•  Summary 
  •  
  •  Actions 
  •  
  •  Committee Votes 
  •  
  •  Floor Votes 
  •  
  •  Memo 
  •  
  •  Text 
  •  
  •  LFIN 
  •  
  •  Chamber Video/Transcript 

SB8327 Summary:

BILL NOS08327
 
SAME ASNo Same As
 
SPONSORJACOBS
 
COSPNSRBORRELLO, JORDAN
 
MLTSPNSR
 
Add 250.70 & 250.75, Pen L; add 209, St Tech L; add 899-cc, Gen Bus L; add 79-p, Civ Rts L
 
Protects people's privacy during contact tracing by creating the crimes of unlawful dissemination of contact tracing information and unlawful use of a surveillance drone and requires certain privacy measures be implemented in contact tracing applications.
Go to top    

SB8327 Actions:

BILL NOS08327
 
05/11/2020REFERRED TO CODES
08/11/2020RECOMMIT, ENACTING CLAUSE STRICKEN
Go to top

SB8327 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                          8327
 
                    IN SENATE
 
                                      May 11, 2020
                                       ___________
 
        Introduced  by  Sen.  JACOBS -- read twice and ordered printed, and when
          printed to be committed to the Committee on Codes
 
        AN ACT to amend the penal law, the state  technology  law,  the  general
          business  law  and  the  civil  rights  law, in relation to protecting
          people's privacy during contact tracing
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section  1. The penal law is amended by adding a new section 250.70 to
     2  read as follows:
     3  § 250.70 Unlawful dissemination of contact tracing information.
     4    A person is guilty of unlawful dissemination of contact tracing infor-
     5  mation when he or she:
     6    1. knowingly uses, causes to be used, or accesses a computer, computer
     7  service, or computer network without authorization and he or she thereby
     8  knowingly gains access to contact tracing information; or
     9    2. knowingly disseminates contact tracing information  to  any  person
    10  not  authorized by the governor or the commissioner of the department of
    11  health to receive such information.  For the purposes of  this  section,
    12  the  term  "contact  tracing  information"  shall  mean  any information
    13  collected for the purposes of performing the process  of  identification
    14  of  persons  who may have come into contact with or into close proximity
    15  to an infected person and any subsequent collection of additional infor-
    16  mation about these persons and contacts.
    17    Unlawful dissemination of contact tracing information  is  a  class  E
    18  felony.
    19    §  2.  The penal law is amended by adding a new section 250.75 to read
    20  as follows:
    21  § 250.75 Unlawful use of a surveillance drone.
    22    A person is guilty of unlawful use of a surveillance drone when he  or
    23  she  knowingly  uses  or  causes  to be used a drone for the purposes of
    24  surveillance without the consent of all persons within  the  area  surv-
    25  eilled  by  such  drone  for  the purposes of collecting contact tracing
    26  information or for monitoring the vital signs or social distancing prac-
    27  tices of individuals.
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD16269-02-0

        S. 8327                             2
 
     1    For the purposes of this section, the term "contact  tracing  informa-
     2  tion"  shall mean any information collected for the purposes of perform-
     3  ing the process of identification of persons  who  may  have  come  into
     4  contact  with  or  into  close  proximity  to an infected person and any
     5  subsequent  collection  of  further  information about these persons and
     6  contacts.
     7    Unlawful use of a surveillance drone is a class E felony.
     8    § 3. The state technology law is amended by adding a new  section  209
     9  to read as follows:
    10    §  209.  Contact  tracing  application privacy. 1. For the purposes of
    11  this section, the term:
    12    (a) "contact tracing information" shall mean any information collected
    13  for the purposes of performing the process of identification of  persons
    14  who  may  have  come  into  contact  with  or into close proximity to an
    15  infected person and any subsequent collection of additional  information
    16  about these persons and contacts.
    17    (b) "application" shall mean computer software, applications and other
    18  forms  of  technology  created  and  used for the purposes of collecting
    19  contact tracing information.
    20    2. The use of applications  created  for  the  purpose  of  collecting
    21  contact tracing information shall be voluntary. The user of any applica-
    22  tion shall be required to give explicit consent to the application being
    23  downloaded,  to  the  application  being  used,  and  to the application
    24  providing any information collected to any person.   The user  shall  be
    25  provided  with a conspicuous, plain language explanation of the applica-
    26  tion, the application's functions and any information that the  applica-
    27  tion  will  collect  prior to the user being able to give consent to the
    28  download of the application.  Such consent shall be revocable at anytime
    29  at which point the application  shall  terminate  the  functionality  to
    30  which  the user is no longer consenting. If consent to having the appli-
    31  cation downloaded is revoked, the application shall fully remove  itself
    32  or  enable  the user to easily remove the application from the device it
    33  is downloaded onto.
    34    3. Any information stored or transmitted by an  application  shall  be
    35  stored  or transmitted in an encrypted manner as to prevent access by an
    36  unauthorized person.
    37    4. Any information collected by an  application  shall  be  completely
    38  deleted,  destroyed  and  erased  and  no  further  information shall be
    39  collected upon the end of  the  state  public  emergency  requiring  the
    40  creation of the application.
    41    5.  Notwithstanding  any  other  provision of law to the contrary, any
    42  person, business or governmental entity in  violation  of  this  section
    43  shall  be  liable to any person who used an application involuntarily or
    44  without giving properly informed consent or whose contact tracing infor-
    45  mation was disclosed or used improperly. Liability under this section is
    46  in addition to any other applicable penalties and causes of  action.  An
    47  action  to  recover  damages  under  this section may be maintained as a
    48  class action, notwithstanding subdivision b of section nine hundred  one
    49  of the civil practice law and rules.
    50    §  4. The general business law is amended by adding a new section 899-
    51  cc to read as follows:
    52    § 899-cc. Contact tracing application privacy. 1. For the purposes  of
    53  this section, the term:
    54    (a) "contact tracing information" shall mean any information collected
    55  for  the purposes of performing the process of identification of persons
    56  who may have come into contact  with  or  into  close  proximity  to  an

