Bill Text: NY S04044 | 2023-2024 | General Assembly | Amended

---

Bill Title: Relates to disclosing personal information; limits disclosures of personal information to law enforcement; expands information sharing in response to emergencies; provides for statutory damages for violations and that any information disclosed to a law enforcement agency in violation of the privacy law shall be inadmissible in a criminal or civil court, or administrative proceeding.

Spectrum: Partisan Bill (Democrat 7-0)

Status: (Introduced) 2024-03-05 - PRINT NUMBER 4044A [S04044 Detail]

Download: New_York-2023-S04044-Amended.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                         4044--A

                               2023-2024 Regular Sessions

                    IN SENATE

                                    February 2, 2023
                                       ___________

        Introduced by Sens. GONZALEZ, BRISPORT, BROUK, FERNANDEZ, HOYLMAN-SIGAL,
          SALAZAR, SEPULVEDA -- read twice and ordered printed, and when printed
          to  be  committed  to  the  Committee on Investigations and Government
          Operations -- recommitted  to  the  Committee  on  Investigations  and
          Government  Operations  in  accordance  with  Senate Rule 6, sec. 8 --
          committee discharged, bill amended, ordered reprinted as  amended  and
          recommitted to said committee

        AN  ACT  to  amend  the  public  officers law, in relation to disclosing
          personal information

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1. Section 92 of the public officers law, as added by chapter
     2  652 of the laws of 1983, subdivision 8 as  amended  by  section  135  of
     3  subpart  B  of  part C of chapter 62 of the laws of 2011 and the opening
     4  paragraph of subdivision 9 as amended by chapter  313  of  the  laws  of
     5  1991, is amended to read as follows:
     6    § 92. Definitions.  (1)  Agency.  The  term  "agency"  means any state
     7  board,  bureau,  committee,  commission,  council,  department,   public
     8  authority,  public  benefit  corporation,  division, office or any other
     9  governmental entity performing a governmental  or  proprietary  function
    10  for the state of New York, except the judiciary or the state legislature
    11  or  any  unit  of  local  government  and  shall  not include offices of
    12  district attorneys.
    13    (2) Committee. The  term  "committee"  means  the  committee  on  open
    14  government  as constituted pursuant to subdivision one of section eight-
    15  y-nine of this chapter.
    16    (3) Data subject. The term "data subject"  means  any  natural  person
    17  about whom personal information has been collected by an agency.
    18    (4)  Disclose. The term "disclose" means to reveal, release, transfer,
    19  disseminate or otherwise communicate  personal  information  or  records

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD04764-02-3
        S. 4044--A                          2

     1  orally, in writing or by electronic or any other means other than to the
     2  data subject.
     3    (5)  911 services dispatcher. The term "911 services dispatcher" means
     4  a person who receives reports of emergencies via a 911  system  or  E911
     5  system  as  defined in subdivision three of section three hundred one of
     6  the county law.
     7    (6) Emergency medical services personnel. The term "emergency  medical
     8  services  personnel" means individuals designated as such in subdivision
     9  five of section twenty-nine hundred ninety-four-aa of the public  health
    10  law.
    11    (7)  Governmental unit. The term "governmental unit" means any govern-
    12  mental entity performing a governmental or proprietary function for  the
    13  federal government or for any state or any municipality thereof.
    14    [(6)]  (8) Law. The term "law" means state or federal statute, rule or
    15  regulation.
    16    [(7)] (9) Law enforcement agency. The term  "law  enforcement  agency"
    17  shall  have the same meaning as in subdivision four of section 705.00 of
    18  the criminal procedure law.
    19    (10) Law enforcement officer. The term "law enforcement officer" means
    20  a police officer or peace officer as defined  in  section  1.20  of  the
    21  criminal procedure law.
    22    (11)  Police  agency. The term "police agency" has the same meaning as
    23  in subdivision eight of section eight hundred thirty-five of the  execu-
    24  tive law.
    25    (12)  Personal  information. The term "personal information" means any
    26  information concerning a data subject which, because  of  name,  number,
    27  symbol,  mark  or  other  identifier, alone or in combination with other
    28  information, can be used to identify that data subject or be  associated
    29  with an identified data subject.
    30    [(8)] (13) Public safety agency record. The term "public safety agency
    31  record" means a record of the state commission of correction, the tempo-
    32  rary  state  commission  of investigation, the department of corrections
    33  and community supervision, the office of children and  family  services,
    34  the  office of victim services, the office of probation and correctional
    35  alternatives or the division of state police or of any agency or  compo-
    36  nent thereof whose primary function is the enforcement of civil or crim-
    37  inal statutes if such record pertains to investigation, law enforcement,
    38  confinement  of  persons  in  correctional  facilities or supervision of
    39  persons pursuant to criminal conviction or court order, and any  records
    40  maintained  by  the  division  of  criminal justice services pursuant to
    41  sections eight hundred thirty-seven, eight hundred thirty-seven-a, eight
    42  hundred thirty-seven-b,  eight  hundred  thirty-seven-c,  eight  hundred
    43  thirty-eight, eight hundred thirty-nine, and eight hundred forty-five of
    44  the  executive  law  and  by the department of state pursuant to section
    45  ninety-nine of the executive law.
    46    [(9)] (14) Record. The term "record" means  any  item,  collection  or
    47  grouping  of  personal  information  about a data subject which is main-
    48  tained and is retrievable by use of the name or other identifier of  the
    49  data  subject  irrespective  of  the physical form or technology used to
    50  maintain such personal information. The term "record" shall not  include
    51  personal  information  which is not used to make any determination about
    52  the data subject if it is:
    53    (a) a telephone book or directory which is used exclusively for  tele-
    54  phone and directory information;
    55    (b) any card catalog, book or other resource material in any library;
        S. 4044--A                          3

