Relates to disclosing personal information; limits disclosures of personal information to law enforcement; expands information sharing in response to emergencies; provides for statutory damages for violations and that any information disclosed to a law enforcement agency in violation of the privacy law shall be inadmissible in a criminal or civil court, or administrative proceeding.
STATE OF NEW YORK
________________________________________________________________________
S. 4044 A. 3051
2023-2024 Regular Sessions
SENATE - ASSEMBLY
February 2, 2023
___________
IN SENATE -- Introduced by Sen. GONZALEZ -- read twice and ordered
printed, and when printed to be committed to the Committee on Investi-
gations and Government Operations
IN ASSEMBLY -- Introduced by M. of A. EPSTEIN -- read once and referred
to the Committee on Governmental Operations
AN ACT to amend the public officers law, in relation to disclosing
personal information
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Section 92 of the public officers law, as added by chapter
2 652 of the laws of 1983, subdivision 8 as amended by section 135 of
3 subpart B of part C of chapter 62 of the laws of 2011 and the opening
4 paragraph of subdivision 9 as amended by chapter 313 of the laws of
5 1991, is amended to read as follows:
6 § 92. Definitions. (1) Agency. The term "agency" [means any state
7 board, bureau, committee, commission, council, department, public
8 authority, public benefit corporation, division, office or any other
9 governmental entity performing a governmental or proprietary function
10 for the state of New York, except the judiciary or the state legislature
11 or any unit of local government and shall not include offices of
12 district attorneys] shall have the same meaning as in subdivision three
13 of section eighty-six of this chapter.
14 (2) Committee. The term "committee" means the committee on open
15 government as constituted pursuant to subdivision one of section eight-
16 y-nine of this chapter.
17 (3) Data subject. The term "data subject" means any natural person
18 about whom personal information has been collected by an agency.
19 (4) Disclose. The term "disclose" means to reveal, release, transfer,
20 disseminate or otherwise communicate personal information or records
21 orally, in writing or by electronic or any other means other than to the
22 data subject.
23 (5) 911 services dispatcher. The term "911 services dispatcher" means
24 a person who receives reports of emergencies via a 911 system or E911
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD04764-01-3
S. 4044 2 A. 3051
1 system as defined in subdivision three of section three hundred one of
2 the county law.
3 (6) Emergency medical services personnel. The term "emergency medical
4 services personnel" means individuals designated as such in subdivision
5 five of section twenty-nine hundred ninety-four-aa of the public health
6 law.
7 (7) Governmental unit. The term "governmental unit" means any govern-
8 mental entity performing a governmental or proprietary function for the
9 federal government or for any state or any municipality thereof.
10 [(6)] (8) Law. The term "law" means state or federal statute, rule or
11 regulation.
12 (9) Law enforcement agency. The term "law enforcement agency" shall
13 have the same meaning as in subdivision four of section 705.00 of the
14 criminal procedure law.
15 (10) Law enforcement officer. The term "law enforcement officer" means
16 a police officer or peace officer as defined in section 1.20 of the
17 criminal procedure law.
18 [(7)] (11) Personal information. The term "personal information" means
19 any information concerning a data subject which, because of name,
20 number, symbol, mark or other identifier, alone or in combination with
21 other information, can be used to identify that data subject or be asso-
22 ciated with an identified data subject.
23 [(8) Public safety agency record. The term "public safety agency
24 record" means a record of the state commission of correction, the tempo-
25 rary state commission of investigation, the department of corrections
26 and community supervision, the office of children and family services,
27 the office of victim services, the office of probation and correctional
28 alternatives or the division of state police or of any agency or compo-
29 nent thereof whose primary function is the enforcement of civil or crim-
30 inal statutes if such record pertains to investigation, law enforcement,
31 confinement of persons in correctional facilities or supervision of
32 persons pursuant to criminal conviction or court order, and any records
33 maintained by the division of criminal justice services pursuant to
34 sections eight hundred thirty-seven, eight hundred thirty-seven-a, eight
35 hundred thirty-seven-b, eight hundred thirty-seven-c, eight hundred
36 thirty-eight, eight hundred thirty-nine, and eight hundred forty-five of
37 the executive law and by the department of state pursuant to section
38 ninety-nine of the executive law.
