STATE OF NEW YORK
________________________________________________________________________
3629
2025-2026 Regular Sessions
IN ASSEMBLY
January 29, 2025
___________
Introduced by M. of A. ROZIC, JENSEN -- read once and referred to the
Committee on Governmental Operations
AN ACT to amend the executive law, in relation to prohibiting sharing or
selling personal data to third parties by government entities and
contractors
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The executive law is amended by adding a new article 5-A to
2 read as follows:
3 ARTICLE 5-A
4 SHARING AND SELLING OF PERSONAL DATA
5 Section 81. Definitions.
6 82. Data collection disclosure.
7 83. Sharing and selling of personal information prohibited.
8 84. Limitation on restrictions.
9 § 81. Definitions. As used in this article, the following terms shall
10 have the following meanings unless otherwise specified:
11 1. "Aggregate personal information" shall mean information that
12 relates to a group or category of individuals, from which individual
13 identities have been removed, that is not linked or reasonably linkable
14 to any individual or household, including via a device. "Aggregate
15 personal information" shall not mean one or more individual's records
16 that have been deidentified.
17 2. "Collects", "collected", or "collection" shall mean gathering,
18 obtaining, receiving, or accessing any personal information pertaining
19 to an individual by any means. This includes receiving information from
20 such individual either actively or passively.
21 3. "Contractor" means a contractor, or subcontractor of a contractor,
22 that contracts to process information on behalf of a government entity
23 and to which such government entity discloses an individual's personal
24 information for a legitimate government purpose pursuant to a written
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD04682-01-5
A. 3629 2
1 contract, provided that such contract prohibits such contractor or
2 subcontractor receiving such personal information from retaining, using,
3 or disclosing such personal information for any purpose other than for
4 the specific purpose of performing the services specified in such
5 contract, or as otherwise permitted by this article, including retain-
6 ing, using, or disclosing such personal information for a commercial
7 purpose other than providing the services specified in the contract.
8 4. "Deidentified" shall mean information that cannot reasonably iden-
9 tify, relate to, describe, be capable of being associated with, or be
10 linked to, directly or indirectly, a particular individual, provided
11 that a government entity that uses such deidentified information:
12 (a) has implemented technical safeguards and processes that prohibit
13 reidentification of the individual to whom such information may pertain;
14 (b) has implemented processes to prevent inadvertent release of
15 deidentified information; and
16 (c) makes no attempt to reidentify such information.
17 5. "Device" shall mean any physical object that is capable of connect-
18 ing to the internet, directly or indirectly, or to another device.
19 6. "Government entity" or "entity" shall mean any state agency or any
20 part, body, or subdivision thereof.
21 7. "Individual" shall mean a person who is a resident of New York
22 state.
23 8. (a) "Personal information" shall mean information that identifies,
24 relates to, describes, is capable of being associated with, or could
25 reasonably be linked to, directly or indirectly, a particular individual
26 or household. Personal information includes, but is not limited to, the
27 following:
28 (i) identifiers such as a real name, alias, postal address, unique
29 personal identifier, internet protocol address, email address, social
30 security number, driver's license number, passport number, photograph,
31 or other similar identifiers;
32 (ii) characteristics of protected classifications under New York or
33 federal law;
34 (iii) commercial information, including records of real or personal
35 property;
36 (iv) biometric information;
37 (v) audio, electronic, visual, or similar information;
38 (vi) professional or employment-related information;
39 (vii) education information, defined as information that is not
40 publicly available personally identifiable information as defined in the
41 family educational rights and privacy act (20 USC 1232g);
42 (viii) inferences drawn from any of the information identified in this
43 paragraph to create a profile about an individual reflecting such indi-
44 vidual's preferences, characteristics, psychological trends, predisposi-
45 tions, behavior, attitudes, intelligence, abilities, and aptitudes; and
46 (ix) financial or tax information.
47 (b) "Personal information" shall not include publicly available infor-
48 mation. For these purposes, "publicly available" shall mean information
49 that is lawfully made available from federal, state, or local government
50 records, or any conditions associated with such information. "Publicly
51 available" shall not include an individual's information that is deiden-
52 tified or aggregate personal information.
53 9. "Probabilistic identifier" shall mean the identification of an
54 individual or a device to a degree of certainty of more probable than
55 not based on any categories of personal information included in, or
A. 3629 3
1 similar to, the categories enumerated in subdivision eight of this
2 section.
3 10. "Process" or "processing" shall mean any operation or set of oper-
4 ations that are performed on personal data or on sets of personal data,
5 whether or not by automated means.
6 11. (a) "Sell", "selling", "sale", or "sold" shall mean selling, rent-
7 ing, releasing, disclosing, disseminating, making available, trans-
8 ferring, or otherwise communicating orally, in writing, or by electronic
9 or other means, an individual's personal information by a government
10 entity or contractor to a third party for monetary or other valuable
11 consideration.
