STATE OF NEW YORK ________________________________________________________________________ 2319 2023-2024 Regular Sessions IN ASSEMBLY January 25, 2023 ___________ Introduced by M. of A. VANEL -- read once and referred to the Committee on Consumer Affairs and Protection AN ACT to amend the general business law, in relation to requiring e-mail service providers to create a service for consumers to report instances of unauthorized use of an e-mail account; and to amend the penal law, in relation to establishing the crime of unauthorized use of an e-mail account The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The general business law is amended by adding a new section 2 390-e to read as follows: 3 § 390-e. E-mail protection. 1. For the purposes of this section the 4 following terms shall have the following meanings: 5 (a) "E-mail service provider" shall mean any person, business or 6 organization qualified to do business in this state that provides indi- 7 viduals, corporations, or other entities with the ability to send e-mail 8 messages. 9 (b) "Local district attorney's office" shall mean the district attor- 10 ney's office located within the county in which the owner of the account 11 resides. 12 (c) "Unauthorized use of an e-mail account" shall mean any instance 13 when, without having the right or permission to do so, an individual: 14 (i) creates a false e-mail account using an individual's name for the 15 purpose of soliciting money or another source of funding or any other 16 personal information from any person or persons on such individual's 17 contact list; or 18 (ii) hacks into an existing e-mail account and using such account for 19 the purpose of soliciting money or another source of funding or any 20 other personal information from any person or persons on such individ- 21 ual's contact list. 22 2. All e-mail service providers doing business in this state shall: EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD06267-01-3A. 2319 2 1 (a) Create a service for consumers living within this state to report 2 unauthorized use of an e-mail address to such e-mail service provider; 3 and 4 (b) Review any report made pursuant to paragraph (a) of this subdivi- 5 sion within sixty days of receipt of such report. 6 3. If, upon a review completed pursuant to paragraph (b) of subdivi- 7 sion two of this section, unauthorized use of an e-mail address is found 8 to have occurred, the e-mail service provider shall immediately disable 9 the e-mail account and report the account to the attorney general and 10 the local district attorney's office. 11 4. The attorney general and the local district attorney's office may 12 bring an action against a person who has been found to commit an act of 13 unauthorized use of an e-mail account. Nothing in this section shall in 14 any way limit rights or remedies which are otherwise available under law 15 to the attorney general or local district attorney's office. 16 § 2. The penal law is amended by adding a new section 190.80-b to read 17 as follows: 18 § 190.80-b Unauthorized use of an e-mail account. 19 A person is guilty of unauthorized use of an e-mail account when, 20 having no right to do so, he or she creates a false e-mail account using 21 an individual's name for the purpose of soliciting money or another 22 source of funding or any other personal information from any person or 23 persons on such individual's contact list or hacks into an existing 24 e-mail account and using such account for the purpose of soliciting 25 money or another source of funding from any person or persons on such 26 individual's contact list. 27 Unauthorized use of an e-mail account is a class A misdemeanor. 28 § 3. This act shall take effect on the ninetieth day after it shall 29 have become a law.