|SAME AS||No Same As|
|Add Art 29-CCC §§539 - 539-g, Gen Bus L|
|Establishes a prohibition on sharing location data with third parties; allows municipalities to enact local laws or ordinances prohibiting location data sharing.|
|08/07/2019||referred to consumer affairs and protection|
|01/08/2020||referred to consumer affairs and protection|
Go to top
NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A8530 SPONSOR: Abinanti
TITLE OF BILL: An act to amend the general business law, in relation to establishing a prohibition on sharing location data with third parties   PURPOSE OR GENERAL IDEA OF BILL: To prohibit telecommunications' carriers and mobile applications from sharing a user's location data.   SUMMARY OF SPECIFIC PROVISIONS: Section 1 of the bill amends the general business law by adding a new article 2-CCC entitled Prohibition on Sharing Location Data to: 1. Set forth the definitions to be used in the article including "authorized use," "customer," "location data," "mobile application," "mobile application developer," mobile application device;" "munici- pality;" "share;" and "telecommunications carrier." 2. Make it unlawful for a mobile application developer or a telecommuni- cations carrier to share a customer's location data where such location data was collected while the customer's mobile communication device was physically present in the state. 3. Make it unlawful for a person who receives location data that is shared in violation of the subdivision of this section to share such data with any other person. Each instance in which such data is shared in a manner prohibited by this section constitutes a separate violation of this section. 4. Set forth exceptions to the prohibition on sharing data including information provided to a law enforcement agency in response to a lawful process; information provided to an emergency service agency responding to a 911 communication or other communication reporting an imminent threat to life or property; information required to be provided by federal, state or local law; or a customer providing their own location data to be shared for an authorized use. 5. Require the office of information technology services to enforce the provisions of this section. 6. Set forth the penalties for violations of this act which includes $1,000 per violation, with a maximum penalty of $10,000 per day per person whose location data was unlawfully shared. 7. Provide a private right of action against telecommunications carriers and mobile application developers who violate this prohibition. 8. Authorize the director of the office of information technology services to promulgate and amend rules in furtherance of the adminis- tration of this article. 9. Provide that local laws or ordinances restricting the sharing of location data are not preempted by this article provided that the provisions of such local law or ordinance are at least as stringent as the provisions of this article. Section 2 is the effective date.   JUSTIFICATION: Every day, companies sell personal information from the apps on our phones and the phone companies themselves. The business of tracking and selling location data and other information of customers is extremely lucrative. Location information collected by cellphone companies and apps can provide an extraordinary invasive glimpse into the private lives of cellphone users including where and how they spend their time and money. This bill would protect a cellphone user's privacy by prohibiting tele- communications carriers and mobile applications from sharing a user's location data with another person, if the location is within the state. This bill would also prohibit anyone who receives such location data from sharing it with another person.   PRIOR LEGISLATIVE HISTORY: New bill.   FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS: None   EFFECTIVE DATE: This act shall take effect on the one hundred twentieth day after it shall have become law.
Go to top
STATE OF NEW YORK ________________________________________________________________________ 8530 2019-2020 Regular Sessions IN ASSEMBLY August 7, 2019 ___________ Introduced by M. of A. ABINANTI -- read once and referred to the Commit- tee on Consumer Affairs and Protection AN ACT to amend the general business law, in relation to establishing a prohibition on sharing location data with third parties The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The general business law is amended by adding a new article 2 29-CCC to read as follows: 3 ARTICLE 29-CCC 4 PROHIBITION ON SHARING LOCATION DATA 5 Section 539. Definitions. 6 539-a. Prohibition on sharing location data. 7 539-b. Exceptions. 8 539-c. Enforcement. 9 539-d. Penalties. 10 539-e. Private right of action. 11 539-f. Rulemaking. 12 539-g. Local laws or ordinances. 13 § 539. Definitions. As used in this article, the following terms shall 14 have the following meanings: 15 (a) (1) "Authorized use" means the sharing of a customer's location 16 data: 17 (i) for the purpose of providing a service explicitly requested by 18 such customer; 19 (ii) exclusively for the purpose of providing a service explicitly 20 requested by such customer; and 21 (iii) where such data is not collected, shared, stored or otherwise 22 used by a third party for any purpose other than providing a service 23 explicitly requested by such customer. