Bill Text: NY A03051 | 2023-2024 | General Assembly | Introduced
Bill Title: Relates to disclosing personal information; limits disclosures of personal information to law enforcement; expands information sharing in response to emergencies; provides for statutory damages for violations and that any information disclosed to a law enforcement agency in violation of the privacy law shall be inadmissible in a criminal or civil court, or administrative proceeding.
Spectrum: Partisan Bill (Democrat 6-0)
Status: (Introduced) 2024-01-03 - referred to governmental operations [A03051 Detail]
Download: New_York-2023-A03051-Introduced.html
STATE OF NEW YORK ________________________________________________________________________ S. 4044 A. 3051 2023-2024 Regular Sessions SENATE - ASSEMBLY February 2, 2023 ___________ IN SENATE -- Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when printed to be committed to the Committee on Investi- gations and Government Operations IN ASSEMBLY -- Introduced by M. of A. EPSTEIN -- read once and referred to the Committee on Governmental Operations AN ACT to amend the public officers law, in relation to disclosing personal information The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Section 92 of the public officers law, as added by chapter 2 652 of the laws of 1983, subdivision 8 as amended by section 135 of 3 subpart B of part C of chapter 62 of the laws of 2011 and the opening 4 paragraph of subdivision 9 as amended by chapter 313 of the laws of 5 1991, is amended to read as follows: 6 § 92. Definitions. (1) Agency. The term "agency" [means any state7board, bureau, committee, commission, council, department, public8authority, public benefit corporation, division, office or any other9governmental entity performing a governmental or proprietary function10for the state of New York, except the judiciary or the state legislature11or any unit of local government and shall not include offices of12district attorneys] shall have the same meaning as in subdivision three 13 of section eighty-six of this chapter. 14 (2) Committee. The term "committee" means the committee on open 15 government as constituted pursuant to subdivision one of section eight- 16 y-nine of this chapter. 17 (3) Data subject. The term "data subject" means any natural person 18 about whom personal information has been collected by an agency. 19 (4) Disclose. The term "disclose" means to reveal, release, transfer, 20 disseminate or otherwise communicate personal information or records 21 orally, in writing or by electronic or any other means other than to the 22 data subject. 23 (5) 911 services dispatcher. The term "911 services dispatcher" means 24 a person who receives reports of emergencies via a 911 system or E911 EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD04764-01-3S. 4044 2 A. 3051 1 system as defined in subdivision three of section three hundred one of 2 the county law. 3 (6) Emergency medical services personnel. The term "emergency medical 4 services personnel" means individuals designated as such in subdivision 5 five of section twenty-nine hundred ninety-four-aa of the public health 6 law. 7 (7) Governmental unit. The term "governmental unit" means any govern- 8 mental entity performing a governmental or proprietary function for the 9 federal government or for any state or any municipality thereof. 10 [(6)] (8) Law. The term "law" means state or federal statute, rule or 11 regulation. 12 (9) Law enforcement agency. The term "law enforcement agency" shall 13 have the same meaning as in subdivision four of section 705.00 of the 14 criminal procedure law. 15 (10) Law enforcement officer. The term "law enforcement officer" means 16 a police officer or peace officer as defined in section 1.20 of the 17 criminal procedure law. 18 [(7)] (11) Personal information. The term "personal information" means 19 any information concerning a data subject which, because of name, 20 number, symbol, mark or other identifier, alone or in combination with 21 other information, can be used to identify that data subject or be asso- 22 ciated with an identified data subject. 23 [(8) Public safety agency record. The term "public safety agency24record" means a record of the state commission of correction, the tempo-25rary state commission of investigation, the department of corrections26and community supervision, the office of children and family services,27the office of victim services, the office of probation and correctional28alternatives or the division of state police or of any agency or compo-29nent thereof whose primary function is the enforcement of civil or crim-30inal statutes if such record pertains to investigation, law enforcement,31confinement of persons in correctional facilities or supervision of32persons pursuant to criminal conviction or court order, and any records33maintained by the division of criminal justice services pursuant to34sections eight hundred thirty-seven, eight hundred thirty-seven-a, eight35hundred thirty-seven-b, eight hundred thirty-seven-c, eight hundred36thirty-eight, eight hundred thirty-nine, and eight hundred forty-five of37the executive law and by the department of state pursuant to section38ninety-nine of the executive law.39(9)] (12) Record. The term "record" means any item, collection or 40 grouping of personal information about a data subject which is main- 41 tained and is retrievable by use of the name or other identifier of the 42 data subject irrespective of the physical form or technology used to 43 maintain such personal information. The term "record" shall not include 44 personal information which is not used to make any determination about 45 the data subject if it is: 46 (a) a telephone book or directory which is used exclusively for tele- 47 phone and directory information; 48 (b) any card catalog, book or other resource material in any library; 49 (c) any compilation of information containing names and addresses only 50 which is used exclusively for the purpose of mailing agency information; 51 (d) personal information required by law to be maintained, and 52 required by law to be used, only for statistical research or reporting 53 purposes; 54 (e) information requested by the agency which is necessary for the 55 agency to answer unsolicited requests by the data subject for informa- 56 tion; orS. 4044 3 A. 3051 1 (f) correspondence files. 