S T A T E O F N E W Y O R K
________________________________________________________________________
S. 4044 A. 3051
2023-2024 Regular Sessions
S E N A T E - A S S E M B L Y
February 2, 2023
___________
IN SENATE -- Introduced by Sen. GONZALEZ -- read twice and ordered
printed, and when printed to be committed to the Committee on Investi-
gations and Government Operations
IN ASSEMBLY -- Introduced by M. of A. EPSTEIN -- read once and referred
to the Committee on Governmental Operations
AN ACT to amend the public officers law, in relation to disclosing
personal information
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Section 92 of the public officers law, as added by chapter
652 of the laws of 1983, subdivision 8 as amended by section 135 of
subpart B of part C of chapter 62 of the laws of 2011 and the opening
paragraph of subdivision 9 as amended by chapter 313 of the laws of
1991, is amended to read as follows:
§ 92. Definitions. (1) Agency. The term "agency" [means any state
board, bureau, committee, commission, council, department, public
authority, public benefit corporation, division, office or any other
governmental entity performing a governmental or proprietary function
for the state of New York, except the judiciary or the state legislature
or any unit of local government and shall not include offices of
district attorneys] SHALL HAVE THE SAME MEANING AS IN SUBDIVISION THREE
OF SECTION EIGHTY-SIX OF THIS CHAPTER.
(2) Committee. The term "committee" means the committee on open
government as constituted pursuant to subdivision one of section eight-
y-nine of this chapter.
(3) Data subject. The term "data subject" means any natural person
about whom personal information has been collected by an agency.
(4) Disclose. The term "disclose" means to reveal, release, transfer,
disseminate or otherwise communicate personal information or records
orally, in writing or by electronic or any other means other than to the
data subject.
(5) 911 SERVICES DISPATCHER. THE TERM "911 SERVICES DISPATCHER" MEANS
A PERSON WHO RECEIVES REPORTS OF EMERGENCIES VIA A 911 SYSTEM OR E911
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04764-01-3
S. 4044 2 A. 3051
SYSTEM AS DEFINED IN SUBDIVISION THREE OF SECTION THREE HUNDRED ONE OF
THE COUNTY LAW.
(6) EMERGENCY MEDICAL SERVICES PERSONNEL. THE TERM "EMERGENCY MEDICAL
SERVICES PERSONNEL" MEANS INDIVIDUALS DESIGNATED AS SUCH IN SUBDIVISION
FIVE OF SECTION TWENTY-NINE HUNDRED NINETY-FOUR-AA OF THE PUBLIC HEALTH
LAW.
(7) Governmental unit. The term "governmental unit" means any govern-
mental entity performing a governmental or proprietary function for the
federal government or for any state or any municipality thereof.
[(6)] (8) Law. The term "law" means state or federal statute, rule or
regulation.
(9) LAW ENFORCEMENT AGENCY. THE TERM "LAW ENFORCEMENT AGENCY" SHALL
HAVE THE SAME MEANING AS IN SUBDIVISION FOUR OF SECTION 705.00 OF THE
CRIMINAL PROCEDURE LAW.
(10) LAW ENFORCEMENT OFFICER. THE TERM "LAW ENFORCEMENT OFFICER" MEANS
A POLICE OFFICER OR PEACE OFFICER AS DEFINED IN SECTION 1.20 OF THE
CRIMINAL PROCEDURE LAW.
[(7)] (11) Personal information. The term "personal information" means
any information concerning a data subject which, because of name,
number, symbol, mark or other identifier, ALONE OR IN COMBINATION WITH
OTHER INFORMATION, can be used to identify that data subject OR BE ASSO-
CIATED WITH AN IDENTIFIED DATA SUBJECT.
[(8) Public safety agency record. The term "public safety agency
record" means a record of the state commission of correction, the tempo-
rary state commission of investigation, the department of corrections
and community supervision, the office of children and family services,
the office of victim services, the office of probation and correctional
alternatives or the division of state police or of any agency or compo-
nent thereof whose primary function is the enforcement of civil or crim-
inal statutes if such record pertains to investigation, law enforcement,
confinement of persons in correctional facilities or supervision of
persons pursuant to criminal conviction or court order, and any records
maintained by the division of criminal justice services pursuant to
sections eight hundred thirty-seven, eight hundred thirty-seven-a, eight
hundred thirty-seven-b, eight hundred thirty-seven-c, eight hundred
thirty-eight, eight hundred thirty-nine, and eight hundred forty-five of
the executive law and by the department of state pursuant to section
ninety-nine of the executive law.
(9)] (12) Record. The term "record" means any item, collection or
grouping of personal information about a data subject which is main-
tained and is retrievable by use of the name or other identifier of the
data subject irrespective of the physical form or technology used to
maintain such personal information. The term "record" shall not include
personal information which is not used to make any determination about
the data subject if it is:
(a) a telephone book or directory which is used exclusively for tele-
phone and directory information;
(b) any card catalog, book or other resource material in any library;
(c) any compilation of information containing names and addresses only
which is used exclusively for the purpose of mailing agency information;
(d) personal information required by law to be maintained, and
required by law to be used, only for statistical research or reporting
purposes;
(e) information requested by the agency which is necessary for the
agency to answer unsolicited requests by the data subject for informa-
tion; or
S. 4044 3 A. 3051
(f) correspondence files.
