STATE OF NEW YORK
________________________________________________________________________
4044--A
2023-2024 Regular Sessions
IN SENATE
February 2, 2023
___________
Introduced by Sens. GONZALEZ, BRISPORT, BROUK, FERNANDEZ, HOYLMAN-SIGAL,
SALAZAR, SEPULVEDA -- read twice and ordered printed, and when printed
to be committed to the Committee on Investigations and Government
Operations -- recommitted to the Committee on Investigations and
Government Operations in accordance with Senate Rule 6, sec. 8 --
committee discharged, bill amended, ordered reprinted as amended and
recommitted to said committee
AN ACT to amend the public officers law, in relation to disclosing
personal information
The People of the State of New York, represented in Senate and Assem-
bly, do enact as follows:
1 Section 1. Section 92 of the public officers law, as added by chapter
2 652 of the laws of 1983, subdivision 8 as amended by section 135 of
3 subpart B of part C of chapter 62 of the laws of 2011 and the opening
4 paragraph of subdivision 9 as amended by chapter 313 of the laws of
5 1991, is amended to read as follows:
6 § 92. Definitions. (1) Agency. The term "agency" means any state
7 board, bureau, committee, commission, council, department, public
8 authority, public benefit corporation, division, office or any other
9 governmental entity performing a governmental or proprietary function
10 for the state of New York, except the judiciary or the state legislature
11 or any unit of local government and shall not include offices of
12 district attorneys.
13 (2) Committee. The term "committee" means the committee on open
14 government as constituted pursuant to subdivision one of section eight-
15 y-nine of this chapter.
16 (3) Data subject. The term "data subject" means any natural person
17 about whom personal information has been collected by an agency.
18 (4) Disclose. The term "disclose" means to reveal, release, transfer,
19 disseminate or otherwise communicate personal information or records
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04764-02-3
S. 4044--A 2
1 orally, in writing or by electronic or any other means other than to the
2 data subject.
3 (5) 911 services dispatcher. The term "911 services dispatcher" means
4 a person who receives reports of emergencies via a 911 system or E911
5 system as defined in subdivision three of section three hundred one of
6 the county law.
7 (6) Emergency medical services personnel. The term "emergency medical
8 services personnel" means individuals designated as such in subdivision
9 five of section twenty-nine hundred ninety-four-aa of the public health
10 law.
11 (7) Governmental unit. The term "governmental unit" means any govern-
12 mental entity performing a governmental or proprietary function for the
13 federal government or for any state or any municipality thereof.
14 [(6)] (8) Law. The term "law" means state or federal statute, rule or
15 regulation.
16 [(7)] (9) Law enforcement agency. The term "law enforcement agency"
17 shall have the same meaning as in subdivision four of section 705.00 of
18 the criminal procedure law.
19 (10) Law enforcement officer. The term "law enforcement officer" means
20 a police officer or peace officer as defined in section 1.20 of the
21 criminal procedure law.
22 (11) Police agency. The term "police agency" has the same meaning as
23 in subdivision eight of section eight hundred thirty-five of the execu-
24 tive law.
25 (12) Personal information. The term "personal information" means any
26 information concerning a data subject which, because of name, number,
27 symbol, mark or other identifier, alone or in combination with other
28 information, can be used to identify that data subject or be associated
29 with an identified data subject.
30 [(8)] (13) Public safety agency record. The term "public safety agency
31 record" means a record of the state commission of correction, the tempo-
32 rary state commission of investigation, the department of corrections
33 and community supervision, the office of children and family services,
34 the office of victim services, the office of probation and correctional
35 alternatives or the division of state police or of any agency or compo-
36 nent thereof whose primary function is the enforcement of civil or crim-
37 inal statutes if such record pertains to investigation, law enforcement,
38 confinement of persons in correctional facilities or supervision of
39 persons pursuant to criminal conviction or court order, and any records
40 maintained by the division of criminal justice services pursuant to
41 sections eight hundred thirty-seven, eight hundred thirty-seven-a, eight
42 hundred thirty-seven-b, eight hundred thirty-seven-c, eight hundred
43 thirty-eight, eight hundred thirty-nine, and eight hundred forty-five of
44 the executive law and by the department of state pursuant to section
45 ninety-nine of the executive law.
46 [(9)] (14) Record. The term "record" means any item, collection or
47 grouping of personal information about a data subject which is main-
48 tained and is retrievable by use of the name or other identifier of the
49 data subject irrespective of the physical form or technology used to
50 maintain such personal information. The term "record" shall not include
51 personal information which is not used to make any determination about
52 the data subject if it is:
53 (a) a telephone book or directory which is used exclusively for tele-
54 phone and directory information;
55 (b) any card catalog, book or other resource material in any library;
S. 4044--A 3
1 (c) any compilation of information containing names and addresses only
2 which is used exclusively for the purpose of mailing agency information;
3 (d) personal information required by law to be maintained, and
4 required by law to be used, only for statistical research or reporting
5 purposes;
6 (e) information requested by the agency which is necessary for the
7 agency to answer unsolicited requests by the data subject for informa-
8 tion; or
9 (f) correspondence files.
