S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6797
 
                        2025-2026 Regular Sessions
 
                             I N  S E N A T E
 
                              March 24, 2025
                                ___________
 
 Introduced  by  Sen. SKOUFIS -- read twice and ordered printed, and when
   printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general business law,  in  relation  to  prohibiting
   data  brokers  from  selling  the  personal information of current and
   former military servicemembers

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-jj to read as follows:
   §  399-JJ.  SALE OF PERSONAL INFORMATION OF SERVICEMEMBERS. 1. AS USED
 IN THIS SECTION:
   (A) "CONSENT" MEANS A CLEAR AFFIRMATIVE ACT SIGNIFYING A FREELY GIVEN,
 SPECIFIC, INFORMED, AND UNAMBIGUOUS INDICATION OF A CONSUMER'S AGREEMENT
 TO THE PROCESSING OF DATA RELATING TO THE CONSUMER. CONSENT MAY BE WITH-
 DRAWN AT ANY TIME, AND A CONTROLLER MUST PROVIDE CLEAR, CONSPICUOUS, AND
 CONSUMER-FRIENDLY MEANS TO WITHDRAW CONSENT. THE BURDEN OF  ESTABLISHING
 CONSENT IS ON THE CONTROLLER. CONSENT DOES NOT INCLUDE: (I) AN AGREEMENT
 OF  GENERAL TERMS OF USE OR A SIMILAR DOCUMENT THAT REFERENCES UNRELATED
 INFORMATION IN ADDITION TO PERSONAL DATA PROCESSING; (II)  AN  AGREEMENT
 OBTAINED THROUGH FRAUD, DECEIT OR DECEPTION; (III) ANY ACT THAT DOES NOT
 CONSTITUTE A USER'S INTENT TO INTERACT WITH ANOTHER PARTY SUCH AS HOVER-
 ING  OVER,  PAUSING OR CLOSING ANY CONTENT; OR (IV) A PRE-CHECKED BOX OR
 SIMILAR DEFAULT.
   (B) "CONSUMER" MEANS A NATURAL PERSON  WHO  IS  A  NEW  YORK  RESIDENT
 ACTING ONLY IN AN INDIVIDUAL OR HOUSEHOLD CONTEXT. IT DOES NOT INCLUDE A
 NATURAL  PERSON  KNOWN  TO  BE  ACTING  IN  A PROFESSIONAL OR EMPLOYMENT
 CONTEXT.
   (C) "DATA BROKER" MEANS A PERSON, OR UNIT OR UNITS OF A LEGAL  ENTITY,
 SEPARATELY  OR TOGETHER, THAT DOES BUSINESS IN THE STATE OF NEW YORK AND
 KNOWINGLY COLLECTS, AND SELLS TO OTHER CONTROLLERS OR THIRD PARTIES, THE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD03293-01-5
 S. 6797                             2
              

 
 PERSONAL DATA OF A  CONSUMER  WITH  WHOM  IT  DOES  NOT  HAVE  A  DIRECT
 RELATIONSHIP. "DATA BROKER" DOES NOT INCLUDE ANY OF THE FOLLOWING:
   (I)  A  CONSUMER  REPORTING AGENCY TO THE EXTENT THAT IT IS COVERED BY
 THE FEDERAL FAIR CREDIT REPORTING ACT (15 U.S.C. SEC. 1681 ET SEQ.); OR
   (II) A FINANCIAL INSTITUTION TO THE EXTENT THAT IT IS COVERED  BY  THE
 GRAMM-LEACH-BLILEY  ACT  (PUBLIC  LAW  106-102)  AND  IMPLEMENTING REGU-
 LATIONS.
   (D) "HOUSEHOLD" MEANS A GROUP, HOWEVER IDENTIFIED,  OF  CONSUMERS  WHO
 COHABITATE  WITH  ONE  ANOTHER  AT  THE SAME RESIDENTIAL ADDRESS AND MAY
 SHARE USE OF COMMON DEVICES OR SERVICES.
