NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A7191B
SPONSOR: Wallace (MS)
 
TITLE OF BILL: An act to amend the general business law, in relation
to prohibiting the disclosure of personally identifiable information by
an internet service provider without the express written approval of the
consumer
 
PURPOSE OF GENERAL IDEA OF BILL:
The bill provides protections to New Yorkers by requiring that internet
service providers ("ISPs") not sell consumer information, unless author-
ization is conspicuously requested and expressly given; nor may an ISP
refuse to provide service for failure to give consent.
 
SUMMARY OF SPECIFIC PROVISIONS:
Section 1. Amends the General Business Law as follows:
Add 399-k (1): defines the terms consumer, internet service provider
(ISP), and personally identifiable information.
Add 399-k (2): prohibits ISPs from disclosing a consumer's personal
information without express written consent.
Add 399-k (3): provides exceptions to the requirements of subsection 2
for the purpose of cooperating with law enforcement.
Add 399-k (4): requires ISPs to obtain consumer authorization for
disclosure and requires the authorization request to be conspicuous.
Add 399-k (5): requires the ISP to take reasonable steps to protect a
consumer's personal information.
Add 399-k (6): grants a right of action against an ISP where this
section is violated and excluding the right of action from any mandatory
arbitration clause that may exist in the contract between the ISP and
the consumer.
Add 399-k (7): to address other laws that may impact this section.
 
JUSTIFICATION:
This legislation is introduced in response to Congress's decision to
repeal internet privacy regulations set to take effect in early 2017.
This legislation requires ISPs to obtain the consent of their customers
before disclosing any personally identifiable information of the custom-
er, and prohibits an ISP from refusing service if a customer does not
want to give consent to disclosure.
This legislation gives customers control over whether their personal
data may be disclosed and shared. ISP providers have access to "an
unprecedented breath" of electronic personal information, including a
customer's name, address, financial information, every website visited,
the links clicked on in those websites, geo-location information, and
the content of our electronic communications. ISPs should not be permit-
ted to disclose such deeply personal information for commercial gain
without customer consent. This legislation places control over disclo-
sure in the hands of the customer, where it belongs, and prohibits an
ISP from refusing to provide service unless consent is given.
 
PRIOR LEGISLATIVE HISTORY:
New bill
 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:
None
 
EFFECTIVE DATE:
This act shall take effect immediately.