S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   4367
 
                        2023-2024 Regular Sessions
 
                             I N  S E N A T E
 
                             February 7, 2023
                                ___________
 
 Introduced by Sen. FERNANDEZ -- read twice and ordered printed, and when
   printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general business law, in relation to prohibiting the
   disclosure  of  personally  identifiable  information  by  an internet
   service provider without the express written approval of the consumer

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-k to read as follows:
   §  399-K.  DISCLOSURE  OF  PERSONALLY  IDENTIFIABLE  INFORMATION BY AN
 INTERNET SERVICE PROVIDER; PROHIBITED.  1.  FOR  THE  PURPOSES  OF  THIS
 SECTION THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEANINGS:
   (A)  "CONSUMER"  MEANS A PERSON WHO AGREES TO PAY A FEE TO AN INTERNET
 SERVICE PROVIDER FOR ACCESS TO THE INTERNET  FOR  PERSONAL,  FAMILY,  OR
 HOUSEHOLD PURPOSES, AND WHO DOES NOT RESELL ACCESS.
   (B) "INTERNET SERVICE PROVIDER" (ISP) MEANS A BUSINESS ENTITY OR INDI-
 VIDUAL  WHO  PROVIDES CONSUMERS AUTHENTICATED ACCESS TO, OR PRESENCE ON,
 THE INTERNET BY MEANS OF  A  SWITCHED  OR  DEDICATED  TELECOMMUNICATIONS
 CHANNEL  UPON  WHICH  THE  PROVIDER PROVIDES TRANSIT ROUTING OF INTERNET
 PROTOCOL PACKETS FOR AND ON BEHALF OF  THE  CONSUMER.  INTERNET  SERVICE
 PROVIDER  DOES  NOT  INCLUDE THE OFFERING, ON A COMMON CARRIER BASIS, OF
 TELECOMMUNICATIONS FACILITIES OR OF TELECOMMUNICATIONS BY MEANS OF THESE
 FACILITIES.
   (C) "PERSONALLY IDENTIFIABLE INFORMATION" MEANS INFORMATION THAT IDEN-
 TIFIES:
   (I) A CONSUMER BY PHYSICAL OR ELECTRONIC ADDRESS OR TELEPHONE NUMBER;
   (II) A CONSUMER'S INTERNET SEARCH HISTORY OR INTERNET  USAGE  HISTORY;
 OR
   (III) ANY OF THE CONTENTS OF A CONSUMER'S DATA-STORAGE DEVICES.
   2.  EXCEPT AS PROVIDED IN SUBDIVISIONS THREE AND FOUR OF THIS SECTION,
 AN ISP SHALL NOT KNOWINGLY DISCLOSE PERSONALLY IDENTIFIABLE  INFORMATION
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD00871-01-3
              