     1    (c) any compilation of information containing names and addresses only
     2  which is used exclusively for the purpose of mailing agency information;
     3    (d)  personal  information  required  by  law  to  be  maintained, and
     4  required by law to be used, only for statistical research  or  reporting
     5  purposes;
     6    (e)  information  requested  by  the agency which is necessary for the
     7  agency to answer unsolicited requests by the data subject  for  informa-
     8  tion; or
     9    (f) correspondence files.
    10    [(10)] (15) Routine use. The term "routine use" means, with respect to
    11  the  disclosure  of  a  record  or personal information, any use of such
    12  record or personal information relevant to the purpose for which it  was
    13  collected,  and  which  use  is necessary to the statutory duties of the
    14  agency that collected or obtained the record or personal information, or
    15  necessary for that agency to operate a program  specifically  authorized
    16  by law.
    17    [(11)]  (16) System of records. The term "system of records" means any
    18  group of records under the actual or constructive control of any  agency
    19  pertaining  to one or more data subjects from which personal information
    20  is retrievable by use of the name or other identifier of a data subject.
    21    § 2. Section 96 of the public officers law, as added by chapter 652 of
    22  the laws of 1983, paragraph (j) of subdivision 1 as amended  by  chapter
    23  1015  of  the laws of 1984, paragraph (n) of subdivision 1 as amended by
    24  chapter 319 of the laws of 2014, paragraphs (o) and (p) of subdivision 1
    25  as amended by section 1 of part S of chapter 58 of the laws of 2022, and
    26  paragraph (c) of subdivision 2 as amended by chapter 322 of the laws  of
    27  2021, is amended to read as follows:
    28    § 96. Disclosure  of records. (1) No agency may disclose any record or
    29  personal information unless such disclosure is:
    30    (a) pursuant to a written request by or the voluntary written  consent
    31  of  the data subject, provided that such request or consent by its terms
    32  limits and specifically describes:
    33    (i) the personal information which is requested to be disclosed;
    34    (ii) the person  or  entity  to  whom  such  personal  information  is
    35  requested to be disclosed; and
    36    (iii)  the uses which will be made of such personal information by the
    37  person or entity receiving it; or
    38    (b) to those officers and employees of,  and  to  those  who  contract
    39  with,  the agency that maintains the record if such disclosure is neces-
    40  sary to the performance of their official duties pursuant to  a  purpose
    41  of  the agency required to be accomplished by statute or executive order
    42  or necessary to operate a program specifically authorized by law; or
    43    (c) subject to disclosure under article six of  this  chapter,  unless
    44  disclosure  of such information would constitute an unwarranted invasion
    45  of personal privacy as defined in paragraph (a) of  subdivision  two  of
    46  section eighty-nine of this chapter; or
    47    (d)  to  officers  or  employees  of another governmental unit if each
    48  category of information sought to be  disclosed  is  necessary  for  the
    49  receiving governmental unit to operate a program specifically authorized
    50  by  statute and if the use for which the information is requested is not
    51  relevant to the purpose for which it was collected; or
    52    (e) for a routine use, as defined  in  subdivision  [ten]  fifteen  of
    53  section ninety-two of this article; or
    54    (f)  specifically authorized by statute or federal rule or regulation;
    55  or
        S. 4044--A                          4

