•  Summary 
 
•  Actions 
 
•  Committee Votes 
 
•  Floor Votes 
 
•  Memo 
 
•  Text 
 
•  LFIN 
 
•  Chamber Video 

A07495 Summary:

A07495 Actions:

A07495 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
 submitted in accordance with Assembly Rule III, Sec 1(f)



 
BILL NUMBER: A7495A
 
SPONSOR: Seawright

 
TITLE OF BILL:  An act to amend the general business law, in relation
to the sale of personal information by an internet service provider
 
 
PURPOSE:
 
To prohibit internet service providers from selling the private informa-
tion of consumers in New York State without providing consumers with
proper notice or risking the quality of their service.
 
 
SUMMARY OF PROVISIONS:
 
Section 1. Amends the general business law by adding a new section §
349-f.
 
1. Prohibits internet service providers from selling a specified sched-
ule of private data without proper notice.
 
2. Prevents providers from penalizing a consumer who does not authorize
the sharing their private data including but not limited to imposing
supplemental charges, decreasing bandwidth resulting in reduced speeds
or any other measure that would diminish the quality or accessibility of
internet services.
 
3. Establishes that the violation of any provision set out in this
section results in the penalty of an unclassified misdemeanor carrying a
fine of $1000 for each individual violation.
 
Section 2. Effective date.
 
 
EXISTING LAW:
 
This would be a new law.
 
 
JUSTIFICATION:
 
New York State is one of the most connected states, in terms of internet
access, in the nation. New York is on track for all residents to have
high speed internet access by the end of 2018. New York must act proac-
tively and establishing provisions preventing violations of consumer
privacy is imperative.

Currently, providers are able to sell the majority of data they collect
from consumer's internet browsing history and caches to third parties
without providing explicit notification to customers.
 
This information can reveal potentially sensitive information to employ-
ers, associates, advertisers, and more. This can have negative conse-
quences socially and financially for impacted individuals.
 
Ongoing changes at the federal level have opened the door to consumers
unknowingly sacrificing their privacy and their ability to control how
their most sensitive information is used.
 
This legislation would prevent the sale of consumer's private informa-
tion by internet service providers, without their consent. It also
prohibits those same providers from using coercive tactics to get
customers to agree to share data, such as imposing additional penalties
or reducing the speed or quality of service.
 
 
DIFFERENCE BETWEEN ORIGINAL AND AMENDED VERSION:

There are minimal language changes between the original and amended
version.
 
 
LEGISLATIVE HISTORY:
 
This is a new bill.
 
 
FISCAL IMPLICATIONS:
 
None
 
 
EFFECTIVE DATE:
This act shall take effect immediately

A07495 Text:

 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                         7495--A
 
                               2017-2018 Regular Sessions
 
                   IN ASSEMBLY
 
                                     April 27, 2017
                                       ___________
 
        Introduced  by  M.  of  A.  SEAWRIGHT  --  read once and referred to the
          Committee on Consumer Affairs and Protection -- committee  discharged,
          bill  amended,  ordered  reprinted  as amended and recommitted to said
          committee
 
        AN ACT to amend the general business law, in relation  to  the  sale  of
          personal information by an internet service provider
 
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:
 
     1    Section 1. The general business law is amended by adding a new section
     2  349-f to read as follows:
     3    § 349-f. Sale, transfer, or sharing  of  personal  information  by  an
     4  internet service provider. 1. As used in this section:
     5    (a) "Personal information" shall mean any information that, when it is
     6  disclosed,  identifies,  describes,  or is able to be associated with an
     7  individual and includes, but is not limited to, the following:
     8    (i) an individual's name and address;
     9    (ii) information pertaining to  creditworthiness,  assets,  income  or
    10  liabilities;
    11    (iii) age or date of birth;
    12    (iv) names of children;
    13    (v) electronic mail or other addresses of children;
    14    (vi) number of children;
    15    (vii) the age or gender of children;
    16    (viii) height;
    17    (ix) weight;
    18    (x) race;
    19    (xi) religion;
    20    (xii) occupation;
    21    (xiii) telephone number;
    22    (xiv) education;
    23    (xv) political party affiliation;
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD10913-03-7
        A. 7495--A                          2
 
     1    (xvi) medical condition;
     2    (xvii) drugs, therapies, or medical products or equipment used;
     3    (xviii) the kind of product the customer purchased, leased, or rented;
     4    (xix) real property purchased, leased, or rented;
     5    (xx) the kind of service provided;
     6    (xxi) social security number;
     7    (xxii) bank account number;
     8    (xxiii) credit card number;
     9    (xxiv) debit card number;
    10    (xxv) bank or investment account, debit card, or credit card balance;
    11    (xxvi) payment history;
    12    (xxvii) internet searches; or
    13    (xxviii) browser cache.
    14    (b)  "Provider of internet service" shall mean any person, business or
    15  organization qualified to do business in this state that provides  indi-
    16  viduals,  corporations, or other entities with the ability to connect to
    17  the internet through equipment that is located in this state.
    18    2. A provider of internet service shall keep confidential:
    19    (a) all personal information concerning a subscriber, other  than  the
    20  electronic  mail  address of the subscriber, unless the subscriber gives
    21  permission, in writing or by electronic mail, to the provider of  inter-
    22  net service to disclose the information; and
    23    (b)  the  electronic  mail  address of a subscriber, if the subscriber
    24  requests, in writing or by electronic mail, to have the electronic  mail
    25  address  of  the  subscriber  kept  confidential.  Upon receiving such a
    26  request from a subscriber, a provider of  internet  service  shall  keep
    27  confidential  the  electronic mail address of the subscriber, unless the
    28  subscriber gives permission, in writing or by electronic  mail,  to  the
    29  provider  of internet service to disclose the electronic mail address of
    30  the subscriber.
    31    3. A provider of internet service shall provide notice of the require-
    32  ments of subdivision two of this section to each of its subscribers. The
    33  notice must include, without limitation, a conspicuous statement that  a
    34  subscriber  may  request,  in writing or by electronic mail, to have the
    35  electronic mail address of the subscriber kept confidential.
    36    4. A provider of internet service shall not add a supplemental  charge
    37  or in any way  penalize a subscriber either financially or in quality or
    38  speed  of delivery for choosing not to allow for the sharing of personal
    39  information.
    40    5. A provider of internet service who violates any provision  of  this
    41  section  shall be guilty of a misdemeanor and shall be subject to a fine
    42  of not less than five hundred dollars or more than one thousand  dollars
    43  for each violation.
    44    § 2. This act shall take effect immediately.