Add §§250.70 & 250.75, Pen L; add §209, St Tech L; add §899-cc, Gen Bus L; add §79-q, Civ Rts L
Protects people's privacy during contact tracing by creating the crimes of unlawful dissemination of contact tracing information and unlawful use of a surveillance drone; requires certain privacy measures be implemented in contact tracing applications.
STATE OF NEW YORK
________________________________________________________________________
6448
2021-2022 Regular Sessions
IN SENATE
April 29, 2021
___________
Introduced by Sens. JORDAN, BORRELLO -- read twice and ordered printed,
and when printed to be committed to the Committee on Codes
AN ACT to amend the penal law, the state technology law, the general
business law and the civil rights law, in relation to protecting
people's privacy during contact tracing
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The penal law is amended by adding two new sections 250.70
2 and 250.75 to read as follows:
3 § 250.70 Unlawful dissemination of contact tracing information.
4 A person is guilty of unlawful dissemination of contact tracing infor-
5 mation when he or she:
6 1. knowingly uses, causes to be used, or accesses a computer, computer
7 service, or computer network without authorization and he or she thereby
8 knowingly gains access to contact tracing information; or
9 2. knowingly disseminates contact tracing information to any person
10 not authorized by the governor or the commissioner of the department of
11 health to receive such information. For the purposes of this section,
12 the term "contact tracing information" shall mean any information
13 collected for the purposes of performing the process of identification
14 of persons who may have come into contact with or into close proximity
15 to an infected person and any subsequent collection of additional infor-
16 mation about these persons and contacts.
17 Unlawful dissemination of contact tracing information is a class E
18 felony.
19 § 250.75 Unlawful use of a surveillance drone.
20 A person is guilty of unlawful use of a surveillance drone when he or
21 she knowingly uses or causes to be used a drone for the purposes of
22 surveillance without the consent of all persons within the area surv-
23 eilled by such drone for the purposes of collecting contact tracing
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD10990-01-1
S. 6448 2
1 information or for monitoring the vital signs or social distancing prac-
2 tices of individuals.
3 For the purposes of this section, the term "contact tracing informa-
4 tion" shall mean any information collected for the purposes of perform-
5 ing the process of identification of persons who may have come into
6 contact with or into close proximity to an infected person and any
7 subsequent collection of further information about these persons and
8 contacts.
9 Unlawful use of a surveillance drone is a class E felony.
10 § 2. The state technology law is amended by adding a new section 209
11 to read as follows:
12 § 209. Contact tracing application privacy. 1. For the purposes of
13 this section, the term:
14 (a) "contact tracing information" shall mean any information collected
15 for the purposes of performing the process of identification of persons
16 who may have come into contact with or into close proximity to an
17 infected person and any subsequent collection of additional information
18 about these persons and contacts.
19 (b) "application" shall mean computer software, applications and other
20 forms of technology created and used for the purposes of collecting
21 contact tracing information.
22 2. The use of applications created for the purpose of collecting
23 contact tracing information shall be voluntary. The user of any applica-
24 tion shall be required to give explicit consent to the application being
25 downloaded, to the application being used, and to the application
26 providing any information collected to any person. The user shall be
27 provided with a conspicuous, plain language explanation of the applica-
28 tion, the application's functions and any information that the applica-
29 tion will collect prior to the user being able to give consent to the
30 download of the application. Such consent shall be revocable at anytime
31 at which point the application shall terminate the functionality to
32 which the user is no longer consenting. If consent to having the appli-
33 cation downloaded is revoked, the application shall fully remove itself
34 or enable the user to easily remove the application from the device it
35 is downloaded onto.
36 3. Any information stored or transmitted by an application shall be
37 stored or transmitted in an encrypted manner as to prevent access by an
38 unauthorized person.
39 4. Any information collected by an application shall be completely
40 deleted, destroyed and erased and no further information shall be
41 collected upon the end of the state public emergency requiring the
42 creation of the application.