2 [(10)] (13) Routine use. The term "routine use" means, with respect to 3 the disclosure of a record or personal information, any use of such 4 record or personal information relevant to the purpose for which it was 5 collected, and which use is necessary to the statutory duties of the 6 agency that collected or obtained the record or personal information, or 7 necessary for that agency to operate a program specifically authorized 8 by law. 9 [(11)] (14) System of records. The term "system of records" means any 10 group of records under the actual or constructive control of any agency 11 pertaining to one or more data subjects from which personal information 12 is retrievable by use of the name or other identifier of a data subject. 13 § 2. The opening paragraph of subdivision 3 of section 94 of the 14 public officers law, as added by chapter 652 of the laws of 1983, is 15 amended to read as follows: 16 Each agency, for disclosures made pursuant to paragraphs (d)[,] and 17 (i) [and (l)] of subdivision one of section ninety-six of this article, 18 except for disclosures made for inclusion in public safety agency 19 records when such record is requested for the purpose of obtaining 20 information required for the investigation of a violation of civil or 21 criminal statutes within the disclosing agency, shall: 22 § 3. Section 96 of the public officers law, as added by chapter 652 of 23 the laws of 1983, paragraph (j) of subdivision 1 as amended by chapter 24 1015 of the laws of 1984, paragraph (n) of subdivision 1 as amended by 25 chapter 319 of the laws of 2014, paragraphs (o) and (p) of subdivision 1 26 as amended by section one of part S of chapter 58 of the laws of 2022, 27 and paragraph (c) of subdivision 2 as amended by chapter 322 of the laws 28 of 2021, is amended to read as follows: 29 § 96. Disclosure of records. (1) No agency may disclose any record or 30 personal information unless such disclosure is: 31 (a) pursuant to a written request by or the voluntary written consent 32 of the data subject, provided that such request or consent by its terms 33 limits and specifically describes: 34 (i) the personal information which is requested to be disclosed; 35 (ii) the person or entity to whom such personal information is 36 requested to be disclosed; and 37 (iii) the uses which will be made of such personal information by the 38 person or entity receiving it; or 39 (b) to those officers and employees of, and to those who contract 40 with, the agency that maintains the record if such disclosure is neces- 41 sary to the performance of their official duties pursuant to a purpose 42 of the agency required to be accomplished by statute or executive order 43 or necessary to operate a program specifically authorized by law; or 44 (c) subject to disclosure under article six of this chapter, unless 45 disclosure of such information would constitute an unwarranted invasion 46 of personal privacy as defined in paragraph (a) of subdivision two of 47 section eighty-nine of this chapter; or 48 (d) to officers or employees of another governmental unit if each 49 category of information sought to be disclosed is necessary for the 50 receiving governmental unit to operate a program specifically authorized 51 by statute [and if], the use for which the information is requested is 52 not relevant to the purpose for which it was collected; or 53 (e) for a routine use, as defined in subdivision [ten] thirteen of 54 section ninety-two of this article; or 55 (f) specifically authorized by statute or federal rule or regulation; 56 orS. 4044 4 A. 3051 1 (g) to the bureau of the census for purposes of planning or carrying 2 out a census or survey or related activity pursuant to the provisions of 3 Title XIII of the United States Code; or 4 (h) to a person who has provided the agency with advance written 5 assurance that the record will be used solely for the purpose of statis- 6 tical research or reporting, but only if it is to be transferred in a 7 form that does not reveal the identity of any data subject; or 8 (i) pursuant to a showing of compelling circumstances affecting the 9 health or safety of a data subject, if upon such disclosure notification 10 is transmitted to the data subject at [his or her] their last known 11 address; or 12 (j) to the state archives as a record which has sufficient historical 13 or other value to warrant its continued preservation by the state or for 14 evaluation by the state archivist or [his or her] their designee to 15 determine whether the record has such value; or 16 (k) to any person pursuant to a court ordered subpoena or other 17 compulsory legal process; or 18 (l) [for inclusion in a public safety agency record or to any govern-19mental unit or component thereof which performs as one of its principal20functions any activity pertaining to the enforcement of