Add 250.70 & 250.75, Pen L; add 209, St Tech L; add 899-cc, Gen Bus L; add 79-p, Civ Rts L
Protects people's privacy during contact tracing by creating the crimes of unlawful dissemination of contact tracing information and unlawful use of a surveillance drone and requires certain privacy measures be implemented in contact tracing applications.
STATE OF NEW YORK
________________________________________________________________________
8327
IN SENATE
May 11, 2020
___________
Introduced by Sen. JACOBS -- read twice and ordered printed, and when
printed to be committed to the Committee on Codes
AN ACT to amend the penal law, the state technology law, the general
business law and the civil rights law, in relation to protecting
people's privacy during contact tracing
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The penal law is amended by adding a new section 250.70 to
2 read as follows:
3 § 250.70 Unlawful dissemination of contact tracing information.
4 A person is guilty of unlawful dissemination of contact tracing infor-
5 mation when he or she:
6 1. knowingly uses, causes to be used, or accesses a computer, computer
7 service, or computer network without authorization and he or she thereby
8 knowingly gains access to contact tracing information; or
9 2. knowingly disseminates contact tracing information to any person
10 not authorized by the governor or the commissioner of the department of
11 health to receive such information. For the purposes of this section,
12 the term "contact tracing information" shall mean any information
13 collected for the purposes of performing the process of identification
14 of persons who may have come into contact with or into close proximity
15 to an infected person and any subsequent collection of additional infor-
16 mation about these persons and contacts.
17 Unlawful dissemination of contact tracing information is a class E
18 felony.
19 § 2. The penal law is amended by adding a new section 250.75 to read
20 as follows:
21 § 250.75 Unlawful use of a surveillance drone.
22 A person is guilty of unlawful use of a surveillance drone when he or
23 she knowingly uses or causes to be used a drone for the purposes of
24 surveillance without the consent of all persons within the area surv-
25 eilled by such drone for the purposes of collecting contact tracing
26 information or for monitoring the vital signs or social distancing prac-
27 tices of individuals.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD16269-02-0
S. 8327 2
1 For the purposes of this section, the term "contact tracing informa-
2 tion" shall mean any information collected for the purposes of perform-
3 ing the process of identification of persons who may have come into
4 contact with or into close proximity to an infected person and any
5 subsequent collection of further information about these persons and
6 contacts.
7 Unlawful use of a surveillance drone is a class E felony.
8 § 3. The state technology law is amended by adding a new section 209
9 to read as follows:
10 § 209. Contact tracing application privacy. 1. For the purposes of
11 this section, the term:
12 (a) "contact tracing information" shall mean any information collected
13 for the purposes of performing the process of identification of persons
14 who may have come into contact with or into close proximity to an
15 infected person and any subsequent collection of additional information
16 about these persons and contacts.
17 (b) "application" shall mean computer software, applications and other
18 forms of technology created and used for the purposes of collecting
19 contact tracing information.
20 2. The use of applications created for the purpose of collecting
21 contact tracing information shall be voluntary. The user of any applica-
22 tion shall be required to give explicit consent to the application being
23 downloaded, to the application being used, and to the application
24 providing any information collected to any person. The user shall be
25 provided with a conspicuous, plain language explanation of the applica-
26 tion, the application's functions and any information that the applica-
27 tion will collect prior to the user being able to give consent to the
28 download of the application. Such consent shall be revocable at anytime
29 at which point the application shall terminate the functionality to
30 which the user is no longer consenting. If consent to having the appli-
31 cation downloaded is revoked, the application shall fully remove itself
32 or enable the user to easily remove the application from the device it
33 is downloaded onto.
34 3. Any information stored or transmitted by an application shall be
35 stored or transmitted in an encrypted manner as to prevent access by an
36 unauthorized person.
37 4. Any information collected by an application shall be completely
38 deleted, destroyed and erased and no further information shall be
39 collected upon the end of the state public emergency requiring the
40 creation of the application.
