Enacts the telecommunications privacy law containing provisions regulating the collection, use or disclosure of information by telecommunications carriers; requires a telecommunication carrier to notify customers of the information collected and distributed; subjects a third party who receives information from a telecommunications carrier to privacy rules; grants a subscriber right to inspect and correct personal information; provides for enforcement for the attorney general; establishes legislature's intent to create comprehensive privacy protection for subscribers to all forms of telecommunications services.
STATE OF NEW YORK
________________________________________________________________________
2579
2011-2012 Regular Sessions
IN SENATE
January 26, 2011
___________
Introduced by Sen. KRUGER -- read twice and ordered printed, and when
printed to be committed to the Committee on Energy and Telecommuni-
cations
AN ACT to amend the public service law, in relation to protecting the
privacy of telecommunications subscribers
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The public service law is amended by adding a new article
2 5-A to read as follows:
3 ARTICLE 5-A
4 TELECOMMUNICATIONS PRIVACY LAW
5 Section 104. Short title.
6 104-a. Legislative intent.
7 104-b. Definitions.
8 104-c. Collection, use or disclosure of information.
9 104-d. Subscriber notice of carrier information practices.
10 104-e. Third parties.
11 104-f. Subscriber's right to inspect and correct information.
12 104-g. Monitoring or intercepting upstream communications chan-
13 nels.
14 104-h. Security measures.
15 104-i. Exception to written authorization requirement.
16 104-j. Examination or disclosure of aggregate data.
17 104-k. Enforcement.
18 104-l. Separability clause.
19 § 104. Short title. This article may be cited as the "Telecommuni-
20 cations Privacy Law".
21 § 104-a. Legislative intent. 1. The legislature finds that recent
22 advances in telecommunications and information technologies have rapidly
23 expanded the collection of personal data on individuals. The kinds of
24 data which can be gathered and the speed with which that data can be
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD07119-01-1
S. 2579 2
1 correlated, retrieved and disseminated are substantially increasing. The
2 increasing use of these technologies and their related systems, channels
3 and services has a serious potential for injury to individual privacy
4 that can occur from any collection, maintenance, use or dissemination of
5 personal information.
6 2. The right to privacy is a personal and fundamental right worthy of
7 protection through appropriate legislation.
8 3. Existing federal and state laws do not provide comprehensive priva-
9 cy protection for the wide range of technologies being used in telecom-
10 munications. Among these are telephony, open video systems, cable tele-
11 vision, satellite video services, wireless video services and wireless
12 voice services. The legislature intends to protect the welfare of the
13 people of New York by enabling them to participate in the use of such
14 technologies without unduly sacrificing their personal privacy.
15 4. The legislature also intends that businesses engaging in telecommu-
16 nications services in New York should also benefit from comprehensive
17 privacy protection for individuals. Comprehensive rules for all telecom-
18 munications firms should create a level playing field by eliminating
19 existing disparities between privacy requirements for different types of
20 technologies. Moreover, if New York consumers can use the new technolo-
21 gies with assurance that their privacy is protected, more consumers will
22 be likely to participate in their use.
23 5. In order to meet these goals, this article is based on the princi-
24 ples that telecommunications firms should collect, use and disclose only
25 such information as they genuinely need and that individuals should know
26 what information is collected on them and should control its disclosure.
27 § 104-b. Definitions. As used in this article:
28 1. "Telecommunications" means the transmission between or among points
29 specified by the user, of information of the user's choosing, without
30 change in the form or content of the information as sent and received,
31 by means of electromagnetic transmission, with or without benefit of any
32 closed transmission medium, including all instrumentalities, facilities,
33 apparatus, and services (including the collection, storage, forwarding,
34 switching, and delivery of such information) essential to such trans-
35 mission.
36 2. "Telecommunications carrier" means any provider of telecommuni-
37 cations services.
38 3. "Subscriber" means any person who receives any form of telecommuni-
39 cations service and any other authorized user of a person's subscriber
40 terminal.
41 4. "Personally identifiable information" means any information that
42 identifies any person as a subscriber to, or user of, a telecommuni-
43 cations carrier, or that otherwise provides information about that indi-
44 vidual or his use of any service provided by a telecommunications carri-
45 er, except listing information published in "white pages" directories.
46 5. "Ordinary course of business" means the provision of (a) the tele-
47 communications service from which personally identifiable information is
48 derived, or (b) services necessary to, or used in, the provision of such
49 telecommunications service, including the publishing of directories.
50 6. "Upstream communications channel" means a signaling path provided
51 by a telecommunications carrier for the transmission of signals over a
52 telecommunications system from subscriber terminals.
53 7. "Intercept" means to acquire, at any time from initiation to
54 completion of a signal transmission over a telecommunications system,
55 the content of the information contained in that signal.