43 5. Notwithstanding any other provision of law to the contrary, any
44 person, business or governmental entity in violation of this section
45 shall be liable to any person who used an application involuntarily or
46 without giving properly informed consent or whose contact tracing infor-
47 mation was disclosed or used improperly. Liability under this section is
48 in addition to any other applicable penalties and causes of action. An
49 action to recover damages under this section may be maintained as a
50 class action, notwithstanding subdivision b of section nine hundred one
51 of the civil practice law and rules.
52 § 3. The general business law is amended by adding a new section 899-
53 cc to read as follows:
54 § 899-cc. Contact tracing application privacy. 1. For the purposes of
55 this section, the term:
S. 6448 3
1 (a) "contact tracing information" shall mean any information collected
2 for the purposes of performing the process of identification of persons
3 who may have come into contact with or into close proximity to an
4 infected person and any subsequent collection of additional information
5 about these persons and contacts.
6 (b) "application" shall mean computer software, applications and other
7 forms of technology created and used for the purposes of collecting
8 contact tracing information.
9 2. The use of applications created for the purpose of collecting
10 contact tracing information shall be voluntary. The user of any applica-
11 tion shall be required to give explicit consent to the application being
12 downloaded, to the application being used, and to the application
13 providing any information collected to any person. The user shall be
14 provided with a conspicuous, plain language explanation of the applica-
15 tion, the application's functions and any information that the applica-
16 tion will collect prior to the user being able to give consent to the
17 download of the application. Such consent shall be revocable at any
18 time at which point the application shall terminate the functionality to
19 which the user is no longer consenting. If consent to having the appli-
20 cation downloaded is revoked, the application shall fully remove itself
21 or enable the user to easily remove the application from the device it
22 is downloaded onto.
23 3. Any information stored or transmitted by an application shall be
24 stored or transmitted in an encrypted manner as to prevent access by an
25 unauthorized person.
26 4. Any information collected by an application shall be completely
27 deleted, destroyed and erased and no further information shall be
28 collected upon the end of the state public emergency requiring the
29 creation of the application.
30 5. Notwithstanding any other provision of law to the contrary, any
31 person, business or governmental entity in violation of this section
32 shall be liable to any person who used an application involuntarily or
33 without giving properly informed consent or whose contact tracing infor-
34 mation was disclosed or used improperly. Liability under this section is
35 in addition to any other applicable penalties and causes of action. An
36 action to recover damages under this section may be maintained as a
37 class action, notwithstanding subdivision b of section nine hundred one
38 of the civil practice law and rules.
39 § 4. The civil rights law is amended by adding a new section 79-q to
40 read as follows:
41 § 79-q. Right to privacy; contact tracing. 1. The following defi-
42 nitions are applicable to this section:
43 (a) "contact tracing information" shall mean any information collected
44 for the purposes of performing the process of identification of persons
45 who may have come into contact with or into close proximity to an
46 infected person and any subsequent collection of further additional
47 information about these persons and contacts.
48 (b) "application" shall mean computer software, or applications and
49 other forms of technology created and used for the purposes of collect-
50 ing contact tracing information.
51 2. (a) No person, business, or governmental entity shall require the
52 download, installation or use of an application of the purposes of
53 collecting contact tracing information for any reason and the use of
54 such applications shall be voluntary.
55 (b) No person, business, or governmental entity shall restrict the
56 rights and privileges of a person based on such persons refusal to down-
S. 6448 4
1 load, installation or use of an application for the purposes of collect-
2 ing contact tracing information.
3 (c) No person, business, or governmental entity shall collect, use,
4 or distribute contact tracing information in violation of section 250.70
5 or 250.75 of the penal law, section two hundred nine of the state tech-
6 nology law, or section eight hundred ninety-nine-cc of the general busi-
7 ness law.
8 3. Any person aggrieved by a violation of the protections created by
9 this section shall have the right to bring an action or special proceed-
10 ing in a court of appropriate jurisdiction to seek damages and/or
11 declaratory and injunctive relief or any other remedies as provided by
12 law with respect to such violation. The right to bring an action under
13 this section is in addition to any other applicable penalties and causes
14 of action.
15 4. An action to recover damages under this section may be maintained
16 as a class action, notwithstanding subdivision b of section nine hundred
17 one of the civil practice law and rules.
18 § 5. This act shall take effect immediately.
