•  Summary 
  •  
  •  Actions 
  •  
  •  Committee Votes 
  •  
  •  Floor Votes 
  •  
  •  Memo 
  •  
  •  Text 
  •  
  •  LFIN 
  •  
  •  Chamber Video/Transcript 

AB8530 Summary:

BILL NOA08530
 
SAME ASNo Same As
 
SPONSORAbinanti
 
COSPNSR
 
MLTSPNSR
 
Add Art 29-CCC 539 - 539-g, Gen Bus L
 
Establishes a prohibition on sharing location data with third parties; allows municipalities to enact local laws or ordinances prohibiting location data sharing.
Go to top    

AB8530 Actions:

BILL NOA08530
 
08/07/2019referred to consumer affairs and protection
01/08/2020referred to consumer affairs and protection
Go to top

AB8530 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A8530
 
SPONSOR: Abinanti
  TITLE OF BILL: An act to amend the general business law, in relation to establishing a prohibition on sharing location data with third parties   PURPOSE OR GENERAL IDEA OF BILL: To prohibit telecommunications' carriers and mobile applications from sharing a user's location data.   SUMMARY OF SPECIFIC PROVISIONS: Section 1 of the bill amends the general business law by adding a new article 2-CCC entitled Prohibition on Sharing Location Data to: 1. Set forth the definitions to be used in the article including "authorized use," "customer," "location data," "mobile application," "mobile application developer," mobile application device;" "munici- pality;" "share;" and "telecommunications carrier." 2. Make it unlawful for a mobile application developer or a telecommuni- cations carrier to share a customer's location data where such location data was collected while the customer's mobile communication device was physically present in the state. 3. Make it unlawful for a person who receives location data that is shared in violation of the subdivision of this section to share such data with any other person. Each instance in which such data is shared in a manner prohibited by this section constitutes a separate violation of this section. 4. Set forth exceptions to the prohibition on sharing data including information provided to a law enforcement agency in response to a lawful process; information provided to an emergency service agency responding to a 911 communication or other communication reporting an imminent threat to life or property; information required to be provided by federal, state or local law; or a customer providing their own location data to be shared for an authorized use. 5. Require the office of information technology services to enforce the provisions of this section. 6. Set forth the penalties for violations of this act which includes $1,000 per violation, with a maximum penalty of $10,000 per day per person whose location data was unlawfully shared. 7. Provide a private right of action against telecommunications carriers and mobile application developers who violate this prohibition. 8. Authorize the director of the office of information technology services to promulgate and amend rules in furtherance of the adminis- tration of this article. 9. Provide that local laws or ordinances restricting the sharing of location data are not preempted by this article provided that the provisions of such local law or ordinance are at least as stringent as the provisions of this article. Section 2 is the effective date.   JUSTIFICATION: Every day, companies sell personal information from the apps on our phones and the phone companies themselves. The business of tracking and selling location data and other information of customers is extremely lucrative. Location information collected by cellphone companies and apps can provide an extraordinary invasive glimpse into the private lives of cellphone users including where and how they spend their time and money. This bill would protect a cellphone user's privacy by prohibiting tele- communications carriers and mobile applications from sharing a user's location data with another person, if the location is within the state. This bill would also prohibit anyone who receives such location data from sharing it with another person.   PRIOR LEGISLATIVE HISTORY: New bill.   FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS: None   EFFECTIVE DATE: This act shall take effect on the one hundred twentieth day after it shall have become law.
Go to top

AB8530 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                          8530
 
                               2019-2020 Regular Sessions
 
                   IN ASSEMBLY
 
                                     August 7, 2019
                                       ___________
 
        Introduced by M. of A. ABINANTI -- read once and referred to the Commit-
          tee on Consumer Affairs and Protection
 
        AN  ACT to amend the general business law, in relation to establishing a
          prohibition on sharing location data with third parties
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section 1. The general business law is amended by adding a new article
     2  29-CCC to read as follows:
 
     3                               ARTICLE 29-CCC
     4                    PROHIBITION ON SHARING LOCATION DATA
 
     5  Section 539. Definitions.
     6          539-a. Prohibition on sharing location data.
     7          539-b. Exceptions.
     8          539-c. Enforcement.
     9          539-d. Penalties.
    10          539-e. Private right of action.
    11          539-f. Rulemaking.
    12          539-g. Local laws or ordinances.
    13    § 539. Definitions. As used in this article, the following terms shall
    14  have the following meanings:
    15    (a)  (1)  "Authorized  use" means the sharing of a customer's location
    16  data:
    17    (i) for the purpose of providing a  service  explicitly  requested  by
    18  such customer;
    19    (ii)  exclusively  for  the  purpose of providing a service explicitly
    20  requested by such customer; and
    21    (iii) where such data is not collected, shared,  stored  or  otherwise
    22  used  by  a  third  party for any purpose other than providing a service
    23  explicitly requested by such customer.
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD13551-03-9