   (E) "MILITARY SERVICEMEMBER" MEANS A PERSON  WHO  IS  SERVING  OR  HAS
 SERVED:
   (I)  ON  ACTIVE DUTY IN THE ARMY, NAVY, MARINE CORPS, AIR FORCE, SPACE
 FORCE, OR COAST GUARD OF THE UNITED STATES;
   (II) IN THE ARMY NATIONAL GUARD OR AIR NATIONAL GUARD;
   (III) AS A COMMISSIONED OFFICER IN THE PUBLIC HEALTH SERVICE OR OF THE
 NATIONAL  OCEANIC  AND  ATMOSPHERIC  ADMINISTRATION   OR   ENVIRONMENTAL
 SCIENCES SERVICES ADMINISTRATION; OR
   (IV) AS A CADET AT A UNITED STATES ARMED FORCES SERVICE ACADEMY.
   (F)  "MILITARY SERVICEMEMBER LIST" MEANS A LIST THAT INCLUDES PERSONAL
 INFORMATION, OTHER THAN PUBLIC RECORD INFORMATION,  ABOUT  ONE  OR  MORE
 INDIVIDUALS  OR  HOUSEHOLDS  WHICH IS CREATED FOR THE EXPRESS OR IMPLIED
 PURPOSE OF COMPILING INFORMATION ABOUT INDIVIDUALS WHO  ARE  CURRENT  OR
 FORMER SERVICEMEMBERS OR FAMILY MEMBERS OF A CURRENT OR FORMER SERVICEM-
 EMBER.
   (G) "PERSONAL DATA" MEANS ANY DATA THAT IDENTIFIES OR COULD REASONABLY
 BE  LINKED,  DIRECTLY  OR INDIRECTLY, WITH A SPECIFIC NATURAL PERSON, OR
 HOUSEHOLD. PERSONAL DATA DOES NOT INCLUDE DEIDENTIFIED DATA, INFORMATION
 THAT IS LAWFULLY MADE PUBLICLY AVAILABLE FROM FEDERAL,  STATE  OR  LOCAL
 GOVERNMENT  RECORDS,  OR  INFORMATION THAT A CONTROLLER HAS A REASONABLE
 BASIS TO BELIEVE IS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC BY THE
 CONSUMER OR FROM WIDELY DISTRIBUTED MEDIA.
   (H) "SALE", "SELL", OR "SOLD" MEANS THE DISCLOSURE, TRANSFER,  CONVEY-
 ANCE, SHARING,  LICENSING,  MAKING  AVAILABLE,  PROCESSING, GRANTING  OF
 PERMISSION OR AUTHORIZATION TO PROCESS, OR OTHER  EXCHANGE  OF  PERSONAL
 DATA,  OR  PROVIDING ACCESS TO PERSONAL DATA FOR MONETARY OR OTHER VALU-
 ABLE  CONSIDERATION BY THE CONTROLLER TO A THIRD PARTY.  "SALE" INCLUDES
 ENABLING, FACILITATING OR PROVIDING ACCESS TO PERSONAL DATA FOR TARGETED
 ADVERTISING. "SALE" DOES NOT INCLUDE THE FOLLOWING:
   (I) THE DISCLOSURE OF DATA TO A PROCESSOR WHO PROCESSES  THE  DATA  ON
 BEHALF  OF  THE  CONTROLLER  AND  WHICH IS CONTRACTUALLY PROHIBITED FROM
 USING IT FOR ANY PURPOSE OTHER THAN AS INSTRUCTED BY THE CONTROLLER;
   (II) THE DISCLOSURE OR TRANSFER OF DATA AS AN ASSET THAT IS PART OF  A
 MERGER,  ACQUISITION,  BANKRUPTCY, OR OTHER TRANSACTION IN WHICH ANOTHER
 ENTITY ASSUMES CONTROL OR OWNERSHIP OF ALL OR A MAJORITY OF THE CONTROL-
 LER'S ASSETS; OR
   (III) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY  NECESSARY  FOR
 PURPOSES OF PROVIDING A PRODUCT, SERVICE, OR INTERACTION WITH SUCH THIRD
 PARTY,  WHEN  THE CONSUMER INTENTIONALLY AND UNAMBIGUOUSLY REQUESTS SUCH
 DISCLOSURE.