12 (b) A government entity or contractor does not sell personal informa-
13 tion within the meaning of this article when:
14 (i) An individual uses or directs such government entity or contractor
15 to intentionally disclose personal information to a third party,
16 provided such third party also does not sell such personal information,
17 unless such disclosure would be consistent with the provisions of this
18 article.
19 (ii) Such government entity or contractor uses or shares with a third
20 party personal information of an individual that is necessary to perform
21 a legitimate government purpose if both of the following conditions are
22 met:
23 (1) the government entity or contractor has provided notice that
24 information is being used or shared; and
25 (2) the third party does not further collect, sell, or use the
26 personal information of such individual except as necessary to perform
27 the business purpose for which it received such information.
28 (iii) A contractor who transfers to a third party an individual's
29 personal information as an asset that is part of a merger, acquisition,
30 bankruptcy, or other transaction in which such contractor or third party
31 assumes control of all or part of such third party provided that such
32 information is used or shared consistently with this article. If a third
33 party materially alters how it uses or shares personal information of an
34 individual in a manner that is materially inconsistent with the promises
35 made at the time of collection, it shall provide prior notice of the new
36 or changed practice to such individual. Such notice shall be sufficient-
37 ly prominent and robust to ensure that individuals can easily exercise
38 their choices consistently with section eighty-three of this article.
39 12. "Service" or "services" shall mean work, labor, and services,
40 including services furnished in connection with the sale or repair of
41 goods.
42 13. "Third party" shall mean a person or business entity who is not
43 another government entity or contractor thereof.
44 14. "Unique identifier" or "unique personal identifier" shall mean a
45 persistent identifier that can be used to recognize an individual, a
46 family, or a device that is linked to an individual or family, over time
47 and across different services, including, but not limited to, a device
48 identifier; an internet protocol address; cookies, beacons, pixel tags,
49 or similar technology; unique pseudonym, or user alias; telephone
50 numbers, or other forms of persistent or probabilistic identifiers that
51 can be used to identify a particular individual or device. For purposes
52 of this subdivision, "family" means a custodial parent or guardian and
53 any minor children over which such parent or guardian has custody.
54 § 82. Data collection disclosure. 1. A government entity or contractor
55 that collects an individual's personal information shall, at or before
56 the point of collection, inform such individual as to the categories of
A. 3629 4
1 personal information to be collected and the purposes for which such
2 categories of personal information shall be used. A government entity or
3 contractor shall not collect additional categories of personal informa-
4 tion or use personal information collected for additional purposes with-
5 out providing such individual with notice consistent with this article.
6 2. This section shall not require a government entity or contractor
7 to:
8 (a) retain any personal information collected for a single, one-time
9 transaction if such information is not shared or retained by such
10 government entity or contractor; or
11 (b) reidentify or otherwise link information that is not maintained in
12 a manner that would be considered personal information.
13 § 83. Sharing and selling of personal information prohibited. 1. No
14 government entity or contractor shall share any individual's personal
15 information with a contractor or subcontractor unless such information
16 is crucial to the purpose for which such government entity or contractor
17 has contracted such contractor or subcontractor's services.
18 2. No government entity or contractor shall share any individual's
19 personal information with another government entity or contractor unless
20 such information is crucial to the performance of such other government
21 entity or contractor's duties, and such other government entity or
22 contractor cannot procure such personal information on its own without
23 serious hardship.
24 3. No government entity or contractor shall sell personal information
25 about an individual.
26 § 84. Limitation on restrictions. 1. The obligations imposed on
27 government entities and contractors by this article shall not restrict
28 any government entity or contractor's ability to:
29 (a) otherwise comply with federal, state, or local laws;
30 (b) comply with a civil, criminal, or regulatory inquiry, investi-
31 gation, subpoena, or summons by federal, state, or local authorities;
32 (c) comply with a request made under the freedom of information law;
33 or
34 (d) exercise or defend legal claims.
35 2. This article shall not apply to the sale of personal information to
36 or from a consumer reporting agency if such information is to be
37 reported in, or used to generate, a consumer report as defined by the
38 federal fair credit reporting act (15 USC 1681), and use of that infor-
39 mation is limited by such act.
40 3. A government entity that discloses personal information to a
41 contractor shall not be liable under this article if such contractor
42 uses such personal information in violation of the restrictions set
43 forth in this article, provided that, at the time of disclosing such
44 personal information, such government entity does not have actual know-
45 ledge or reason to believe that such contractor intends to commit such a
46 violation. No contractor shall be liable under this article for the
47 obligations of a government entity for which it provides services as set
48 forth in this article.
49 4. This article shall not be construed to require a government entity
50 to reidentify or otherwise link information that is not maintained in a
51 manner that would be considered personal information.
52 5. The rights afforded to individuals and the obligations imposed on
53 government entities and contractors by this article shall not adversely
54 affect the rights and freedoms of any other person.
55 § 2. This act shall take effect one year after it shall have become a
56 law.