S. 2579 3
1 8. "Third party" means a person other than the subscriber or a tele-
2 communications carrier or any affiliate or agent thereof; but, such term
3 shall not include an interconnecting carrier or an organization whose
4 objective is the detection, elimination or reduction of toll fraud,
5 which has a demonstrable and reasonable requirement for personally iden-
6 tifiable information.
7 9. "Generally available data base" means a single collection of
8 personally identifiable information generally used by a telecommuni-
9 cations carrier in the ordinary course of business. The personally
10 identifiable information contained in such data base may include such
11 information as subscriber name and address, amount due, equipment, bill-
12 ing records, contracts with the subscriber, deposit information, payment
13 information and billing adjustments.
14 § 104-c. Collection, use or disclosure of information. A telecommuni-
15 cations carrier may collect, receive, store, aggregate, use, rent, sell,
16 release or disclose personally identifiable information relating to any
17 subscriber, subscriber household, or user of a subscriber terminal only:
18 1. to the extent necessary to provide the carrier's telecommunications
19 services in the ordinary course of business;
20 2. with the subscriber consent described in section one hundred four-d
21 of this article;
22 3. to detect the unauthorized receipt of telecommunications services,
23 including cooperative efforts among carriers to detect, eliminate or
24 reduce toll fraud;
25 4. pursuant to a court order or subpoena;
26 5. as specifically permitted by the federal communications commission
27 or the public service commission; or
28 6. otherwise pursuant to law.
29 § 104-d. Subscriber notice of carrier information practices. 1. A
30 telecommunications carrier must notify a subscriber of the general
31 circumstances under which personally identifiable information, may be
32 collected, used or disclosed.
33 2. In the case of a subscriber contract entered into on or before the
34 effective date of this article, the notice must be provided within one
35 hundred twenty days immediately after such date. In the case of a
36 subscriber contract entered into after the effective date of this arti-
37 cle, the notice shall be provided at the time that the contract is
38 entered into. After the initial notice, notice must be provided at least
39 annually.
40 3. Notice must be in writing, clear and conspicuous, and in plain
41 English.
42 4. The telecommunications carrier shall not use personally identifi-
43 able information in a manner other than that described in the notice
44 without further written notice to the subscriber and, where required by
45 this article, the consent of the subscriber.
46 5. A subscriber may withdraw his permission at any time. This with-
47 drawal shall take effect thirty days after the subscriber notifies the
48 telecommunications carrier that consent is being withdrawn.
49 6. A telecommunications carrier shall not refuse to provide any tele-
50 communications service to any person on account of that person's refus-
51 ing to grant consent to collect, use or disclose personally identifiable
52 information.
53 7. A telecommunications carrier must obtain a subscriber's affirmative
54 consent before the carrier may rent, sell, release or disclose the
55 subscriber's personally identifiable information to a third party,
56 except as authorized in section one hundred four-c of this article. Such
S. 2579 4
1 affirmative consent may be obtained only if the telecommunications
2 carrier has notified the subscriber of: (a) the kind of personally iden-
3 tifiable information that the carrier will collect and the intended use
4 of that information; (b) the nature, frequency, and purpose of any
5 disclosure of that information; and (c) the persons to whom disclosure
6 may be made.
7 § 104-e. Third parties. 1. Use of personally identifiable information
8 by those receiving the information from a telecommunications carrier
9 pursuant to the provisions of this article is limited to the purposes
10 for which the disclosure is made.
11 2. Concurrent with, or prior to, the provision of personally identifi-
12 able information to others pursuant to the provisions of this article, a
13 telecommunications carrier shall give notice to the person receiving the
14 information of the provisions of this article. If personally identifi-
15 able information is provided on a continuing basis, notice shall be
16 provided at the time of or prior to the provision of the first of such
17 information and annually thereafter.
18 3. A third party which has received personally identifiable informa-
19 tion pursuant to this article shall not retain that information if no
20 longer needed for the purposes for which it was acquired, nor shall the
21 party rent, sell, release, or otherwise disclose that information to any
22 person, unless the third party does so in accordance with the provisions
23 of this article.
24 4. Every third party receiving personally identifiable information
25 pursuant to this section shall certify annually to the information
26 provider in writing that it is complying with the provisions of this
27 article.
28 § 104-f. Subscriber's right to inspect and correct information. 1. A
29 telecommunications carrier shall disclose to a subscriber all personally
30 identifiable information which the carrier possesses pertaining to that
31 subscriber stored on its generally applicable data base, upon written
32 request of the subscriber. Such disclosure shall be made within a
33 reasonable time from the receipt of the subscriber's request.
34 2. A subscriber may request to examine a copy of the information
35 described in this section upon reasonable notice. The information
36 supplied to the subscriber shall be in a legible format, which is capa-
37 ble of being understood by a reasonable person. The subscriber shall
38 bear reasonable copying and mailing costs occasioned by the examination.
