STATE OF NEW YORK
________________________________________________________________________
6848
2019-2020 Regular Sessions
IN SENATE
November 13, 2019
___________
Introduced by Sen. THOMAS -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to requiring
registration of data brokers and directing the attorney general to
maintain a website of such registrations
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new article
2 44 to read as follows:
3 ARTICLE 44
4 DATA BROKER REGISTRY
5 Section 1400. Definitions.
6 1401. Annual registration.
7 1402. Website.
8 1403. Penalties.
9 § 1400. Definitions. For the purposes of this article, the following
10 terms shall have the following meanings:
11 1. "Consumer" shall mean a natural person who is a New York resident.
12 "Consumer" shall not include an employee or contractor of a business
13 acting in their role as an employee or contractor.
14 2. "Data broker" shall mean a business that knowingly collects and
15 sells to third parties the personal information of a consumer with whom
16 the business does not have a direct relationship. "Data broker" shall
17 not include a consumer reporting agency covered by the federal Fair
18 Credit Reporting Act or a financial institution covered by the Gramm-
19 Leach-Bliley Act or an entity covered by the Insurance Information and
20 Privacy Protection Act.
21 3. "Direct relationship" shall mean that the consumer is a past or
22 present: (a) customer, client, subscriber or user of the business's
23 goods or services; (b) employee, contractor or agent of the business;
24 (c) investor in the business; or (d) donor to the business.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD14182-01-9
S. 6848 2
1 4. "Personal information" shall mean any information concerning a
2 natural person which, because of name, number, personal mark, or other
3 identifier, can be used to identify such natural person.
4 § 1401. Annual registration. Annually, on or before January thirty-
5 first, a data broker, as defined under this article, shall:
6 1. register with the attorney general in a manner provided for by the
7 attorney general;
8 2. pay a registration fee in an amount determined by the attorney
9 general not to exceed the reasonable cost of establishing and maintain-
10 ing the informational website described in section fourteen hundred
11 three of this article; and
12 3. provide the following information:
13 (a) the name of the data broker and its primary physical, email and
14 internet website address;
15 (b) whether the data broker permits a consumer to: opt out of the data
16 broker's collection of brokered personal information; opt out of its
17 databases; or opt out of certain sales of data;
18 (c) the method for requesting an opt-out under paragraph (b) of this
19 subdivision;
20 (d) a statement specifying the data collection, databases, or sales
21 activities from which a consumer may not opt out; and
22 (e) any additional information or explanation the data broker chooses
23 to provide concerning its data collection practices.
24 § 1402. Website. The attorney general shall establish, manage and
25 maintain a statewide registry on its internet website, which shall list
26 all registered data brokers doing business in the state and make acces-
27 sible to the public all the information provided by data brokers pursu-
28 ant to this article. Printed hard copies of such registry shall be made
29 available upon request and payment of a fee to be determined by the
30 attorney general.
31 § 1403. Penalties. A data broker that fails to register is subject to
32 injunction and is liable for civil penalties of one hundred dollars for
33 each day that such data broker fails to register, an amount equal to the
34 fees due under this section during the period such data broker failed to
35 register and expenses incurred by the attorney general in the investi-
36 gation and prosecution of the action.
37 § 2. This act shall take effect on the first of January next succeed-
38 ing the date on which it shall have become a law.