     1    (g) to the bureau of the census for purposes of planning  or  carrying
     2  out a census or survey or related activity pursuant to the provisions of
     3  Title XIII of the United States Code; or
     4    (h)  to  a  person  who  has  provided the agency with advance written
     5  assurance that the record will be used solely for the purpose of statis-
     6  tical research or reporting, but only if it is to be  transferred  in  a
     7  form  that  does not and cannot reveal the identity of any data subject,
     8  alone or in combination with other available information; or
     9    (i) pursuant to a showing of compelling  circumstances  affecting  the
    10  health or safety of a data subject, if upon such disclosure notification
    11  is  transmitted  to  the  data  subject at [his or her] their last known
    12  address; or
    13    (j) to the state archives as a record which has sufficient  historical
    14  or other value to warrant its continued preservation by the state or for
    15  evaluation  by  the  state  archivist  or [his or her] their designee to
    16  determine whether the record has such value; or
    17    (k) to any person pursuant  to  a  court  ordered  subpoena  or  other
    18  compulsory legal process; or
    19    (l)  from one public safety agency record for inclusion in [a] another
    20  public safety agency record or from one public safety agency  record  to
    21  any  governmental unit or component thereof which performs as one of its
    22  principal functions any activity pertaining to the enforcement of crimi-
    23  nal laws, provided that, such record  is  reasonably  described  and  is
    24  requested  solely  for  a law enforcement function, and further provided
    25  that data may not be transferred under this paragraph to  United  States
    26  Immigrations  and  Customs Enforcement, United States Customs and Border
    27  Protection, any other entity for the purposes  of  immigration  enforce-
    28  ment,  or  to  any  out-of-state law enforcement agency, law enforcement
    29  officer, or police agency for the enforcement of any  criminal  law  the
    30  elements of which would not constitute a crime in the state of New York;
    31  or
    32    (m) pursuant to a search warrant; or
    33    (n) to officers or employees of another agency if the record sought to
    34  be  disclosed  is  necessary for the receiving agency to comply with the
    35  mandate of an executive order, but only if such records are to  be  used
    36  only  for statistical research, evaluation or reporting and are not used
    37  in making any determination about a data subject; or
    38    (o) to officers or employees of a public retirement system of the city
    39  of New York if the information sought to be disclosed is  necessary  for
    40  the  receiving  public  retirement  system to process benefits under the
    41  retirement and social security law, the administrative code of the  city
    42  of  New  York, or the education law or any other applicable provision of
    43  law. A written request or consent from  the  data  subject  pursuant  to
    44  paragraph  (a) of this subdivision shall not be required for the disclo-
    45  sure of records pursuant to this paragraph; or
    46    (p) to officers or employees of the United States department of educa-
    47  tion for such department to process credit for qualifying employment and
    48  loan forgiveness under the public service loan  forgiveness  program.  A
    49  written  request  or consent from the data subject pursuant to paragraph
    50  (a) of this subdivision shall not be  required  for  the  disclosure  of
    51  records pursuant to this paragraph; or
    52    (q)  necessary  to prevent an immediate and substantial risk of death,
    53  significant bodily harm, significant damage to property, or is otherwise
    54  necessary to respond to an immediate emergency; or
    55    (r) disclosed by a 911 service dispatcher in the course of  responding
    56  to  an  emergency  reported via a 911 system or E911 system to emergency
        S. 4044--A                          5