[(10)] (13) Routine use. The term "routine use" means, with respect to
the disclosure of a record or personal information, any use of such
record or personal information relevant to the purpose for which it was
collected, and which use is necessary to the statutory duties of the
agency that collected or obtained the record or personal information, or
necessary for that agency to operate a program specifically authorized
by law.
[(11)] (14) System of records. The term "system of records" means any
group of records under the actual or constructive control of any agency
pertaining to one or more data subjects from which personal information
is retrievable by use of the name or other identifier of a data subject.
§ 2. The opening paragraph of subdivision 3 of section 94 of the
public officers law, as added by chapter 652 of the laws of 1983, is
amended to read as follows:
Each agency, for disclosures made pursuant to paragraphs (d)[,] AND
(i) [and (l)] of subdivision one of section ninety-six of this article,
except for disclosures made for inclusion in public safety agency
records when such record is requested for the purpose of obtaining
information required for the investigation of a violation of civil or
criminal statutes within the disclosing agency, shall:
§ 3. Section 96 of the public officers law, as added by chapter 652 of
the laws of 1983, paragraph (j) of subdivision 1 as amended by chapter
1015 of the laws of 1984, paragraph (n) of subdivision 1 as amended by
chapter 319 of the laws of 2014, paragraphs (o) and (p) of subdivision 1
as amended by section one of part S of chapter 58 of the laws of 2022,
and paragraph (c) of subdivision 2 as amended by chapter 322 of the laws
of 2021, is amended to read as follows:
§ 96. Disclosure of records. (1) No agency may disclose any record or
personal information unless such disclosure is:
(a) pursuant to a written request by or the voluntary written consent
of the data subject, provided that such request or consent by its terms
limits and specifically describes:
(i) the personal information which is requested to be disclosed;
(ii) the person or entity to whom such personal information is
requested to be disclosed; and
(iii) the uses which will be made of such personal information by the
person or entity receiving it; or
(b) to those officers and employees of, and to those who contract
with, the agency that maintains the record if such disclosure is neces-
sary to the performance of their official duties pursuant to a purpose
of the agency required to be accomplished by statute or executive order
or necessary to operate a program specifically authorized by law; or
(c) subject to disclosure under article six of this chapter, unless
disclosure of such information would constitute an unwarranted invasion
of personal privacy as defined in paragraph (a) of subdivision two of
section eighty-nine of this chapter; or
(d) to officers or employees of another governmental unit if each
category of information sought to be disclosed is necessary for the
receiving governmental unit to operate a program specifically authorized
by statute [and if], the use for which the information is requested is
not relevant to the purpose for which it was collected; or
(e) for a routine use, as defined in subdivision [ten] THIRTEEN of
section ninety-two of this article; or
(f) specifically authorized by statute or federal rule or regulation;
or
S. 4044 4 A. 3051
(g) to the bureau of the census for purposes of planning or carrying
out a census or survey or related activity pursuant to the provisions of
Title XIII of the United States Code; or
(h) to a person who has provided the agency with advance written
assurance that the record will be used solely for the purpose of statis-
tical research or reporting, but only if it is to be transferred in a
form that does not reveal the identity of any data subject; or
(i) pursuant to a showing of compelling circumstances affecting the
health or safety of a data subject, if upon such disclosure notification
is transmitted to the data subject at [his or her] THEIR last known
address; or
(j) to the state archives as a record which has sufficient historical
or other value to warrant its continued preservation by the state or for
evaluation by the state archivist or [his or her] THEIR designee to
determine whether the record has such value; or
(k) to any person pursuant to a court ordered subpoena or other
compulsory legal process; or
(l) [for inclusion in a public safety agency record or to any govern-
mental unit or component thereof which performs as one of its principal
functions any activity pertaining to the enforcement of criminal laws,
provided that, such record is reasonably described and is requested
solely for a law enforcement function; or
(m)] pursuant to a search warrant; or
[(n)] (M) to officers or employees of another agency if the record
sought to be disclosed is necessary for the receiving agency to comply
with the mandate of an executive order, but only if such records are to
be used only for statistical research, evaluation or reporting and are
not used in making any determination about a data subject; or
[(o)] (N) to officers or employees of a public retirement system of
the city of New York if the information sought to be disclosed is neces-
sary for the receiving public retirement system to process benefits
under the retirement and social security law, the administrative code of
the city of New York, or the education law or any other applicable
provision of law. A written request or consent from the data subject
pursuant to paragraph (a) of this subdivision shall not be required for
the disclosure of records pursuant to this paragraph; or
[(p)] (O) to officers or employees of the United States department of
education for such department to process credit for qualifying employ-
ment and loan forgiveness under the public service loan forgiveness
program. A written request or consent from the data subject pursuant to
paragraph (a) of this subdivision shall not be required for the disclo-
sure of records pursuant to this paragraph; OR
(P) NECESSARY TO PREVENT AN IMMEDIATE AND SUBSTANTIAL RISK OF DEATH,
SIGNIFICANT BODILY HARM, SIGNIFICANT DAMAGE TO PROPERTY, OR IS OTHERWISE
NECESSARY TO RESPOND TO AN IMMEDIATE EMERGENCY; OR
(Q) DISCLOSED BY A 911 SERVICE DISPATCHER IN THE COURSE OF RESPONDING
TO AN EMERGENCY REPORTED VIA A 911 SYSTEM OR E911 SYSTEM TO EMERGENCY
MEDICAL SERVICES PERSONNEL, LAW ENFORCEMENT OFFICERS, OR OTHERS RESPON-
SIBLE FOR PROVIDING ASSISTANCE AT THE SCENE OF AN EMERGENCY; OR
(R) TO LICENSING OFFICERS OF NEW YORK STATE, AS DEFINED IN SUBDIVISION
TEN OF SECTION 265.00 OF THE PENAL LAW, FOR SUCH OFFICERS TO ISSUE
FIREARM LICENSES PURSUANT TO SECTION 400.00 OF THE PENAL LAW.
