STATE OF NEW YORK ________________________________________________________________________

6848

2019-2020 Regular Sessions

IN SENATE

November 13, 2019 ___________

Introduced by Sen. THOMAS -- read twice and ordered printed, and when printed to be committed to the Committee on Rules

AN ACT to amend the general business law, in relation to requiring registration of data brokers and directing the attorney general to maintain a website of such registrations

The People of the State of New York, represented in Senate and Assem- bly, do enact as follows:

1 Section 1. The general business law is amended by adding a new article 2 44 to read as follows: 3 ARTICLE 44 4 DATA BROKER REGISTRY 5 Section 1400. Definitions. 6 1401. Annual registration. 7 1402. Website. 8 1403. Penalties. 9 § 1400. Definitions. For the purposes of this article, the following 10 terms shall have the following meanings: 11 1. "Consumer" shall mean a natural person who is a New York resident. 12 "Consumer" shall not include an employee or contractor of a business 13 acting in their role as an employee or contractor. 14 2. "Data broker" shall mean a business that knowingly collects and 15 sells to third parties the personal information of a consumer with whom 16 the business does not have a direct relationship. "Data broker" shall 17 not include a consumer reporting agency covered by the federal Fair 18 Credit Reporting Act or a financial institution covered by the Gramm- 19 Leach-Bliley Act or an entity covered by the Insurance Information and 20 Privacy Protection Act. 21 3. "Direct relationship" shall mean that the consumer is a past or 22 present: (a) customer, client, subscriber or user of the business's 23 goods or services; (b) employee, contractor or agent of the business; 24 (c) investor in the business; or (d) donor to the business.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD14182-01-9

S. 6848 2

1 4. "Personal information" shall mean any information concerning a 2 natural person which, because of name, number, personal mark, or other 3 identifier, can be used to identify such natural person. 4 § 1401. Annual registration. Annually, on or before January thirty- 5 first, a data broker, as defined under this article, shall: 6 1. register with the attorney general in a manner provided for by the 7 attorney general; 8 2. pay a registration fee in an amount determined by the attorney 9 general not to exceed the reasonable cost of establishing and maintain- 10 ing the informational website described in section fourteen hundred 11 three of this article; and 12 3. provide the following information: 13 (a) the name of the data broker and its primary physical, email and 14 internet website address; 15 (b) whether the data broker permits a consumer to: opt out of the data 16 broker's collection of brokered personal information; opt out of its 17 databases; or opt out of certain sales of data; 18 (c) the method for requesting an opt-out under paragraph (b) of this 19 subdivision; 20 (d) a statement specifying the data collection, databases, or sales 21 activities from which a consumer may not opt out; and 22 (e) any additional information or explanation the data broker chooses 23 to provide concerning its data collection practices. 24 § 1402. Website. The attorney general shall establish, manage and 25 maintain a statewide registry on its internet website, which shall list 26 all registered data brokers doing business in the state and make acces- 27 sible to the public all the information provided by data brokers pursu- 28 ant to this article. Printed hard copies of such registry shall be made 29 available upon request and payment of a fee to be determined by the 30 attorney general. 31 § 1403. Penalties. A data broker that fails to register is subject to 32 injunction and is liable for civil penalties of one hundred dollars for 33 each day that such data broker fails to register, an amount equal to the 34 fees due under this section during the period such data broker failed to 35 register and expenses incurred by the attorney general in the investi- 36 gation and prosecution of the action. 37 § 2. This act shall take effect on the first of January next succeed- 38 ing the date on which it shall have become a law.