        A. 8530                             2

     1    (2) Such term does not include any  instance  in  which  a  customer's
     2  location data is shared in exchange for products or services.
     3    (b)  "Customer" means a current or former subscriber to a telecommuni-
     4  cations carrier or a current or former user of a mobile application.
     5    (c) "Location data" means  information  related  to  the  physical  or
     6  geographical  location of a person or the person's mobile communications
     7  device, regardless of the particular technological method used to obtain
     8  this information.
     9    (d) "Mobile application" means a software program  that  runs  on  the
    10  operating system of a mobile communications device.
    11    (e)  "Mobile application developer" means a person that owns, operates
    12  or maintains a mobile application and makes such  application  available
    13  for the use of customers, whether for a fee or otherwise.
    14    (f)  "Mobile  communications device" means any portable wireless tele-
    15  communications equipment that is utilized for the transmission or recep-
    16  tion of data, including location data, and that is or  may  be  commonly
    17  carried  by  or on a person or commonly travels with a person, including
    18  in or as part of a vehicle a person drives.
    19    (g) "Municipality" shall mean any county, city, town or village within
    20  the state.
    21    (h) "Share" means to make location data available to  another  person,
    22  whether for a fee or otherwise.
    23    (i) "Telecommunications carrier" means a service offered to the public
    24  for  a  fee that transmits sounds, images or data through wireless tele-
    25  communications technology.
    26    § 539-a. Prohibition on sharing location data. (a) It is unlawful  for
    27  a  mobile application developer or a telecommunications carrier to share
    28  a customer's location data where such location data was collected  while
    29  the  customer's  mobile  communications device was physically present in
    30  the state.
    31    (b) It is unlawful for a person who receives  location  data  that  is
    32  shared  in  violation  of  subdivision (a) of this section to share such
    33  data with any other person.
    34    (c) Each instance in which a mobile application developer,  telecommu-
    35  nications carrier or other person shares a customer's location data with
    36  another  person  in  a  manner  prohibited by this section constitutes a
    37  separate violation of this section.
    38    § 539-b. Exceptions. The provisions of section  five  hundred  thirty-
    39  nine-a of this article do not apply to:
    40    (a)  information provided to a law enforcement agency in response to a
    41  lawful process;
    42    (b) information provided to an emergency service agency responding  to
    43  a  911  communication  or  any other communication reporting an imminent
    44  threat to life or property;
    45    (c) information required to be provided by  federal,  state  or  local
    46  law; or
    47    (d)  a customer providing the customer's own location data to a mobile
    48  application or telecommunications carrier to be shared for an authorized
    49  use.
    50    § 539-c. Enforcement. The office of  information  technology  services
    51  shall enforce the provisions of this section.
    52    §  539-d. Penalties. (a) Except as provided in subdivision (b) of this
    53  section, any person who violates the provisions of section five  hundred
    54  thirty-nine-a of this article shall be subject to a civil penalty of one
    55  thousand dollars for each such violation.

        A. 8530                             3
 
     1    (b)  Where  a person commits multiple violations of subdivision (a) or
     2  (b) of section five hundred thirty-nine-a of this article  on  the  same
     3  day,  the  maximum  civil  penalty  assessed against such person for all
     4  violations occurring on such day shall be a cumulative  penalty  of  ten
     5  thousand dollars per person whose location data was shared unlawfully.
     6    § 539-e. Private right of action. (a) Any customer whose location data
     7  has  been shared in violation of this article may bring an action in any
     8  court of competent jurisdiction. If a court  of  competent  jurisdiction
     9  finds  that a person has violated a provision of this article, the court
    10  may award: (1) actual damages,  computed  at  a  rate  of  one  thousand
    11  dollars  per  violation  up  to  ten  thousand  dollars per day; and (2)
    12  reasonable attorney's fees and costs incurred in maintaining such  civil
    13  action.
    14    (b)  The  private  right  of  action provided by this section does not
    15  supplant any other claim or cause of  action  available  to  a  customer
    16  under  common  law  or by statute. The provisions of this section are in
    17  addition to any such common law and statutory remedies.
    18    (c) Nothing in this article shall be construed as creating  a  private
    19  right of action against the city or any agency or employee thereof.
    20    §  539-f.  Rulemaking. The director of the office of information tech-
    21  nology services may promulgate and amend rules  in  furtherance  of  the
    22  administration of this article.
    23    §  539-g.  Local  laws or ordinances. Nothing in this article shall be
    24  deemed to preempt any provision of local law  or  ordinance  restricting
    25  the  sharing  of  location  data  with  third parties, provided that the
    26  provisions of such local law or ordinance are at least as  stringent  as
    27  the provisions of this article.
    28    § 2. This act shall take effect on the one hundred twentieth day after
    29  it shall have become a law.
Go to top