(2) NOTWITHSTANDING SUBDIVISION ONE OF THIS SECTION, NO AGENCY MAY
DISCLOSE ANY RECORD OR PERSONAL INFORMATION TO A LAW ENFORCEMENT AGENCY
OR LAW ENFORCEMENT OFFICER UNLESS SUCH DISCLOSURE IS PURSUANT TO PARA-
GRAPHS (L), (P), (Q), OR (R) OF SUBDIVISION ONE OF THIS SECTION.
S. 4044 5 A. 3051
(3) Nothing in this section shall require disclosure of[:
(a) personal information which is otherwise prohibited by law from
being disclosed;
(b) patient records concerning mental disability or medical records
where such disclosure is not otherwise required by law;
(c) personal information pertaining to the incarceration of an incar-
cerated individual at a state correctional facility which is evaluative
in nature or which, if disclosed, could endanger the life or safety of
any person, unless such disclosure is otherwise permitted by law;
(d) attorney's work product or material prepared for litigation before
judicial, quasi-judicial or administrative tribunals, as described in
subdivisions (c) and (d) of section three thousand one hundred one of
the civil practice law and rules, except pursuant to statute, subpoena
issued in the course of a criminal action or proceeding, court ordered
or grand jury subpoena, search warrant or other court ordered disclo-
sure] ANY RECORD OR PERSONAL INFORMATION OR EXPAND AN AGENCY'S OR
GOVERNMENTAL UNIT'S ABILITY TO DISCLOSE ANY RECORD OR PERSONAL INFORMA-
TION.
§ 4. Section 97 of the public officers law, as added by chapter 652 of
the laws of 1983, is amended to read as follows:
§ 97. [Civil remedies] REMEDIES. (1) Any data subject aggrieved by
any action taken under this article may seek judicial review and relief
pursuant to article seventy-eight of the civil practice law and rules.
(2) IN ANY ACTION BROUGHT UNDER SUBDIVISION ONE OF THIS SECTION, THE
PLAINTIFF MAY SEEK:
(A) ONE THOUSAND DOLLARS PER VIOLATION OR ACTUAL DAMAGES, WHICHEVER IS
GREATER; AND
(B) PUNITIVE DAMAGES; AND
(C) ANY OTHER RELIEF THE COURT DEEMS PROPER.
(3) IN ASSESSING THE AMOUNT OF PUNITIVE DAMAGES AWARDED TO A PLAINTIFF
IN AN ACTION BROUGHT UNDER SUBDIVISION ONE OF THIS SECTION, THE COURT
SHALL CONSIDER:
(A) THE DEFENDANT'S PATTERN OF VIOLATIONS OF THIS ARTICLE; AND
(B) THE IMPACT OF THE VIOLATION ON THE DATA SUBJECT'S EXERCISE OF
CONSTITUTIONAL AND STATUTORY RIGHTS, INCLUDING, BUT NOT LIMITED TO,
RELIGION, POLITICAL VIEWS, AND MEDICAL CARE.
(4) In any proceeding brought under subdivision one of this section,
the party defending the action shall bear the burden of proof, and the
court [may] SHALL, if the data subject [substantially] prevails against
any agency [and if the agency lacked a reasonable basis pursuant to this
article for the challenged action], award to the data subject reasonable
attorneys' fees and disbursements reasonably incurred.
(5) ANY INFORMATION DISCLOSED TO A LAW ENFORCEMENT AGENCY IN VIOLATION
OF THIS ARTICLE SHALL BE INADMISSIBLE AGAINST THE DATA SUBJECT IN A
CRIMINAL OR CIVIL COURT, OR ADMINISTRATIVE PROCEEDING.
[(3)] (6) Nothing in this article shall be construed to limit or
abridge the right of any person to obtain judicial review or pecuniary
or other relief, in any other form or upon any other basis, otherwise
available to a person aggrieved by any agency action under this article.
§ 5. This act shall take effect immediately.