 S. 4367                             2
 
 RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS OR ISP WITH-
 OUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER.
   (A)  A  TELECOMMUNICATIONS  OR  ISP  THAT HAS ENTERED INTO A FRANCHISE
 AGREEMENT, RIGHT-OF-WAY AGREEMENT, OR OTHER CONTRACT WITH THE  STATE  OF
 NEW  YORK  OR ANY POLITICAL SUBDIVISION THEREOF, OR THAT USES FACILITIES
 THAT ARE SUBJECT TO SUCH AGREEMENTS, EVEN IF IT IS NOT A  PARTY  TO  THE
 AGREEMENT,  SHALL  NOT  COLLECT NOR DISCLOSE PERSONAL INFORMATION FROM A
 CONSUMER RESULTING FROM THE CONSUMER'S USE OF THE TELECOMMUNICATIONS  OR
 ISP WITHOUT EXPRESS WRITTEN APPROVAL FROM THE CONSUMER; AND
   (B)  NO  SUCH  TELECOMMUNICATION  OR  ISP  SHALL REFUSE TO PROVIDE ITS
 SERVICES TO A CONSUMER ON THE GROUNDS THAT THE CONSUMER HAS NOT APPROVED
 THE COLLECTION OR DISCLOSURE OF THE CONSUMER'S PERSONAL INFORMATION.
   3. AN ISP MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION  CONCERNING
 A CONSUMER:
   (A)  PURSUANT TO A GRAND JURY SUBPOENA, IN ACCORDANCE WITH SUBDIVISION
 EIGHT OF SECTION 190.30 OF THE CRIMINAL PROCEDURE LAW;
   (B) PURSUANT TO A  WARRANT  ISSUED  IN  ACCORDANCE  WITH  ARTICLE  SIX
 HUNDRED NINETY OR ARTICLE SEVEN HUNDRED OF THE CRIMINAL PROCEDURE LAW;
   (C)  PURSUANT TO A COURT ORDER IN A PENDING CRIMINAL PROCEEDING UPON A
 SHOWING THAT SUCH PERSONALLY IDENTIFIABLE INFORMATION  IS  RELEVANT  AND
 MATERIAL TO SUCH CRIMINAL ACTION OR PROCEEDING;
   (D)  PURSUANT  TO  A  COURT ORDER IN A PENDING CIVIL PROCEEDING UPON A
 SHOWING OF COMPELLING NEED FOR SUCH INFORMATION THAT CANNOT BE  ACCOMMO-
 DATED BY OTHER MEANS;
   (E)  TO  A COURT IN A CIVIL ACTION FOR CONVERSION COMMENCED BY THE ISP
 OR IN A CIVIL ACTION TO ENFORCE COLLECTION OF UNPAID  SUBSCRIPTION  FEES
 OR  PURCHASE AMOUNTS, AND THEN ONLY TO THE EXTENT NECESSARY TO ESTABLISH
 THE FACT OF THE SUBSCRIPTION DELINQUENCY OR PURCHASE AGREEMENT, AND WITH
 APPROPRIATE SAFEGUARDS AGAINST UNAUTHORIZED DISCLOSURE;
   (F) TO THE CONSUMER WHO IS THE SUBJECT OF THE INFORMATION, UPON  WRIT-
 TEN  OR ELECTRONIC REQUEST AND UPON PAYMENT OF ANY FEE NOT TO EXCEED THE
 ACTUAL COST OF RETRIEVING THE INFORMATION;
   (G) TO ANOTHER ISP FOR PURPOSES OF REPORTING OR PREVENTING  VIOLATIONS
 OF  THE PUBLISHED ACCEPTABLE USE POLICY OR CONSUMER SERVICE AGREEMENT OF
 THE ISP; EXCEPT THAT THE RECIPIENT MAY FURTHER DISCLOSE  THE  PERSONALLY
 IDENTIFIABLE INFORMATION ONLY AS PROVIDED BY THIS CHAPTER; OR
   (H) TO ANY PERSON WITH THE AUTHORIZATION OF THE CONSUMER.
   4.  (A)  THE  ISP  SHALL  OBTAIN  THE CONSUMER'S AUTHORIZATION FOR THE
 DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION IN WRITING OR BY ELEC-
 TRONIC MEANS.
   (B) THE REQUEST FOR AUTHORIZATION MUST REASONABLY DESCRIBE  THE  TYPES
 OF  PERSONS TO WHOM PERSONALLY IDENTIFIABLE INFORMATION MAY BE DISCLOSED
 AND THE ANTICIPATED USES OF THE INFORMATION.
   (C) IN ORDER FOR AN AUTHORIZATION TO BE EFFECTIVE, A CONTRACT  BETWEEN
 AN  ISP  AND  THE  CONSUMER  MUST  STATE  THAT THE AUTHORIZATION WILL BE
 OBTAINED BY AN AFFIRMATIVE ACT OF THE CONSUMER.
   (D) THE PROVISION IN THE CONTRACT MUST BE CONSPICUOUS.
   (E) AUTHORIZATION SHALL BE OBTAINED IN A MANNER CONSISTENT WITH GUIDE-
 LINES ISSUED BY REPRESENTATIVES OF THE ISP OR ONLINE INDUSTRIES,  OR  IN
 ANY OTHER MANNER REASONABLY DESIGNED TO COMPLY WITH THIS SECTION.
   5.  THE  ISP SHALL TAKE ALL REASONABLE AND NECESSARY STEPS TO MAINTAIN
 THE SECURITY AND PRIVACY OF A CONSUMER'S PERSONALLY IDENTIFIABLE  INFOR-
 MATION.
   6.  A  CONSUMER  WHO  PREVAILS  OR SUBSTANTIALLY PREVAILS IN AN ACTION
 BROUGHT UNDER THIS SECTION IS ENTITLED TO THE GREATER  OF  FIVE  HUNDRED
 DOLLARS OR ACTUAL DAMAGES. COSTS, DISBURSEMENTS, AND REASONABLE ATTORNEY
 S. 4367                             3
 
 FEES  MAY  BE AWARDED TO A PARTY AWARDED DAMAGES FOR A VIOLATION OF THIS
 SECTION. THE ACTION AVAILABLE UNDER THIS SECTION IS  EXEMPTED  FROM  ANY
 MANDATORY ARBITRATION CLAUSES THAT MAY EXIST IN THE CONTRACT BETWEEN THE
 ISP  AND  THE  CONSUMER.  IN A CIVIL ACTION UNDER THIS SECTION, IT IS AN
 AFFIRMATIVE DEFENSE THAT SUCH  INFORMATION  WAS  RELEASED  OR  OTHERWISE
 AVAILABLE  IN VIOLATION OF THIS SECTION NOTWITHSTANDING REASONABLE PRAC-
 TICES ESTABLISHED AND IMPLEMENTED BY THE DEFENDANT TO PREVENT VIOLATIONS
 OF THIS SECTION.
   7. THIS SECTION DOES NOT LIMIT ANY GREATER PROTECTION OF  THE  PRIVACY
 OF INFORMATION UNDER OTHER LAW, EXCEPT THAT:
   (A)  NOTHING  IN  THIS  SECTION SHALL BE DEEMED TO LIMIT THE AUTHORITY
 UNDER OTHER STATE OR FEDERAL LAW OF LAW ENFORCEMENT TO  OBTAIN  INFORMA-
 TION; AND
   (B) IF FEDERAL LAW IS ENACTED THAT REGULATES THE RELEASE OF PERSONALLY
 IDENTIFIABLE  INFORMATION  BY ISPS BUT DOES NOT PREEMPT STATE LAW ON THE
 SUBJECT, STATE LAW PREVAILS.
   § 2. This act shall take effect on the ninetieth day  after  it  shall
 have become a law.