   (I) "TARGETED ADVERTISING" MEANS ADVERTISING BASED UPON PROFILING.
   2. IT SHALL BE UNLAWFUL FOR A DATA BROKER KNOWINGLY OR  RECKLESSLY  TO
 SELL  A  MILITARY SERVICEMEMBER LIST OR PERSONAL DATA ABOUT ANY MILITARY
 SERVICEMEMBER WITHOUT CONSENT FROM SUCH MILITARY SERVICEMEMBERS.
   3. IT SHALL BE UNLAWFUL FOR A DATA BROKER KNOWINGLY OR  RECKLESSLY  TO
 ADVERTISE A MILITARY SERVICEMEMBER LIST OR PERSONAL DATA ABOUT ANY MILI-
 S. 6797                             3
 
 TARY  SERVICEMEMBER  OR MEMBER OF THEIR FAMILY WITHOUT CONSENT FROM SUCH
 MILITARY SERVICEMEMBERS.
   4.  THIS SECTION APPLIES TO LEGAL PERSONS THAT CONDUCT BUSINESS IN NEW
 YORK OR PRODUCE PRODUCTS OR SERVICES THAT ARE TARGETED TO  RESIDENTS  OF
 NEW YORK.
   5. THIS SECTION SHALL NOT APPLY TO:
   (A) PERSONAL DATA PROCESSED BY STATE AND LOCAL GOVERNMENTS, AND MUNIC-
 IPAL  CORPORATIONS,  FOR  PROCESSES  OTHER THAN SALE; PROVIDED, HOWEVER,
 FILING AND PROCESSING FEES SHALL  NOT  BE  CONSIDERED  A  SALE  FOR  THE
 PURPOSES OF THIS PARAGRAPH;
   (B)  A  NATIONAL SECURITIES ASSOCIATION REGISTERED PURSUANT TO SECTION
 15A OF THE SECURITIES EXCHANGE ACT OF 1934, AS AMENDED,  OR  REGULATIONS
 ADOPTED  THEREUNDER  OR  A  REGISTERED FUTURES ASSOCIATION SO DESIGNATED
 PURSUANT TO SECTION 17 OF THE COMMODITY EXCHANGE ACT, AS AMENDED, OR ANY
 REGULATIONS ADOPTED THEREUNDER;
   (C) ANY NONPROFIT ENTITY IDENTIFIED IN SECTION FOUR  HUNDRED  FIVE  OF
 THE  FINANCIAL  SERVICES  LAW  TO THE EXTENT SUCH ORGANIZATION COLLECTS,
 PROCESSES, USES, OR SHARES  DATA  SOLELY  IN  RELATION  TO  IDENTIFYING,
 INVESTIGATING, OR ASSISTING:
   (I)  LAW  ENFORCEMENT AGENCIES IN CONNECTION WITH SUSPECTED INSURANCE-
 RELATED CRIMINAL OR FRAUDULENT ACTS; OR
   (II) FIRST RESPONDERS IN CONNECTION WITH CATASTROPHIC EVENTS;
   (D) INFORMATION THAT MEETS THE FOLLOWING CRITERIA:
   (I) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO
 AND  IN  COMPLIANCE  WITH  THE  FEDERAL  GRAMM-LEACH-BLILEY  ACT   (P.L.
 106-102), AND IMPLEMENTING REGULATIONS;
   (II)  PERSONAL  DATA COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT
 TO THE FEDERAL DRIVER'S PRIVACY PROTECTION ACT OF 1994 (18  U.S.C.  SEC.
