S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                    733
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                                (PREFILED)
 
                              January 6, 2021
                                ___________
 
 Introduced  by  M.  of  A. L. ROSENTHAL -- read once and referred to the
   Committee on Consumer Affairs and Protection
 
 AN ACT to amend the general business law,  in  relation  to  collection,
   storage  or  transmission of personal information collected from smart
   home systems

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 390-d to read as follows:
   §  390-D.  SMART HOME SYSTEMS. 1. FOR THE PURPOSES OF THIS SECTION THE
 FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A) "SMART HOME SYSTEM" MEANS ANY DEVICE,  OR  OTHER  PHYSICAL  OBJECT
 THAT  IS  CAPABLE OF CONNECTING TO THE INTERNET, DIRECTLY OR INDIRECTLY,
 AND THAT IS ASSIGNED AN INTERNET PROTOCOL ADDRESS OR BLUETOOTH ADDRESS.
   (B) "END USER" MEANS A  PERSON  THAT  ULTIMATELY  USES  A  SMART  HOME
 CONNECTED  SYSTEM  REGARDLESS  OF  WHETHER  SUCH  PERSON  INSTALLED SUCH
 SYSTEM.
   (C) "PERSONAL INFORMATION"  INCLUDES,  BUT  IS  NOT  LIMITED  TO,  THE
 FOLLOWING:
   (I)  IDENTITY  INFORMATION  INCLUDING,  BUT NOT LIMITED TO, REAL NAME,
 ALIAS, NICKNAME, AND USER NAME;
   (II) ADDRESS  INFORMATION,  INCLUDING,  BUT  NOT  LIMITED  TO,  POSTAL
 ADDRESS OR E-MAIL;
   (III) TELEPHONE NUMBER;
   (IV) ACCOUNT NAME;
   (V)  SOCIAL  SECURITY NUMBER OR OTHER GOVERNMENT-ISSUED IDENTIFICATION
 NUMBER, INCLUDING, BUT NOT LIMITED TO, SOCIAL SECURITY NUMBER,  DRIVER'S
 LICENSE NUMBER, IDENTIFICATION CARD NUMBER, AND PASSPORT NUMBER;
   (VI) BIRTHDATE OR AGE;
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD00550-01-1

 A. 733                              2
 
   (VII)  PHYSICAL CHARACTERISTIC INFORMATION, INCLUDING, BUT NOT LIMITED
 TO, HEIGHT AND WEIGHT;
   (VIII)  SEXUAL  INFORMATION,  INCLUDING,  BUT  NOT  LIMITED TO, SEXUAL
 ORIENTATION, SEX, GENDER STATUS, GENDER IDENTITY, AND GENDER EXPRESSION;
   (IX) RACE OR ETHNICITY;
   (X) RELIGIOUS AFFILIATION OR ACTIVITY;
   (XI) POLITICAL AFFILIATION OR ACTIVITY;
   (XII) PROFESSIONAL OR EMPLOYMENT-RELATED INFORMATION;
   (XIII) EDUCATIONAL INFORMATION;
   (XIV) MEDICAL INFORMATION, INCLUDING,  BUT  NOT  LIMITED  TO,  MEDICAL
 CONDITIONS  OR  DRUGS,  THERAPIES, MENTAL HEALTH, OR MEDICAL PRODUCTS OR
 EQUIPMENT USED;
   (XV) FINANCIAL INFORMATION, INCLUDING, BUT  NOT  LIMITED  TO,  CREDIT,
 DEBIT,  OR ACCOUNT NUMBERS, ACCOUNT BALANCES, PAYMENT HISTORY, OR INFOR-
 MATION RELATED TO ASSETS, LIABILITIES, OR GENERAL CREDITWORTHINESS;
   (XVI) COMMERCIAL INFORMATION, INCLUDING, BUT NOT LIMITED  TO,  RECORDS
 OF  PROPERTY, PRODUCTS OR SERVICES PROVIDED, OBTAINED, OR CONSIDERED, OR
 OTHER PURCHASING OR CONSUMER HISTORIES OR TENDENCIES;
   (XVII) LOCATION INFORMATION;
   (XVIII) INTERNET OR MOBILE ACTIVITY INFORMATION,  INCLUDING,  BUT  NOT
 LIMITED  TO,  INTERNET  PROTOCOL ADDRESSES OR INFORMATION CONCERNING THE
 ACCESS OR USE OF ANY INTERNET OR MOBILE-BASED SITE OR SERVICE;
   (XIX) CONTENT, INCLUDING TEXT, PHOTOGRAPHS, AUDIO OR VIDEO RECORDINGS,
 OR OTHER MATERIAL GENERATED BY OR PROVIDED BY AN END USER; AND
   (XX) ANY OF THE ABOVE CATEGORIES OF INFORMATION AS THEY PERTAIN TO ANY
 CHILDREN OF AN END USER.
   2. (A) NO BUSINESS WHICH MANUFACTURES OR SELLS A SMART HOME  CONNECTED
 SYSTEM  SHALL  COLLECT,  STORE  OR  TRANSMIT  ANY  PERSONAL  INFORMATION
 OBTAINED FROM THE INSTALLATION OR USE OF A SMART HOME  CONNECTED  SYSTEM
 TO  A THIRD-PARTY WITHOUT THE EXPRESS AND AFFIRMATIVE CONSENT OF THE END
 USER OF SUCH SYSTEM.
   (B) NO LANDLORD WHO HAS INSTALLED A SMART HOME CONNECTED SYSTEM ON  OR
 IN  RENTAL PROPERTY SHALL COLLECT, STORE OR TRANSMIT ANY PERSONAL INFOR-
 MATION OBTAINED  FROM  THE  INSTALLATION  OR  USE  OF  SUCH  SMART  HOME
 CONNECTED  SYSTEM  WITHOUT  THE  EXPRESS  AND AFFIRMATIVE CONSENT OF THE
 TENANT OF SUCH RENTAL PROPERTY.
   (C) NO EMPLOYER WHO HAS INSTALLED A SMART HOME CONNECTED SYSTEM  SHALL
 COLLECT,  STORE  OR  TRANSMIT  ANY  PERSONAL INFORMATION OF ANY EMPLOYEE
 OBTAINED FROM THE INSTALLATION OR  USE  OF  SUCH  SMART  HOME  CONNECTED
 SYSTEM WITHOUT THE EXPRESS AND AFFIRMATIVE CONSENT OF SUCH EMPLOYEE.
   § 2. This act shall take effect immediately.