        S. 8327                             3
 
     1  infected  person and any subsequent collection of additional information
     2  about these persons and contacts.
     3    (b) "application" shall mean computer software, applications and other
     4  forms  of  technology  created  and  used for the purposes of collecting
     5  contact tracing information.
     6    2. The use of applications  created  for  the  purpose  of  collecting
     7  contact tracing information shall be voluntary. The user of any applica-
     8  tion shall be required to give explicit consent to the application being
     9  downloaded,  to  the  application  being  used,  and  to the application
    10  providing any information collected to any person.   The user  shall  be
    11  provided  with a conspicuous, plain language explanation of the applica-
    12  tion, the application's functions and any information that the  applica-
    13  tion  will  collect  prior to the user being able to give consent to the
    14  download of the application.   Such consent shall be  revocable  at  any
    15  time at which point the application shall terminate the functionality to
    16  which  the user is no longer consenting. If consent to having the appli-
    17  cation downloaded is revoked, the application shall fully remove  itself
    18  or  enable  the user to easily remove the application from the device it
    19  is downloaded onto.
    20    3. Any information stored or transmitted by an  application  shall  be
    21  stored  or transmitted in an encrypted manner as to prevent access by an
    22  unauthorized person.
    23    4. Any information collected by an  application  shall  be  completely
    24  deleted,  destroyed  and  erased  and  no  further  information shall be
    25  collected upon the end of  the  state  public  emergency  requiring  the
    26  creation of the application.
    27    5.  Notwithstanding  any  other  provision of law to the contrary, any
    28  person, business or governmental entity in  violation  of  this  section
    29  shall  be  liable to any person who used an application involuntarily or
    30  without giving properly informed consent or whose contact tracing infor-
    31  mation was disclosed or used improperly. Liability under this section is
    32  in addition to any other applicable penalties and causes of  action.  An
    33  action  to  recover  damages  under  this section may be maintained as a
    34  class action, notwithstanding subdivision b of section nine hundred  one
    35  of the civil practice law and rules.
    36    §  5.  The civil rights law is amended by adding a new section 79-p to
    37  read as follows:
    38    § 79-p. Right to privacy; contact  tracing.  1.  The  following  defi-
    39  nitions are applicable to this section:
    40    (a) "contact tracing information" shall mean any information collected
    41  for  the purposes of performing the process of identification of persons
    42  who may have come into contact  with  or  into  close  proximity  to  an
    43  infected    person   and any subsequent collection of further additional
    44  information about these persons and contacts.
    45    (b) "application" shall mean computer software,  or  applications  and
    46  other  forms of technology created and used for the purposes of collect-
    47  ing contact tracing information.
    48     2. (a) No person, business, or governmental entity shall require  the
    49  download,  installation  or  use  of  an  application of the purposes of
    50  collecting contact tracing information for any reason  and  the  use  of
    51  such applications shall be voluntary.
    52    (b)  No  person,  business,  or governmental entity shall restrict the
    53  rights and privileges of a person based on such persons refusal to down-
    54  load, installation or use of an application for the purposes of collect-
    55  ing contact tracing information.

        S. 8327                             4
 
     1    (c)  No person, business, or governmental entity shall  collect,  use,
     2  or distribute contact tracing information in violation of section 250.70
     3  or  250.75 of the penal law, section two hundred nine of the state tech-
     4  nology law, or section eight hundred ninety-nine-cc of the general busi-
     5  ness law.
     6    3.  Any  person aggrieved by a violation of the protections created by
     7  this section shall have the right to bring an action or special proceed-
     8  ing in a court  of  appropriate  jurisdiction  to  seek  damages  and/or
     9  declaratory  and  injunctive relief or any other remedies as provided by
    10  law with respect to such violation. The right to bring an  action  under
    11  this section is in addition to any other applicable penalties and causes
    12  of action.
    13    4.  An  action to recover damages under this section may be maintained
    14  as a class action, notwithstanding subdivision b of section nine hundred
    15  one of the civil practice law and rules.
    16    § 6. This act shall take effect immediately.
Go to top