 2721  ET SEQ.), IF THE COLLECTION, PROCESSING, SALE, OR DISCLOSURE IS IN
 COMPLIANCE WITH THAT LAW;
   (III) PERSONAL DATA REGULATED BY THE FEDERAL FAMILY EDUCATIONAL RIGHTS
 AND PRIVACY ACT, U.S.C. SEC. 1232G AND ITS IMPLEMENTING REGULATIONS;
   (IV) PERSONAL DATA COLLECTED, PROCESSED, SOLD, OR  DISCLOSED  PURSUANT
 TO  THE  FEDERAL  FARM  CREDIT ACT OF 1971 (AS AMENDED IN 12 U.S.C. SEC.
 2001-2279CC) AND ITS IMPLEMENTING REGULATIONS (12  C.F.R.  PART  600  ET
 SEQ.)  IF  THE COLLECTION, PROCESSING, SALE, OR DISCLOSURE IS IN COMPLI-
 ANCE WITH THAT LAW;
   (V) PERSONAL DATA REGULATED BY SECTION TWO-D OF THE EDUCATION LAW;
   (VI) DATA MAINTAINED AS EMPLOYMENT RECORDS, FOR  PURPOSES  OTHER  THAN
 SALE;
   (VII)  PROTECTED  HEALTH  INFORMATION  THAT IS LAWFULLY COLLECTED BY A
 COVERED ENTITY OR BUSINESS ASSOCIATE AND IS  GOVERNED  BY  THE  PRIVACY,
 SECURITY,  AND  BREACH  NOTIFICATION  RULES  ISSUED BY THE UNITED STATES
 DEPARTMENT OF HEALTH AND HUMAN SERVICES, PARTS 160 AND 164 OF  TITLE  45
 OF  THE  CODE OF FEDERAL REGULATIONS, ESTABLISHED PURSUANT TO THE HEALTH
 INSURANCE  PORTABILITY  AND  ACCOUNTABILITY  ACT  OF  1996  (PUBLIC  LAW
 104-191)  ("HIPAA")  AND  THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC
 AND CLINICAL HEALTH ACT (PUBLIC LAW 111-5);
   (VIII) PATIENT IDENTIFYING INFORMATION FOR PURPOSES OF 42 C.F.R.  PART
 2, ESTABLISHED PURSUANT TO 42 U.S.C. SEC. 290DD-2, AS LONG AS SUCH  DATA
 IS NOT SOLD IN VIOLATION OF HIPAA OR ANY STATE OR FEDERAL LAW;
   (IX)  INFORMATION  AND  DOCUMENTS LAWFULLY CREATED FOR PURPOSES OF THE
 FEDERAL HEALTH CARE QUALITY IMPROVEMENT ACT OF 1986, AND  RELATED  REGU-
 LATIONS;
   (X)  PATIENT  SAFETY  WORK  PRODUCT  CREATED FOR PURPOSES OF 42 C.F.R.
