STATE OF NEW YORK ________________________________________________________________________ 3346 2017-2018 Regular Sessions IN ASSEMBLY January 27, 2017 ___________ Introduced by M. of A. ORTIZ, DINOWITZ, HIKIND, GOTTFRIED -- read once and referred to the Committee on Consumer Affairs and Protection AN ACT to amend the general business law, in relation to the collection and disclosure of certain information collected by on-line computer services The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The general business law is amended by adding a new section 2 397-b to read as follows: 3 § 397-b. On-line computer services. 1. As used in this section, the 4 following terms shall have the following meanings: 5 (a) "On-line computer service" means the offering of a capability for 6 generating, acquiring, storing, transforming, processing, retrieving, 7 utilizing or making available information using computer-based telecom- 8 munications. On-line computer service shall also include a service that 9 permits a subscriber to retrieve stored information from or file infor- 10 mation for storage in information storage facilities, electronic 11 publishing or an electronic messaging service. 12 (b) "Personal information" means information which identifies either a 13 specific file or service utilized or from an on-line computer service 14 and the subscriber and/or such subscriber's on-line computer address who 15 obtained such file or service. Personal information shall not include 16 any record of aggregate data which does not identify a file or service 17 utilized and a subscriber and/or such subscriber's on-line computer 18 address. 19 (c) "Disclose" or "disclosure" means the sale, rental or other dissem- 20 ination of personal information. 21 (d) "File" means a collection of related records treated as a unit. 22 (e) "Records" means a group of distinct data items in a computer 23 system, manipulated as a unit. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD08351-01-7A. 3346 2 1 2. Any person, firm, partnership or corporation which provides an 2 on-line computer service may not disclose personal information concern- 3 ing a subscriber to any other person, firm, partnership or corporation 4 unless such subscriber: 5 (a) has received the notice provided for in subdivision three of this 6 section; and 7 (b) has consented to the disclosure. 8 3. At the time of entering into an agreement to provide an on-line 9 computer service to a subscriber and at such time when a service is 10 obtained each and every on-line computer service shall provide notice in 11 the form of a separate statement to the subscriber that clearly and 12 conspicuously disclose the following to such subscriber: 13 (a) the nature of personal information collected or to be collected 14 with respect to the subscriber and the nature and use of the information 15 if any; 16 (b) the nature, frequency and purpose of any disclosure which may be 17 made of such information, including an identification of the types of 18 persons or person to whom such disclosure may be made; 19 (c) the period of time the information will be maintained; and 20 (d) a description of the procedures by which the subscriber may gain 21 access to the information. 22 Such notices may be provided electronically by using computer-based 23 telecommunications. 24 4. Upon request a subscriber shall be provided access to all personal 25 information regarding such subscriber that is collected and maintained 26 by an on-line computer service. Such information shall be made available 27 at reasonable times and at a convenient location to the subscriber. 28 Computer-based telecommunications may be the means by which such infor- 29 mation is provided to the subscriber. The subscriber shall be provided 30 reasonable opportunity by the on-line computer service to correct errors 31 in personal information and the on-line computer service shall promptly 32 correct such information. If the on-line computer service is unable to 33 resolve any remaining differences, a subscriber shall also be provided 34 with the opportunity to file a statement of explanation concerning the 35 nature of any dispute. 36 5. Notwithstanding subdivision two of this section, an on-line comput- 37 er service may disclose personal information if the disclosure is: 38 (a) necessary to render or conduct business or provide service to the 39 subscriber; 40 (b) made pursuant to a court order; 41 (c) for the purpose of extending credit to the subscriber or for a 42 check or credit card transaction when it is incidental to the sale or 43 other transfer of the accounts receivable of the on-line computer 44 service; and 45 (d) for the purpose of validating a check written by the subscriber. 46 6. No on-line computer service shall be deemed to have violated the 47 provisions of this section, if such on-line computer service shows by a 48 preponderance of the evidence that the violation was not intentional and 49 that it resulted from a bona fide error made notwithstanding the mainte- 50 nance of procedures reasonably adopted to avoid any such error. 51 7. Any subscriber who has been injured by reason of any violation of 52 this section may bring an action in his or her own name to enjoin such 53 unlawful act or practice, an action to recover his actual damages or one 54 hundred dollars, whichever is greater, or both such actions. The court 55 may, in its discretion, increase the award of damages to an amount not 56 to exceed three times the actual damages up to one thousand dollars, ifA. 3346 3 1 the court finds the defendant willfully or knowingly violated this 2 section. The court may award reasonable attorney's fees to a prevailing 3 plaintiff. 4 8. Whenever there shall be a violation of this section, an application 5 may be made by the attorney general in the name of the people of the 6 state of New York to a court or justice having jurisdiction to issue an 7 injunction, and upon notice to the defendant of not less than five days, 8 to enjoin and restrain the continuance of such violations; and if it 9 shall appear to the satisfaction of the court or justice that the 10 defendant has, in fact, violated this section, an injunction may be 11 issued by such court or justice, enjoining and restraining any further 12 violation, without requiring proof that any person has, in fact, been 13 injured or damaged thereby. In any such proceeding the court may make 14 allowances to the attorney general as provided in paragraph six of 15 subdivision (a) of section eighty-three hundred three of the civil prac- 16 tice law and rules, and direct restitution. Whenever the court shall 17 determine that a violation of this section has occurred, the court may 18 impose a civil penalty of not more than one thousand dollars for each 19 violation. In connection with any such proposed application, the attor- 20 ney general is authorized to take proof and make a determination of the 21 relevant facts and to issue subpoenas in accordance with the civil prac- 22 tice law and rules. 23 § 2. This act shall take effect on the first of November next succeed- 24 ing the date on which it shall have become a law.