criminal laws,21provided that, such record is reasonably described and is requested22solely for a law enforcement function; or23(m)] pursuant to a search warrant; or 24 [(n)] (m) to officers or employees of another agency if the record 25 sought to be disclosed is necessary for the receiving agency to comply 26 with the mandate of an executive order, but only if such records are to 27 be used only for statistical research, evaluation or reporting and are 28 not used in making any determination about a data subject; or 29 [(o)] (n) to officers or employees of a public retirement system of 30 the city of New York if the information sought to be disclosed is neces- 31 sary for the receiving public retirement system to process benefits 32 under the retirement and social security law, the administrative code of 33 the city of New York, or the education law or any other applicable 34 provision of law. A written request or consent from the data subject 35 pursuant to paragraph (a) of this subdivision shall not be required for 36 the disclosure of records pursuant to this paragraph; or 37 [(p)] (o) to officers or employees of the United States department of 38 education for such department to process credit for qualifying employ- 39 ment and loan forgiveness under the public service loan forgiveness 40 program. A written request or consent from the data subject pursuant to 41 paragraph (a) of this subdivision shall not be required for the disclo- 42 sure of records pursuant to this paragraph; or 43 (p) necessary to prevent an immediate and substantial risk of death, 44 significant bodily harm, significant damage to property, or is otherwise 45 necessary to respond to an immediate emergency; or 46 (q) disclosed by a 911 service dispatcher in the course of responding 47 to an emergency reported via a 911 system or E911 system to emergency 48 medical services personnel, law enforcement officers, or others respon- 49 sible for providing assistance at the scene of an emergency; or 50 (r) to licensing officers of New York state, as defined in subdivision 51 ten of section 265.00 of the penal law, for such officers to issue 52 firearm licenses pursuant to section 400.00 of the penal law. 53 (2) Notwithstanding subdivision one of this section, no agency may 54 disclose any record or personal information to a law enforcement agency 55 or law enforcement officer unless such disclosure is pursuant to para- 56 graphs (l), (p), (q), or (r) of subdivision one of this section.S. 4044 5 A. 3051 1 (3) Nothing in this section shall require disclosure of[:2(a) personal information which is otherwise prohibited by law from3being disclosed;4(b) patient records concerning mental disability or medical records5where such disclosure is not otherwise required by law;6(c) personal information pertaining to the incarceration of an incar-7cerated individual at a state correctional facility which is evaluative8in nature or which, if disclosed, could endanger the life or safety of9any person, unless such disclosure is otherwise permitted by law;10(d) attorney's work product or material prepared for litigation before11judicial, quasi-judicial or administrative tribunals, as described in12subdivisions (c) and (d) of section three thousand one hundred one of13the civil practice law and rules, except pursuant to statute, subpoena14issued in the course of a criminal action or proceeding, court ordered15or grand jury subpoena, search warrant or other court ordered disclo-16sure] any record or personal information or expand an agency's or 17 governmental unit's ability to disclose any record or personal informa- 18 tion. 19 § 4. Section 97 of the public officers law, as added by chapter 652 of 20 the laws of 1983, is amended to read as follows: 21 § 97. [Civil remedies] Remedies. (1) Any data subject aggrieved by 22 any action taken under this article may seek judicial review and relief 23 pursuant to article seventy-eight of the civil practice law and rules. 24 (2) In any action brought under subdivision one of this section, the 25 plaintiff may seek: 26 (a) one thousand dollars per violation or actual damages, whichever is 27 greater; and 28 (b) punitive damages; and 29 (c) any other relief the court deems proper. 30 (3) In assessing the amount of punitive damages awarded to a plaintiff 31 in an action brought under subdivision one of this section, the court 32 shall consider: 33 (a) the defendant's pattern of violations of this article; and 34 (b) the impact of the violation on the data subject's exercise of 35 constitutional and statutory rights, including, but not limited to, 36 religion, political views, and medical care. 37 (4) In any proceeding brought under subdivision one of this section, 38 the party defending the action shall bear the burden of proof, and the 39 court [may] shall, if the data subject [substantially] prevails against 40 any agency [and if the agency lacked a reasonable basis pursuant to this41article for the challenged action], award to the data subject reasonable 42 attorneys' fees and disbursements reasonably incurred. 43 (5) Any information disclosed to a law enforcement agency in violation 44 of this article shall be inadmissible against the data subject in a 45 criminal or civil court, or administrative proceeding. 46 [(3)] (6) Nothing in this article shall be construed to limit or 47 abridge the right of any person to obtain judicial review or pecuniary 48 or other relief, in any other form or upon any other basis, otherwise 49 available to a person aggrieved by any agency action under this article. 50 § 5. This act shall take effect immediately.
