Requires a business to delete a consumer's financial information after cancellation of an automatic renewal or continuous service, unless such consumer has affirmatively consented to retention of such financial information; requires such business to notify such consumer of such deletion.
STATE OF NEW YORK
________________________________________________________________________
4413--A
Cal. No. 542
2025-2026 Regular Sessions
IN SENATE
February 4, 2025
___________
Introduced by Sen. MAY -- read twice and ordered printed, and when
printed to be committed to the Committee on Consumer Protection --
recommitted to the Committee on Consumer Protection in accordance with
Senate Rule 6, sec. 8 -- reported favorably from said committee,
ordered to first report, amended on first report, ordered to a second
report and ordered reprinted, retaining its place in the order of
second report
AN ACT to amend the general business law, in relation to deletion of a
consumer's financial information after cancellation of an automatic
renewal or continuous service
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Section 527 of the general business law is amended by
2 adding a new subdivision 5 to read as follows:
3 5. "Financial information" means any information relating to a consum-
4 er's credit card, debit card, or account with a third party held by a
5 business for the purpose of charging such consumer.
6 § 2. Section 527-a of the general business law is amended by adding a
7 new subdivision 2-a to read as follows:
8 2-a. a. Upon receiving a request from a consumer to cancel an automat-
9 ic renewal or continuous service, a business shall delete all records of
10 such consumer's financial information held by such business unless such
11 business has obtained such consumer's affirmative consent to retain such
12 financial information for future purchases. If such business does not
13 obtain such affirmative consent, such business shall:
14 (i) Delete all records of such consumer's financial information within
15 fourteen days of receipt of such request to cancel such automatic
16 renewal or continuous service; and
17 (ii) Notify such consumer by mail or electronic mail of the date such
18 records were deleted pursuant to paragraph (i) of this subdivision, and
19 of each of such consumer's credit cards, debit cards, or accounts with a
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD08677-02-6
S. 4413--A 2
1 third party for which such records were deleted, within seven days of
2 such deletion.
3 b. The provisions of this subdivision shall not apply where a business
4 is otherwise required to retain a consumer's financial information
5 pursuant to state or federal law, rule or regulation.
6 § 3. This act shall take effect on the thirtieth day after it shall
7 have become a law. Effective immediately, the addition, amendment and/or
8 repeal of any rule or regulation necessary for the implementation of
9 this act on its effective date are authorized to be made and completed
10 on or before such effective date.
