NON-COMMERCIAL SPEECH, SUCH
 AS JOURNALISM AND POLITICAL SPEECH; AND
   (9)  FURTHER  INTERPRET  THE  TERMS  "DE-IDENTIFIED",  "SELL",  "THIRD
 PARTY",  AND  "BUSINESS PURPOSE" AS SET FORTH IN SUBDIVISION ONE OF THIS
 SECTION, TO ADDRESS CHANGES IN TECHNOLOGY, DATA COLLECTION, OBSTACLES TO
 IMPLEMENTATION, AND PRIVACY CONCERNS AND TO ENSURE COMPLIANCE  WITH  THE
 PURPOSES  OF  THIS SECTION, PROVIDED THAT SUCH REGULATIONS DO NOT REDUCE
 CONSUMER PRIVACY OR THE ABILITY OF CONSUMERS TO STOP THE SALE  OF  THEIR
 PERSONAL INFORMATION.
   (B)  THE ATTORNEY GENERAL SHALL BE PRECLUDED FROM ADOPTING REGULATIONS
 THAT LIMIT OR REDUCE THE NUMBER  OR  SCOPE  OF  CATEGORIES  OF  PERSONAL
 INFORMATION ENUMERATED IN PARAGRAPH (C) OF SUBDIVISION SIX AND PARAGRAPH
 (M)  OF  SUBDIVISION  ONE  OF  THIS SECTION, OR THAT LIMIT OR REDUCE THE
 NUMBER OR SCOPE OF CATEGORIES ADDED  PURSUANT  TO  SUBPARAGRAPH  ONE  OF
 PARAGRAPH  (A)  OF  THIS SUBDIVISION, EXCEPT AS NECESSARY TO COMPLY WITH
 SUBPARAGRAPH THREE OF PARAGRAPH (A) OF THIS  SUBDIVISION.  THE  ATTORNEY
 GENERAL  SHALL  ALSO  BE  PRECLUDED FROM REDUCING THE SCOPE OF THE DEFI-
 NITION OF "UNIQUE IDENTIFIERS",  EXCEPT  AS  NECESSARY  TO  COMPLY  WITH
 SUBPARAGRAPH THREE OF PARAGRAPH (A) OF THIS SUBDIVISION.
   (C) TO THE EXTENT THE ATTORNEY GENERAL DETERMINES THAT IT IS NECESSARY
 TO  ADOPT  CERTAIN  REGULATIONS  IN ORDER TO IMPLEMENT THIS SECTION, THE
 ATTORNEY GENERAL SHALL ADOPT ANY SUCH REGULATIONS WITHIN SIX  MONTHS  OF
 THE DATE THIS SECTION IS ADOPTED.
   (D) THE ATTORNEY GENERAL MAY ADOPT ADDITIONAL REGULATIONS AS NECESSARY
 TO FURTHER THE PURPOSES OF THIS SECTION.
   16.  IF  A  SERIES  OF STEPS OR TRANSACTIONS WERE COMPONENT PARTS OF A
 SINGLE TRANSACTION INTENDED FROM THE BEGINNING  TO  BE  TAKEN  WITH  THE
 INTENTION  OF  AVOIDING THE REACH OF THIS SECTION, INCLUDING THE DISCLO-
 SURE OF INFORMATION BY A BUSINESS TO A THIRD PARTY IN ORDER TO AVOID THE
 DEFINITION OF "SELL", A COURT SHALL DISREGARD THE INTERMEDIATE STEPS  OR
 TRANSACTIONS FOR PURPOSES OF EFFECTUATING THE PURPOSES OF THIS SECTION.
