BILL NUMBER: S3044
SPONSOR: GONZALEZ
 
TITLE OF BILL:
An act to amend the general business law, in relation to the management
and oversight of personal data
 
PURPOSE GENERAL IDEA 0F BILL:
The purpose of the bill is to help New Yorkers regain control over their
personal data. The New York Privacy Act would require companies to
obtain consent from consumers before processing their personal data.
 
SUMMARY OF PROVISIONS:
Section 1 of the bill provides the name of the act, the "New York Priva-
cy Act". Section 2 of the bill contains the legislative intent.
Section 3 of the bill amends the general business taw by adding a new
article 42-A.
Section 1200 of the new article 42-A provides definitions of relevant
terms to be used in this act.
Section 1201 of the new article 42-A sets out the jurisdictional scope
of this article .
Section 1202 of the new article 42-A delineates consumer rights includ-
ing notice of how data is being used, the right to opt-out of data proc-
essing, a requiring opt-in for processing sensitive data, the right to
request access and obtain a copy of their data, the right to request the
correction of inaccurate data and the right to deletion of data.
Section 1203 of the new article 42-A defines the responsibilities and
obligations of controllers, processors and third parties.
Section 1204 of the new article 42-A requires data brokers to register
and pay an annual fee to the Attorney General, and to submit information
regarding the data broker's data use practices and contact information.
Section 1205 of the new article 42-A describes situations when control-
lers and processors may be exempt from compliance with the obligations
in this article.
Section 1206 of the new article 42-A provides for enforcement by the
Attorney General.
Section 1207 of the new article 42-A contains miscellaneous provisions,
including a conflict preemption clause, timing for the Attorney General
to submit a report on the effectiveness of the article, regulatory
authority for the Attorney General, and how consumers can exercise their
rights under this article.
Section 4 of the bill provides that the act will take effect immediate-
ly, provided that sections 1201, 1202, 1203, 1205, 1206 and 1207 of the
general business law, as added by section three of this act, shall take
effect one year after the effective date.
 
JUSTIFICATION:
According to a Pew survey from 2018, 69% of American adults use at least
one social media platform, up from 5% in 2005. Americans use these plat-
forms to engage with friends and family, to connect with social and
political organizations, and to follow news and current events. Despite
the platforms' usefulness, many social media users have reservations
about the handling of their personal information. A 2014 Pew survey
found that 91% of Americans believe that people have lost control over
how their personal information is collected and used. Some 80% of social
media users said they were concerned about advertisers and businesses
accessing and using data that they share on social media platforms.
Around 64% of people in this survey also said that the government should
do more to address this issue.
Social media companies obtain their revenues through targeted advertis-
ing based on users' likes, shares, searches, phone numbers, emails, and
other information provided while they use these platforms. According to
The New York Times, some of the largest social media companies fail to
inform or obtain consent from users regarding the sharing of their
personal data. In some instances, these social media companies share the
information of hundreds of millions of users without notifying them. It
also found that if users were to choose the most restrictive privacy
settings made available, their personal data was stilt shareable with
some external companies or affiliates. According to these large social
media companies, any information shared on these platforms can be given
to other companies without any additional consent.
Currently, there are no federal regulations addressing this privacy
issue, and the few attempts at self-regulation by these companies fall
welt short of addressing consumers' concerns. New York must join the
growing number of other states to fill this void.
 
PRIOR LEGISLATIVE HISTORY:
2024: S365B (Thomas) - Passed Senate
2024: S365B (Thomas) - Reported from Finance and committed to Rules
2024: S365B (Thomas) - Reported from Internet and Technology and commit-
ted to Finance
2024: S365B (Thomas) - Reported from Consumer Protection and committed
to Internet and Technology
2023: S365B (Thomas) - Passed Senate
2023: S365B (Thomas) - Reported from Finance and committed to Rules
2023: S365A (Thomas) - Reported from Internet and Technology and commit-
ted to Finance
2023: S365 (Thomas) - Reported from Consumer Protection and committed to
Internet and Technology
2021-22: S6701B (Thomas) - Reported from Consumer Protection and commit-
ted to Internet and Technology.
2019-20: S5642 (Thomas) / A8526 (L. Rosenthal) - Advanced to third read-
ing calendar.
 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:
None.
 
EFFECTIVE DATE:
The act will take effect immediately, provided that sections 1201, 1202,
1203, 1205, 1206 and 1207 of the general business taw, as added by
section three of this act, shall take effect one year after the effec-
tive date.