39 3. A telecommunications carrier shall correct the information upon a
40 reasonable showing by the subscriber that personally identifiable infor-
41 mation contained therein is inaccurate. If the telecommunications carri-
42 er and subscriber cannot resolve a dispute about the accuracy of any
43 information concerning the subscriber, the subscriber may append to the
44 carrier's record of information a statement setting forth the nature of
45 the dispute. Such statement shall be retained in the carrier's records
46 so long as the disputed information is retained. Within forty-five days
47 of receiving this notification from the subscriber, the telecommuni-
48 cations carrier shall transmit a corrected copy of the information, or
49 the subscriber's appended statement, to any party which was given the
50 erroneous information. Copies of all such correspondence shall be sent
51 to the subscriber.
52 § 104-g. Monitoring or intercepting upstream communications channels.
53 1. Except as otherwise provided in this article, information derived
54 from any signal of an upstream communications channel transmitted from a
55 subscriber terminal for the purpose of monitoring individual household
56 or communicating patterns may not be disclosed except with the written
S. 2579 5
1 authorization of the subscriber. Such authorizing document must explain
2 in clear and plain English that information concerning the subscriber's
3 viewing patterns or practices may be disclosed. The provision of tele-
4 phony services shall be exempt from the requirements of this subdivi-
5 sion.
6 2. Except as otherwise provided by law, no person shall intercept a
7 signal of an upstream communications channel transmitted from a
8 subscriber terminal except the subscriber and the intended receiver of
9 the signal.
10 § 104-h. Security measures. A telecommunications carrier shall main-
11 tain such safeguards as are necessary to ensure the physical and elec-
12 tronic security and confidentiality of any personally identifiable
13 information concerning subscribers.
14 § 104-i. Exception to written authorization requirement. Written
15 authorization shall not be required for a telecommunications carrier to
16 conduct system-wide or individually addressed monitoring for the
17 purposes of verifying system integrity, controlling return transmission
18 paths, or for any purposes for which personally identifiable information
19 may be lawfully acquired pursuant to this article.
20 § 104-j. Examination or disclosure of aggregate data. This article
21 shall not prohibit the examination of aggregate data by, or the disclo-
22 sure of such data to, any third party, provided that the data contains
23 no personally identifiable information concerning any subscriber, his or
24 her household, or a user of his or her terminal.
25 § 104-k. Enforcement. 1. Any person found to have violated this arti-
26 cle, with gross negligence, shall be liable to the aggrieved subscriber
27 for all actual damages sustained by such subscriber as a direct result
28 of the violation, provided that any subscriber who prevails or substan-
29 tially prevails in any action brought under this section shall receive
30 not less than five hundred dollars in damages, regardless of the amount
31 of actual damage proved, plus costs, disbursements and reasonable attor-
32 neys' fees.
33 2. Whenever there shall be a violation of this article, an application
34 may be made by the attorney general in the name of the people of the
35 state of New York to a court or justice having jurisdiction by a special
36 proceeding to issue an injunction, and upon notice to the defendant of
37 not less than five days, to enjoin and restrain the continuation of such
38 violation; and if it shall appear to the satisfaction of the court or
39 justice that the defendant has, in fact, violated this article, an
40 injunction may be issued by such court or justice, enjoining and
41 restraining any further violation, without requiring proof that any
42 person has, in fact, been injured or damaged thereby. In any such
43 proceeding, the court may make allowances to the attorney general as
44 provided in paragraph six of subdivision (a) of section eighty-three
45 hundred three of the civil practice law and rules and direct restitu-
46 tion. Whenever the court shall determine that a grossly negligent
47 violation of this article has occurred, the court may impose a civil
48 penalty of not more than one thousand dollars for such violation. In
49 connection with any such proposed application, the attorney general is
50 authorized to take proof and make a determination of the relevant facts
51 and to issue subpoenas in accordance with the civil practice law and
52 rules.
53 3. The remedies provided by this article shall be in addition to any
54 other lawful remedy available to a subscriber.
S. 2579 6
1 4. No action may be brought under the provisions of this section
2 unless such action is commenced within two years immediately from the
3 date of the act complained of or of the date of discovery of such act.
4 § 104-l. Separability clause. If any clause, sentence, paragraph,
5 section or part of this article shall be adjudged by any court of compe-
6 tent jurisdiction to be invalid or unconstitutional, such judgment shall
7 not affect, impair or invalidate the remainder thereof, but shall be
8 confined in its operation to the clause, sentence, paragraph, section or
9 part thereof directly involved in the controversy in which such judgment
10 shall have been rendered.
11 § 2. This act shall take effect on the first of July next succeeding
12 the date on which it shall have become a law.