   17. ANY PROVISION OF A CONTRACT OR AGREEMENT OF ANY KIND THAT PURPORTS
 TO  WAIVE  OR  LIMIT  IN ANY WAY A CONSUMER'S RIGHTS UNDER THIS SECTION,
 INCLUDING BUT NOT LIMITED TO ANY RIGHT TO A REMEDY OR MEANS OF  ENFORCE-
 MENT,  SHALL  BE  DEEMED CONTRARY TO PUBLIC POLICY AND SHALL BE VOID AND
 UNENFORCEABLE. THIS SECTION SHALL NOT PREVENT A CONSUMER FROM:   DECLIN-
 ING  TO  REQUEST  INFORMATION FROM A BUSINESS; DECLINING TO OPT OUT OF A
 BUSINESS'S SALE OF THE CONSUMER'S PERSONAL INFORMATION; OR AUTHORIZING A
 BUSINESS TO SELL THE CONSUMER'S PERSONAL  INFORMATION  AFTER  PREVIOUSLY
 OPTING OUT.

 A. 6351                            15
 
   18. IF ANY PROVISION OF THIS SECTION SHALL BE ADJUDGED BY ANY COURT OF
 COMPETENT  JURISDICTION  TO  BE INVALID, SUCH JUDGMENT SHALL NOT AFFECT,
 IMPAIR OR INVALIDATE THE REMAINDER THEREOF, BUT SHALL BE CONFINED IN ITS
 OPERATION TO THE PROVISION DIRECTLY INVOLVED IN THE CONTROVERSY IN WHICH
 SUCH JUDGMENT SHALL HAVE BEEN RENDERED.
   § 3. The state finance law is amended by adding a new section 99-ff to
 read as follows:
   §  99-FF. CONSUMER PRIVACY FUND. 1. THERE IS HEREBY ESTABLISHED IN THE
 JOINT CUSTODY OF THE STATE COMPTROLLER AND THE COMMISSIONER OF  TAXATION
 AND  FINANCE  AN  ACCOUNT  WITHIN  THE  GENERAL  FUND TO BE KNOWN AS THE
 "CONSUMER PRIVACY FUND".
   2. SUCH ACCOUNT SHALL CONSIST OF ALL PENALTIES RECEIVED BY THE DEPART-
 MENT OF STATE PURSUANT TO SECTION EIGHT HUNDRED  NINETY-NINE-BB  OF  THE
 GENERAL BUSINESS LAW AND ANY ADDITIONAL MONIES APPROPRIATED, CREDITED OR
 TRANSFERRED  TO  SUCH ACCOUNT BY THE LEGISLATURE. ANY INTEREST EARNED BY
 THE INVESTMENT OF MONIES IN SUCH ACCOUNT SHALL BE ADDED TO SUCH ACCOUNT,
 BECOME PART OF SUCH ACCOUNT, AND  BE  USED  FOR  THE  PURPOSES  OF  SUCH
 ACCOUNT.
   3.  MONIES  IN  THE  ACCOUNT SHALL BE AVAILABLE TO THE OFFICE OF COURT
 ADMINISTRATION AND THE ATTORNEY GENERAL TO OFFSET ANY COSTS INCURRED  BY
 THE  STATE  COURTS IN CONNECTION WITH ACTIONS BROUGHT TO ENFORCE SECTION
 EIGHT HUNDRED NINETY-NINE-BB OF THE GENERAL BUSINESS LAW AND  ANY  COSTS
 INCURRED BY THE ATTORNEY GENERAL IN CARRYING OUT HIS OR HER DUTIES UNDER
 SUCH SECTION OF LAW.
   4. MONIES IN THE ACCOUNT SHALL BE PAID OUT OF THE ACCOUNT ON THE AUDIT
 AND  WARRANT  OF THE STATE COMPTROLLER ON VOUCHERS CERTIFIED OR APPROVED
 BY THE OFFICE OF COURT ADMINISTRATION AND/OR THE ATTORNEY GENERAL.
   § 4. This act shall take effect on the one hundred eightieth day after
 it shall have become a law. Effective immediately, the addition,  amend-
 ment and/or repeal of any rule or regulation necessary for the implemen-
 tation  of this act on its effective date are authorized and directed to
 be made and completed on or before such effective date.