39 (9)] (12) Record. The term "record" means any item, collection or
40 grouping of personal information about a data subject which is main-
41 tained and is retrievable by use of the name or other identifier of the
42 data subject irrespective of the physical form or technology used to
43 maintain such personal information. The term "record" shall not include
44 personal information which is not used to make any determination about
45 the data subject if it is:
46 (a) a telephone book or directory which is used exclusively for tele-
47 phone and directory information;
48 (b) any card catalog, book or other resource material in any library;
49 (c) any compilation of information containing names and addresses only
50 which is used exclusively for the purpose of mailing agency information;
51 (d) personal information required by law to be maintained, and
52 required by law to be used, only for statistical research or reporting
53 purposes;
54 (e) information requested by the agency which is necessary for the
55 agency to answer unsolicited requests by the data subject for informa-
56 tion; or
S. 4044 3 A. 3051
1 (f) correspondence files.
2 [(10)] (13) Routine use. The term "routine use" means, with respect to
3 the disclosure of a record or personal information, any use of such
4 record or personal information relevant to the purpose for which it was
5 collected, and which use is necessary to the statutory duties of the
6 agency that collected or obtained the record or personal information, or
7 necessary for that agency to operate a program specifically authorized
8 by law.
9 [(11)] (14) System of records. The term "system of records" means any
10 group of records under the actual or constructive control of any agency
11 pertaining to one or more data subjects from which personal information
12 is retrievable by use of the name or other identifier of a data subject.
13 § 2. The opening paragraph of subdivision 3 of section 94 of the
14 public officers law, as added by chapter 652 of the laws of 1983, is
15 amended to read as follows:
16 Each agency, for disclosures made pursuant to paragraphs (d)[,] and
17 (i) [and (l)] of subdivision one of section ninety-six of this article,
18 except for disclosures made for inclusion in public safety agency
19 records when such record is requested for the purpose of obtaining
20 information required for the investigation of a violation of civil or
21 criminal statutes within the disclosing agency, shall:
22 § 3. Section 96 of the public officers law, as added by chapter 652 of
23 the laws of 1983, paragraph (j) of subdivision 1 as amended by chapter
24 1015 of the laws of 1984, paragraph (n) of subdivision 1 as amended by
25 chapter 319 of the laws of 2014, paragraphs (o) and (p) of subdivision 1
26 as amended by section one of part S of chapter 58 of the laws of 2022,
27 and paragraph (c) of subdivision 2 as amended by chapter 322 of the laws
28 of 2021, is amended to read as follows:
29 § 96. Disclosure of records. (1) No agency may disclose any record or
30 personal information unless such disclosure is:
31 (a) pursuant to a written request by or the voluntary written consent
32 of the data subject, provided that such request or consent by its terms
33 limits and specifically describes:
34 (i) the personal information which is requested to be disclosed;
35 (ii) the person or entity to whom such personal information is
36 requested to be disclosed; and
37 (iii) the uses which will be made of such personal information by the
38 person or entity receiving it; or
39 (b) to those officers and employees of, and to those who contract
40 with, the agency that maintains the record if such disclosure is neces-
41 sary to the performance of their official duties pursuant to a purpose
42 of the agency required to be accomplished by statute or executive order
43 or necessary to operate a program specifically authorized by law; or
44 (c) subject to disclosure under article six of this chapter, unless
45 disclosure of such information would constitute an unwarranted invasion
46 of personal privacy as defined in paragraph (a) of subdivision two of
47 section eighty-nine of this chapter; or
48 (d) to officers or employees of another governmental unit if each
49 category of information sought to be disclosed is necessary for the
50 receiving governmental unit to operate a program specifically authorized
51 by statute [and if], the use for which the information is requested is
52 not relevant to the purpose for which it was collected; or
53 (e) for a routine use, as defined in subdivision [ten] thirteen of
54 section ninety-two of this article; or
55 (f) specifically authorized by statute or federal rule or regulation;
56 or
S. 4044 4 A. 3051
1 (g) to the bureau of the census for purposes of planning or carrying
2 out a census or survey or related activity pursuant to the provisions of
3 Title XIII of the United States Code; or
4 (h) to a person who has provided the agency with advance written
5 assurance that the record will be used solely for the purpose of statis-
6 tical research or reporting, but only if it is to be transferred in a
7 form that does not reveal the identity of any data subject; or
8 (i) pursuant to a showing of compelling circumstances affecting the
9 health or safety of a data subject, if upon such disclosure notification
10 is transmitted to the data subject at [his or her] their last known
11 address; or
12 (j) to the state archives as a record which has sufficient historical
13 or other value to warrant its continued preservation by the state or for
14 evaluation by the state archivist or [his or her] their designee to
15 determine whether the record has such value; or
16 (k) to any person pursuant to a court ordered subpoena or other
17 compulsory legal process; or