41 5. Notwithstanding any other provision of law to the contrary, any
42 person, business or governmental entity in violation of this section
43 shall be liable to any person who used an application involuntarily or
44 without giving properly informed consent or whose contact tracing infor-
45 mation was disclosed or used improperly. Liability under this section is
46 in addition to any other applicable penalties and causes of action. An
47 action to recover damages under this section may be maintained as a
48 class action, notwithstanding subdivision b of section nine hundred one
49 of the civil practice law and rules.
50 § 4. The general business law is amended by adding a new section 899-
51 cc to read as follows:
52 § 899-cc. Contact tracing application privacy. 1. For the purposes of
53 this section, the term:
54 (a) "contact tracing information" shall mean any information collected
55 for the purposes of performing the process of identification of persons
56 who may have come into contact with or into close proximity to an
S. 8327 3
1 infected person and any subsequent collection of additional information
2 about these persons and contacts.
3 (b) "application" shall mean computer software, applications and other
4 forms of technology created and used for the purposes of collecting
5 contact tracing information.
6 2. The use of applications created for the purpose of collecting
7 contact tracing information shall be voluntary. The user of any applica-
8 tion shall be required to give explicit consent to the application being
9 downloaded, to the application being used, and to the application
10 providing any information collected to any person. The user shall be
11 provided with a conspicuous, plain language explanation of the applica-
12 tion, the application's functions and any information that the applica-
13 tion will collect prior to the user being able to give consent to the
14 download of the application. Such consent shall be revocable at any
15 time at which point the application shall terminate the functionality to
16 which the user is no longer consenting. If consent to having the appli-
17 cation downloaded is revoked, the application shall fully remove itself
18 or enable the user to easily remove the application from the device it
19 is downloaded onto.
20 3. Any information stored or transmitted by an application shall be
21 stored or transmitted in an encrypted manner as to prevent access by an
22 unauthorized person.
23 4. Any information collected by an application shall be completely
24 deleted, destroyed and erased and no further information shall be
25 collected upon the end of the state public emergency requiring the
26 creation of the application.
27 5. Notwithstanding any other provision of law to the contrary, any
28 person, business or governmental entity in violation of this section
29 shall be liable to any person who used an application involuntarily or
30 without giving properly informed consent or whose contact tracing infor-
31 mation was disclosed or used improperly. Liability under this section is
32 in addition to any other applicable penalties and causes of action. An
33 action to recover damages under this section may be maintained as a
34 class action, notwithstanding subdivision b of section nine hundred one
35 of the civil practice law and rules.
36 § 5. The civil rights law is amended by adding a new section 79-p to
37 read as follows:
38 § 79-p. Right to privacy; contact tracing. 1. The following defi-
39 nitions are applicable to this section:
40 (a) "contact tracing information" shall mean any information collected
41 for the purposes of performing the process of identification of persons
42 who may have come into contact with or into close proximity to an
43 infected person and any subsequent collection of further additional
44 information about these persons and contacts.
45 (b) "application" shall mean computer software, or applications and
46 other forms of technology created and used for the purposes of collect-
47 ing contact tracing information.
48 2. (a) No person, business, or governmental entity shall require the
49 download, installation or use of an application of the purposes of
50 collecting contact tracing information for any reason and the use of
51 such applications shall be voluntary.
52 (b) No person, business, or governmental entity shall restrict the
53 rights and privileges of a person based on such persons refusal to down-
54 load, installation or use of an application for the purposes of collect-
55 ing contact tracing information.
S. 8327 4
1 (c) No person, business, or governmental entity shall collect, use,
2 or distribute contact tracing information in violation of section 250.70
3 or 250.75 of the penal law, section two hundred nine of the state tech-
4 nology law, or section eight hundred ninety-nine-cc of the general busi-
5 ness law.
6 3. Any person aggrieved by a violation of the protections created by
7 this section shall have the right to bring an action or special proceed-
8 ing in a court of appropriate jurisdiction to seek damages and/or
9 declaratory and injunctive relief or any other remedies as provided by
10 law with respect to such violation. The right to bring an action under
11 this section is in addition to any other applicable penalties and causes
12 of action.
13 4. An action to recover damages under this section may be maintained
14 as a class action, notwithstanding subdivision b of section nine hundred
15 one of the civil practice law and rules.
16 § 6. This act shall take effect immediately.