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD13551-03-9A. 8530 2 1 (2) Such term does not include any instance in which a customer's 2 location data is shared in exchange for products or services. 3 (b) "Customer" means a current or former subscriber to a telecommuni- 4 cations carrier or a current or former user of a mobile application. 5 (c) "Location data" means information related to the physical or 6 geographical location of a person or the person's mobile communications 7 device, regardless of the particular technological method used to obtain 8 this information. 9 (d) "Mobile application" means a software program that runs on the 10 operating system of a mobile communications device. 11 (e) "Mobile application developer" means a person that owns, operates 12 or maintains a mobile application and makes such application available 13 for the use of customers, whether for a fee or otherwise. 14 (f) "Mobile communications device" means any portable wireless tele- 15 communications equipment that is utilized for the transmission or recep- 16 tion of data, including location data, and that is or may be commonly 17 carried by or on a person or commonly travels with a person, including 18 in or as part of a vehicle a person drives. 19 (g) "Municipality" shall mean any county, city, town or village within 20 the state. 21 (h) "Share" means to make location data available to another person, 22 whether for a fee or otherwise. 23 (i) "Telecommunications carrier" means a service offered to the public 24 for a fee that transmits sounds, images or data through wireless tele- 25 communications technology. 26 § 539-a. Prohibition on sharing location data. (a) It is unlawful for 27 a mobile application developer or a telecommunications carrier to share 28 a customer's location data where such location data was collected while 29 the customer's mobile communications device was physically present in 30 the state. 31 (b) It is unlawful for a person who receives location data that is 32 shared in violation of subdivision (a) of this section to share such 33 data with any other person. 34 (c) Each instance in which a mobile application developer, telecommu- 35 nications carrier or other person shares a customer's location data with 36 another person in a manner prohibited by this section constitutes a 37 separate violation of this section. 38 § 539-b. Exceptions. The provisions of section five hundred thirty- 39 nine-a of this article do not apply to: 40 (a) information provided to a law enforcement agency in response to a 41 lawful process; 42 (b) information provided to an emergency service agency responding to 43 a 911 communication or any other communication reporting an imminent 44 threat to life or property; 45 (c) information required to be provided by federal, state or local 46 law; or 47 (d) a customer providing the customer's own location data to a mobile 48 application or telecommunications carrier to be shared for an authorized 49 use. 50 § 539-c. Enforcement. The office of information technology services 51 shall enforce the provisions of this section. 52 § 539-d. Penalties. (a) Except as provided in subdivision (b) of this 53 section, any person who violates the provisions of section five hundred 54 thirty-nine-a of this article shall be subject to a civil penalty of one 55 thousand dollars for each such violation.A. 8530 3 1 (b) Where a person commits multiple violations of subdivision (a) or 2 (b) of section five hundred thirty-nine-a of this article on the same 3 day, the maximum civil penalty assessed against such person for all 4 violations occurring on such day shall be a cumulative penalty of ten 5 thousand dollars per person whose location data was shared unlawfully. 6 § 539-e. Private right of action. (a) Any customer whose location data 7 has been shared in violation of this article may bring an action in any 8 court of competent jurisdiction. If a court of competent jurisdiction 9 finds that a person has violated a provision of this article, the court 10 may award: (1) actual damages, computed at a rate of one thousand 11 dollars per violation up to ten thousand dollars per day; and (2) 12 reasonable attorney's fees and costs incurred in maintaining such civil 13 action. 14 (b) The private right of action provided by this section does not 15 supplant any other claim or cause of action available to a customer 16 under common law or by statute. The provisions of this section are in 17 addition to any such common law and statutory remedies. 18 (c) Nothing in this article shall be construed as creating a private 19 right of action against the city or any agency or employee thereof. 20 § 539-f. Rulemaking. The director of the office of information tech- 21 nology services may promulgate and amend rules in furtherance of the 22 administration of this article. 23 § 539-g. Local laws or ordinances. Nothing in this article shall be 24 deemed to preempt any provision of local law or ordinance restricting 25 the sharing of location data with third parties, provided that the 26 provisions of such local law or ordinance are at least as stringent as 27 the provisions of this article. 28 § 2. This act shall take effect on the one hundred twentieth day after 29 it shall have become a law.