 PART 3, ESTABLISHED PURSUANT TO 42 U.S.C. SEC. 299B-21 THROUGH 299B-26;
 S. 6797                             4
 
   (XI) INFORMATION THAT IS TREATED IN THE  SAME  MANNER  AS  INFORMATION
 EXEMPT  UNDER SUBPARAGRAPH (VII) OF THIS PARAGRAPH THAT IS MAINTAINED BY
 A COVERED ENTITY OR BUSINESS ASSOCIATE AS DEFINED BY HIPAA OR A  PROGRAM
 OR  A  QUALIFIED SERVICE ORGANIZATION AS DEFINED BY 42 U.S.C. § 290DD-2,
 AS  LONG  AS SUCH DATA IS NOT SOLD IN VIOLATION OF HIPAA OR ANY STATE OR
 FEDERAL LAW;
   (XII) DEIDENTIFIED HEALTH INFORMATION THAT MEETS ALL OF THE  FOLLOWING
 CONDITIONS:
   (A) IT IS DEIDENTIFIED IN ACCORDANCE WITH THE REQUIREMENTS FOR DEIDEN-
 TIFICATION  SET  FORTH IN SECTION 164.514 OF PART 164 OF TITLE 45 OF THE
 CODE OF FEDERAL REGULATIONS;
   (B) IT IS DERIVED  FROM  PROTECTED  HEALTH  INFORMATION,  INDIVIDUALLY
 IDENTIFIABLE  HEALTH  INFORMATION,  OR  IDENTIFIABLE PRIVATE INFORMATION
 COMPLIANT WITH THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN  SUBJECTS,
 ALSO KNOWN AS THE COMMON RULE; AND
   (C) A COVERED ENTITY OR BUSINESS ASSOCIATE DOES NOT ATTEMPT TO REIDEN-
 TIFY  THE  INFORMATION  NOR  DO THEY ACTUALLY REIDENTIFY THE INFORMATION
 EXCEPT AS OTHERWISE ALLOWED UNDER STATE OR FEDERAL LAW;
   (XIII) INFORMATION MAINTAINED BY A COVERED ENTITY OR BUSINESS  ASSOCI-
 ATE  GOVERNED  BY  THE  PRIVACY, SECURITY, AND BREACH NOTIFICATION RULES
 ISSUED BY THE UNITED STATES DEPARTMENT OF  HEALTH  AND  HUMAN  SERVICES,
 PARTS 160 AND 164 OF TITLE 45 OF THE CODE OF FEDERAL REGULATIONS, ESTAB-
 LISHED  PURSUANT  TO THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY
 ACT OF 1996 (PUBLIC LAW 104-191), TO THE EXTENT THE  COVERED  ENTITY  OR
 BUSINESS  ASSOCIATE  MAINTAINS  THE  INFORMATION  IN  THE SAME MANNER AS
 PROTECTED HEALTH INFORMATION AS DESCRIBED IN SUBPARAGRAPH (VII) OF  THIS
 PARAGRAPH;
   (XIV)  DATA  COLLECTED AS PART OF HUMAN SUBJECTS RESEARCH, INCLUDING A
 CLINICAL TRIAL, CONDUCTED IN ACCORDANCE WITH THE FEDERAL POLICY FOR  THE
 PROTECTION OF HUMAN SUBJECTS, ALSO KNOWN AS THE COMMON RULE, PURSUANT TO
 GOOD  CLINICAL  PRACTICE  GUIDELINES ISSUED BY THE INTERNATIONAL COUNCIL
 FOR HARMONISATION OR PURSUANT TO HUMAN SUBJECT  PROTECTION  REQUIREMENTS
 OF THE UNITED STATES FOOD AND DRUG ADMINISTRATION;
   (XV)  PERSONAL  DATA  PROCESSED  ONLY FOR ONE OR MORE OF THE FOLLOWING
 PURPOSES:
   (A) PRODUCT  REGISTRATION  AND  TRACKING  CONSISTENT  WITH  APPLICABLE
 UNITED STATES FOOD AND DRUG ADMINISTRATION REGULATIONS AND GUIDANCE;
   (B)  PUBLIC  HEALTH  ACTIVITIES  AND  PURPOSES AS DESCRIBED IN SECTION
 164.512 OF TITLE 45 OF THE CODE OF FEDERAL REGULATIONS; AND/OR
   (C) ACTIVITIES RELATED TO QUALITY, SAFETY, OR EFFECTIVENESS  REGULATED
 BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION; OR