10 [(10)] (15) Routine use. The term "routine use" means, with respect to
11 the disclosure of a record or personal information, any use of such
12 record or personal information relevant to the purpose for which it was
13 collected, and which use is necessary to the statutory duties of the
14 agency that collected or obtained the record or personal information, or
15 necessary for that agency to operate a program specifically authorized
16 by law.
17 [(11)] (16) System of records. The term "system of records" means any
18 group of records under the actual or constructive control of any agency
19 pertaining to one or more data subjects from which personal information
20 is retrievable by use of the name or other identifier of a data subject.
21 § 2. Section 96 of the public officers law, as added by chapter 652 of
22 the laws of 1983, paragraph (j) of subdivision 1 as amended by chapter
23 1015 of the laws of 1984, paragraph (n) of subdivision 1 as amended by
24 chapter 319 of the laws of 2014, paragraphs (o) and (p) of subdivision 1
25 as amended by section 1 of part S of chapter 58 of the laws of 2022, and
26 paragraph (c) of subdivision 2 as amended by chapter 322 of the laws of
27 2021, is amended to read as follows:
28 § 96. Disclosure of records. (1) No agency may disclose any record or
29 personal information unless such disclosure is:
30 (a) pursuant to a written request by or the voluntary written consent
31 of the data subject, provided that such request or consent by its terms
32 limits and specifically describes:
33 (i) the personal information which is requested to be disclosed;
34 (ii) the person or entity to whom such personal information is
35 requested to be disclosed; and
36 (iii) the uses which will be made of such personal information by the
37 person or entity receiving it; or
38 (b) to those officers and employees of, and to those who contract
39 with, the agency that maintains the record if such disclosure is neces-
40 sary to the performance of their official duties pursuant to a purpose
41 of the agency required to be accomplished by statute or executive order
42 or necessary to operate a program specifically authorized by law; or
43 (c) subject to disclosure under article six of this chapter, unless
44 disclosure of such information would constitute an unwarranted invasion
45 of personal privacy as defined in paragraph (a) of subdivision two of
46 section eighty-nine of this chapter; or
47 (d) to officers or employees of another governmental unit if each
48 category of information sought to be disclosed is necessary for the
49 receiving governmental unit to operate a program specifically authorized
50 by statute and if the use for which the information is requested is not
51 relevant to the purpose for which it was collected; or
52 (e) for a routine use, as defined in subdivision [ten] fifteen of
53 section ninety-two of this article; or
54 (f) specifically authorized by statute or federal rule or regulation;
55 or
S. 4044--A 4
1 (g) to the bureau of the census for purposes of planning or carrying
2 out a census or survey or related activity pursuant to the provisions of
3 Title XIII of the United States Code; or
4 (h) to a person who has provided the agency with advance written
5 assurance that the record will be used solely for the purpose of statis-
6 tical research or reporting, but only if it is to be transferred in a
7 form that does not and cannot reveal the identity of any data subject,
8 alone or in combination with other available information; or
9 (i) pursuant to a showing of compelling circumstances affecting the
10 health or safety of a data subject, if upon such disclosure notification
11 is transmitted to the data subject at [his or her] their last known
12 address; or
13 (j) to the state archives as a record which has sufficient historical
14 or other value to warrant its continued preservation by the state or for
15 evaluation by the state archivist or [his or her] their designee to
16 determine whether the record has such value; or
17 (k) to any person pursuant to a court ordered subpoena or other
18 compulsory legal process; or
19 (l) from one public safety agency record for inclusion in [a] another
20 public safety agency record or from one public safety agency record to
21 any governmental unit or component thereof which performs as one of its
22 principal functions any activity pertaining to the enforcement of crimi-
23 nal laws, provided that, such record is reasonably described and is
24 requested solely for a law enforcement function, and further provided
25 that data may not be transferred under this paragraph to United States
26 Immigrations and Customs Enforcement, United States Customs and Border
27 Protection, any other entity for the purposes of immigration enforce-
28 ment, or to any out-of-state law enforcement agency, law enforcement
29 officer, or police agency for the enforcement of any criminal law the
30 elements of which would not constitute a crime in the state of New York;
31 or
32 (m) pursuant to a search warrant; or
33 (n) to officers or employees of another agency if the record sought to
34 be disclosed is necessary for the receiving agency to comply with the
35 mandate of an executive order, but only if such records are to be used
36 only for statistical research, evaluation or reporting and are not used
37 in making any determination about a data subject; or
38 (o) to officers or employees of a public retirement system of the city
39 of New York if the information sought to be disclosed is necessary for
40 the receiving public retirement system to process benefits under the
41 retirement and social security law, the administrative code of the city
42 of New York, or the education law or any other applicable provision of
43 law. A written request or consent from the data subject pursuant to
44 paragraph (a) of this subdivision shall not be required for the disclo-
45 sure of records pursuant to this paragraph; or
46 (p) to officers or employees of the United States department of educa-
47 tion for such department to process credit for qualifying employment and
48 loan forgiveness under the public service loan forgiveness program. A
49 written request or consent from the data subject pursuant to paragraph
50 (a) of this subdivision shall not be required for the disclosure of
51 records pursuant to this paragraph; or
52 (q) necessary to prevent an immediate and substantial risk of death,
53 significant bodily harm, significant damage to property, or is otherwise
54 necessary to respond to an immediate emergency; or
55 (r) disclosed by a 911 service dispatcher in the course of responding
56 to an emergency reported via a 911 system or E911 system to emergency
S. 4044--A 5
1 medical services personnel, law enforcement officers, or others respon-
2 sible for providing assistance at the scene of an emergency; or
3 (s) to licensing officers of New York state, as defined in subdivision
4 ten of section 265.00 of the penal law, for such officers to issue
5 firearm licenses pursuant to section 400.00 of the penal law.