18 (l) [for inclusion in a public safety agency record or to any govern-
19 mental unit or component thereof which performs as one of its principal
20 functions any activity pertaining to the enforcement of criminal laws,
21 provided that, such record is reasonably described and is requested
22 solely for a law enforcement function; or
23 (m)] pursuant to a search warrant; or
24 [(n)] (m) to officers or employees of another agency if the record
25 sought to be disclosed is necessary for the receiving agency to comply
26 with the mandate of an executive order, but only if such records are to
27 be used only for statistical research, evaluation or reporting and are
28 not used in making any determination about a data subject; or
29 [(o)] (n) to officers or employees of a public retirement system of
30 the city of New York if the information sought to be disclosed is neces-
31 sary for the receiving public retirement system to process benefits
32 under the retirement and social security law, the administrative code of
33 the city of New York, or the education law or any other applicable
34 provision of law. A written request or consent from the data subject
35 pursuant to paragraph (a) of this subdivision shall not be required for
36 the disclosure of records pursuant to this paragraph; or
37 [(p)] (o) to officers or employees of the United States department of
38 education for such department to process credit for qualifying employ-
39 ment and loan forgiveness under the public service loan forgiveness
40 program. A written request or consent from the data subject pursuant to
41 paragraph (a) of this subdivision shall not be required for the disclo-
42 sure of records pursuant to this paragraph; or
43 (p) necessary to prevent an immediate and substantial risk of death,
44 significant bodily harm, significant damage to property, or is otherwise
45 necessary to respond to an immediate emergency; or
46 (q) disclosed by a 911 service dispatcher in the course of responding
47 to an emergency reported via a 911 system or E911 system to emergency
48 medical services personnel, law enforcement officers, or others respon-
49 sible for providing assistance at the scene of an emergency; or
50 (r) to licensing officers of New York state, as defined in subdivision
51 ten of section 265.00 of the penal law, for such officers to issue
52 firearm licenses pursuant to section 400.00 of the penal law.
53 (2) Notwithstanding subdivision one of this section, no agency may
54 disclose any record or personal information to a law enforcement agency
55 or law enforcement officer unless such disclosure is pursuant to para-
56 graphs (l), (p), (q), or (r) of subdivision one of this section.
S. 4044 5 A. 3051
1 (3) Nothing in this section shall require disclosure of[:
2 (a) personal information which is otherwise prohibited by law from
3 being disclosed;
4 (b) patient records concerning mental disability or medical records
5 where such disclosure is not otherwise required by law;
6 (c) personal information pertaining to the incarceration of an incar-
7 cerated individual at a state correctional facility which is evaluative
8 in nature or which, if disclosed, could endanger the life or safety of
9 any person, unless such disclosure is otherwise permitted by law;
10 (d) attorney's work product or material prepared for litigation before
11 judicial, quasi-judicial or administrative tribunals, as described in
12 subdivisions (c) and (d) of section three thousand one hundred one of
13 the civil practice law and rules, except pursuant to statute, subpoena
14 issued in the course of a criminal action or proceeding, court ordered
15 or grand jury subpoena, search warrant or other court ordered disclo-
16 sure] any record or personal information or expand an agency's or
17 governmental unit's ability to disclose any record or personal informa-
18 tion.
19 § 4. Section 97 of the public officers law, as added by chapter 652 of
20 the laws of 1983, is amended to read as follows:
21 § 97. [Civil remedies] Remedies. (1) Any data subject aggrieved by
22 any action taken under this article may seek judicial review and relief
23 pursuant to article seventy-eight of the civil practice law and rules.
24 (2) In any action brought under subdivision one of this section, the
25 plaintiff may seek:
26 (a) one thousand dollars per violation or actual damages, whichever is
27 greater; and
28 (b) punitive damages; and
29 (c) any other relief the court deems proper.
30 (3) In assessing the amount of punitive damages awarded to a plaintiff
31 in an action brought under subdivision one of this section, the court
32 shall consider:
33 (a) the defendant's pattern of violations of this article; and
34 (b) the impact of the violation on the data subject's exercise of
35 constitutional and statutory rights, including, but not limited to,
36 religion, political views, and medical care.
37 (4) In any proceeding brought under subdivision one of this section,
38 the party defending the action shall bear the burden of proof, and the
39 court [may] shall, if the data subject [substantially] prevails against
40 any agency [and if the agency lacked a reasonable basis pursuant to this
41 article for the challenged action], award to the data subject reasonable
42 attorneys' fees and disbursements reasonably incurred.
43 (5) Any information disclosed to a law enforcement agency in violation
44 of this article shall be inadmissible against the data subject in a
45 criminal or civil court, or administrative proceeding.
46 [(3)] (6) Nothing in this article shall be construed to limit or
47 abridge the right of any person to obtain judicial review or pecuniary
48 or other relief, in any other form or upon any other basis, otherwise
49 available to a person aggrieved by any agency action under this article.
50 § 5. This act shall take effect immediately.