   (XVI) PERSONAL DATA COLLECTED, PROCESSED, OR DISCLOSED PURSUANT TO AND
 IN  COMPLIANCE WITH ANY OPT-OUT PROGRAM AUTHORIZED BY THE PUBLIC SERVICE
 COMMISSION  OR  ANY  OTHER  OPT-OUT  COMMUNITY  DISTRIBUTED   GENERATION
 PROGRAMS AUTHORIZED IN LAW; OR
   (E) (I) AN ACTIVITY INVOLVING THE COLLECTION, MAINTENANCE, DISCLOSURE,
 SALE, COMMUNICATION, OR USE OF ANY PERSONAL DATA BEARING ON A CONSUMER'S
 CREDIT  WORTHINESS, CREDIT STANDING, CREDIT CAPACITY, CHARACTER, GENERAL
 REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING  BY  A  CONSUMER
 REPORTING  AGENCY,  AS  DEFINED  IN  TITLE 15 U.S.C. SEC. 1681A(F), BY A
 FURNISHER OF INFORMATION, AS SET FORTH IN TITLE 15 U.S.C. SEC.  1681S-2,
 WHO  PROVIDES  INFORMATION  FOR  USE IN A CONSUMER REPORT, AS DEFINED IN
 TITLE 15 U.S.C. SEC. 1861A(D), AND BY A USER OF A  CONSUMER  REPORT,  AS
 SET FORTH IN TITLE 15 U.S.C. SEC. 1681B.; AND
   (II)  THIS PARAGRAPH SHALL APPLY ONLY TO THE EXTENT THAT SUCH ACTIVITY
 INVOLVING THE COLLECTION, MAINTENANCE, DISCLOSURE, SALE,  COMMUNICATION,
 S. 6797                             5
 
 OR  USE  OF  SUCH  DATA BY THAT AGENCY, FURNISHER, OR USER IS SUBJECT TO
 REGULATION UNDER THE FAIR CREDIT REPORTING ACT,  TITLE  15  U.S.C.  SEC.
 1681  ET SEQ., AND THE DATA IS NOT COLLECTED, MAINTAINED, USED, COMMUNI-
 CATED,  DISCLOSED,  OR  SOLD  EXCEPT  AS  AUTHORIZED  BY THE FAIR CREDIT
 REPORTING ACT.
   6. WHEREVER THERE SHALL BE A VIOLATION OF THIS SECTION, AN APPLICATION
 MAY BE MADE BY THE ATTORNEY GENERAL IN THE NAME OF  THE  PEOPLE  OF  THE
 STATE  OF NEW YORK TO A COURT OR JUSTICE HAVING JURISDICTION TO ISSUE AN
 INJUNCTION, AND UPON NOTICE TO THE DEFENDANT OF NOT LESS THAN FIVE DAYS,
 TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH  VIOLATIONS;  AND  IF  IT
 SHALL  APPEAR  TO  THE  SATISFACTION  OF  THE COURT OR JUSTICE, THAT THE
 DEFENDANT HAS, IN FACT, VIOLATED  THIS  SECTION  AN  INJUNCTION  MAY  BE
 ISSUED  BY  SUCH  COURT OR JUSTICE ENJOINING AND RESTRAINING ANY FURTHER
 VIOLATION, WITHOUT REQUIRING PROOF THAT ANY PERSON HAS,  IN  FACT,  BEEN
 INJURED  OR  DAMAGED THEREBY. IN ANY SUCH PROCEEDING, THE COURT MAY MAKE
 ALLOWANCES TO THE ATTORNEY GENERAL  AS  PROVIDED  IN  PARAGRAPH  SIX  OF
 SUBDIVISION (A) OF SECTION EIGHTY-THREE HUNDRED THREE OF THE CIVIL PRAC-
 TICE  LAW  AND  RULES,  AND DIRECT RESTITUTION. WHENEVER THE COURT SHALL
 DETERMINE THAT A VIOLATION OF THIS SECTION HAS OCCURRED, THE  COURT  MAY
 IMPOSE  A  CIVIL  PENALTY  OF  NOT  MORE  THAN  TEN THOUSAND DOLLARS. IN
 CONNECTION WITH ANY SUCH PROPOSED APPLICATION, THE ATTORNEY  GENERAL  IS
 AUTHORIZED  TO TAKE PROOF AND MAKE A DETERMINATION OF THE RELEVANT FACTS
 AND TO ISSUE SUBPOENAS IN ACCORDANCE WITH THE  CIVIL  PRACTICE  LAW  AND
 RULES.
   §  2.  This  act shall take effect on the ninetieth day after it shall
 have become a law.