6 (2) Notwithstanding subdivision one of section ninety-two of this
7 article, for the purposes of this section, the term "agency" has the
8 same meaning as in subdivision three of section eighty-six of this chap-
9 ter.
10 (3) Notwithstanding subdivision one of this section, no agency may
11 disclose any record or personal information to a law enforcement agency,
12 law enforcement officer, or police agency unless such disclosure is
13 pursuant to paragraph (k), (l), (m), (q), (r), or (s) of subdivision one
14 of this section, and no agency other than a law enforcement agency or
15 police agency may disclose any record or personal information to a law
16 enforcement agency, law enforcement officer, or police agency pursuant
17 to paragraph (l) of subdivision one of this section.
18 (4) (a) An agency may only disclose records or personal information to
19 a person or entity that is not an agency pursuant to paragraph (b) or
20 (e) of subdivision one of this section if such person or entity agrees
21 in writing not to disclose such records or personal information to a law
22 enforcement agency, law enforcement officer, or police agency except
23 pursuant to this section.
24 (b) If an agency enters into a partnership or agreement with another
25 entity to provide services, and such other entity directly collects
26 records or personal information pursuant to such a partnership or agree-
27 ment, the entity may not disclose the records or personal information
28 other than pursuant to paragraph (k), (l), (m), (q), (r), or (s) of
29 subdivision one of this section.
30 (c) No agency shall enter into an agreement described in paragraph (b)
31 of this subdivision with any police agency or law enforcement agency.
32 (5) Nothing in this section shall require disclosure of[:
33 (a) personal information which is otherwise prohibited by law from
34 being disclosed;
35 (b) patient records concerning mental disability or medical records
36 where such disclosure is not otherwise required by law;
37 (c) personal information pertaining to the incarceration of an incar-
38 cerated individual at a state correctional facility which is evaluative
39 in nature or which, if disclosed, could endanger the life or safety of
40 any person, unless such disclosure is otherwise permitted by law;
41 (d) attorney's work product or material prepared for litigation before
42 judicial, quasi-judicial or administrative tribunals, as described in
43 subdivisions (c) and (d) of section three thousand one hundred one of
44 the civil practice law and rules, except pursuant to statute, subpoena
45 issued in the course of a criminal action or proceeding, court ordered
46 or grand jury subpoena, search warrant or other court ordered disclo-
47 sure] any record or personal information or expand an agency's or
48 governmental unit's ability to disclose any record or personal informa-
49 tion.
50 § 3. Section 97 of the public officers law, as added by chapter 652 of
51 the laws of 1983, is amended to read as follows:
52 § 97. [Civil remedies] Remedies. (1) Any data subject aggrieved by
53 any action taken under this article may seek judicial review and relief
54 pursuant to article seventy-eight of the civil practice law and rules.
55 (2) In any action brought under subdivision one of this section, the
56 plaintiff may seek:
S. 4044--A 6
1 (a) one thousand dollars per violation or actual damages, whichever is
2 greater; and
3 (b) punitive damages; and
4 (c) any other relief the court deems proper.
5 (3) In assessing the amount of punitive damages awarded to a plaintiff
6 in an action brought under subdivision one of this section, the court
7 shall consider:
8 (a) the defendant's pattern of violations of this article; and
9 (b) the impact of the violation on the data subject's exercise of
10 constitutional and statutory rights, including, but not limited to,
11 religion, political views, and medical care.
12 (4) In any proceeding brought under subdivision one of this section,
13 the party defending the action shall bear the burden of proof, and the
14 court [may] shall, if the data subject [substantially] prevails against
15 any agency [and if the agency lacked a reasonable basis pursuant to this
16 article for the challenged action], award to the data subject reasonable
17 attorneys' fees and disbursements reasonably incurred.
18 [(3)] (5) Any information disclosed to a law enforcement agency, law
19 enforcement officer, or police agency in violation of this article shall
20 be inadmissible against the data subject in a criminal or civil court,
21 or administrative proceeding.
22 (6) Nothing in this article shall be construed to limit or abridge the
23 right of any person to obtain judicial review or pecuniary or other
24 relief, in any other form or upon any other basis, otherwise available
25 to a person aggrieved by any agency action under this article.
26 § 4. This act shall take effect immediately.