     1  medical services personnel, law enforcement officers, or others  respon-
     2  sible for providing assistance at the scene of an emergency; or
     3    (s) to licensing officers of New York state, as defined in subdivision
     4  ten  of  section  265.00  of  the  penal law, for such officers to issue
     5  firearm licenses pursuant to section 400.00 of the penal law.
     6    (2) Notwithstanding subdivision one  of  section  ninety-two  of  this
     7  article,  for  the  purposes  of this section, the term "agency" has the
     8  same meaning as in subdivision three of section eighty-six of this chap-
     9  ter.
    10    (3) Notwithstanding subdivision one of this  section,  no  agency  may
    11  disclose any record or personal information to a law enforcement agency,
    12  law  enforcement  officer,  or  police  agency unless such disclosure is
    13  pursuant to paragraph (k), (l), (m), (q), (r), or (s) of subdivision one
    14  of this section, and no agency other than a law  enforcement  agency  or
    15  police  agency  may disclose any record or personal information to a law
    16  enforcement agency, law enforcement officer, or police  agency  pursuant
    17  to paragraph (l) of subdivision one of this section.
    18    (4) (a) An agency may only disclose records or personal information to
    19  a  person  or  entity that is not an agency pursuant to paragraph (b) or
    20  (e) of subdivision one of this section if such person or  entity  agrees
    21  in writing not to disclose such records or personal information to a law
    22  enforcement  agency,  law  enforcement  officer, or police agency except
    23  pursuant to this section.
    24    (b) If an agency enters into a partnership or agreement  with  another
    25  entity  to  provide  services,  and  such other entity directly collects
    26  records or personal information pursuant to such a partnership or agree-
    27  ment, the entity may not disclose the records  or  personal  information
    28  other  than  pursuant  to  paragraph  (k), (l), (m), (q), (r), or (s) of
    29  subdivision one of this section.
    30    (c) No agency shall enter into an agreement described in paragraph (b)
    31  of this subdivision with any police agency or law enforcement agency.
    32    (5) Nothing in this section shall require disclosure of[:
    33    (a) personal information which is otherwise  prohibited  by  law  from
    34  being disclosed;
    35    (b)  patient  records  concerning mental disability or medical records
    36  where such disclosure is not otherwise required by law;
    37    (c) personal information pertaining to the incarceration of an  incar-
    38  cerated  individual at a state correctional facility which is evaluative
    39  in nature or which, if disclosed, could endanger the life or  safety  of
    40  any person, unless such disclosure is otherwise permitted by law;
    41    (d) attorney's work product or material prepared for litigation before
    42  judicial,  quasi-judicial  or  administrative tribunals, as described in
    43  subdivisions (c) and (d) of section three thousand one  hundred  one  of
    44  the  civil  practice law and rules, except pursuant to statute, subpoena
    45  issued in the course of a criminal action or proceeding,  court  ordered
    46  or  grand  jury  subpoena, search warrant or other court ordered disclo-
    47  sure] any record or  personal  information  or  expand  an  agency's  or
    48  governmental  unit's ability to disclose any record or personal informa-
    49  tion.
    50    § 3. Section 97 of the public officers law, as added by chapter 652 of
    51  the laws of 1983, is amended to read as follows:
    52    § 97. [Civil remedies] Remedies.  (1) Any data  subject  aggrieved  by
    53  any  action taken under this article may seek judicial review and relief
    54  pursuant to article seventy-eight of the civil practice law and rules.
    55    (2) In any action brought under subdivision one of this  section,  the
    56  plaintiff may seek:
        S. 4044--A                          6

     1    (a) one thousand dollars per violation or actual damages, whichever is
     2  greater; and
     3    (b) punitive damages; and
     4    (c) any other relief the court deems proper.
     5    (3) In assessing the amount of punitive damages awarded to a plaintiff
     6  in  an  action  brought under subdivision one of this section, the court
     7  shall consider:
     8    (a) the defendant's pattern of violations of this article; and
     9    (b) the impact of the violation on  the  data  subject's  exercise  of
    10  constitutional  and  statutory  rights,  including,  but not limited to,
    11  religion, political views, and medical care.
    12    (4) In any proceeding brought under subdivision one of  this  section,
    13  the  party  defending the action shall bear the burden of proof, and the
    14  court [may] shall, if the data subject [substantially] prevails  against
    15  any agency [and if the agency lacked a reasonable basis pursuant to this
    16  article for the challenged action], award to the data subject reasonable
    17  attorneys' fees and disbursements reasonably incurred.
    18    [(3)]  (5)  Any information disclosed to a law enforcement agency, law
    19  enforcement officer, or police agency in violation of this article shall
    20  be inadmissible against the data subject in a criminal or  civil  court,
    21  or administrative proceeding.
    22    (6) Nothing in this article shall be construed to limit or abridge the
    23  right  of  any  person  to  obtain judicial review or pecuniary or other
    24  relief, in any other form or upon any other basis,  otherwise  available
    25  to a person aggrieved by any agency action under this article.
    26    § 4. This act shall take effect immediately.