A 3629: Prohibits sharing or selling personal data to third parties by government entities and contractors.

  
  STATE OF NEW YORK ________________________________________________________________________ 3629 2025-2026 Regular Sessions  IN ASSEMBLY January 29, 2025 ___________ Introduced by M. of A. ROZIC, JENSEN -- read once and referred to the Committee on Governmental Operations AN ACT to amend the executive law, in relation to prohibiting sharing or selling personal data to third parties by government entities and contractors The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The executive law is amended by adding a new article 5-A to 2 read as follows: 3 ARTICLE 5-A 4 SHARING AND SELLING OF PERSONAL DATA 5 Section 81. Definitions. 6 82. Data collection disclosure. 7 83. Sharing and selling of personal information prohibited. 8 84. Limitation on restrictions. 9 § 81. Definitions. As used in this article, the following terms shall 10 have the following meanings unless otherwise specified: 11 1. "Aggregate personal information" shall mean information that 12 relates to a group or category of individuals, from which individual 13 identities have been removed, that is not linked or reasonably linkable 14 to any individual or household, including via a device. "Aggregate 15 personal information" shall not mean one or more individual's records 16 that have been deidentified. 17 2. "Collects", "collected", or "collection" shall mean gathering, 18 obtaining, receiving, or accessing any personal information pertaining 19 to an individual by any means. This includes receiving information from 20 such individual either actively or passively. 21 3. "Contractor" means a contractor, or subcontractor of a contractor, 22 that contracts to process information on behalf of a government entity 23 and to which such government entity discloses an individual's personal 24 information for a legitimate government purpose pursuant to a written EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD04682-01-5 
 A. 3629 2 1 contract, provided that such contract prohibits such contractor or 2 subcontractor receiving such personal information from retaining, using, 3 or disclosing such personal information for any purpose other than for 4 the specific purpose of performing the services specified in such 5 contract, or as otherwise permitted by this article, including retain- 6 ing, using, or disclosing such personal information for a commercial 7 purpose other than providing the services specified in the contract. 8 4. "Deidentified" shall mean information that cannot reasonably iden- 9 tify, relate to, describe, be capable of being associated with, or be 10 linked to, directly or indirectly, a particular individual, provided 11 that a government entity that uses such deidentified information: 12 (a) has implemented technical safeguards and processes that prohibit 13 reidentification of the individual to whom such information may pertain; 14 (b) has implemented processes to prevent inadvertent release of 15 deidentified information; and 16 (c) makes no attempt to reidentify such information. 17 5. "Device" shall mean any physical object that is capable of connect- 18 ing to the internet, directly or indirectly, or to another device. 19 6. "Government entity" or "entity" shall mean any state agency or any 20 part, body, or subdivision thereof. 21 7. "Individual" shall mean a person who is a resident of New York 22 state. 23 8. (a) "Personal information" shall mean information that identifies, 24 relates to, describes, is capable of being associated with, or could 25 reasonably be linked to, directly or indirectly, a particular individual 26 or household. Personal information includes, but is not limited to, the 27 following: 28 (i) identifiers such as a real name, alias, postal address, unique 29 personal identifier, internet protocol address, email address, social 30 security number, driver's license number, passport number, photograph, 31 or other similar identifiers; 32 (ii) characteristics of protected classifications under New York or 33 federal law; 34 (iii) commercial information, including records of real or personal 35 property; 36 (iv) biometric information; 37 (v) audio, electronic, visual, or similar information; 38 (vi) professional or employment-related information; 39 (vii) education information, defined as information that is not 40 publicly available personally identifiable information as defined in the 41 family educational rights and privacy act (20 USC 1232g); 42 (viii) inferences drawn from any of the information identified in this 43 paragraph to create a profile about an individual reflecting such indi- 44 vidual's preferences, characteristics, psychological trends, predisposi- 45 tions, behavior, attitudes, intelligence, abilities, and aptitudes; and 46 (ix) financial or tax information. 47 (b) "Personal information" shall not include publicly available infor- 48 mation. For these purposes, "publicly available" shall mean information 49 that is lawfully made available from federal, state, or local government 50 records, or any conditions associated with such information. "Publicly 51 available" shall not include an individual's information that is deiden- 52 tified or aggregate personal information. 53 9. "Probabilistic identifier" shall mean the identification of an 54 individual or a device to a degree of certainty of more probable than 55 not based on any categories of personal information included in, or 
 A. 3629 3 1 similar to, the categories enumerated in subdivision eight of this 2 section. 3 10. "Process" or "processing" shall mean any operation or set of oper- 4 ations that are performed on personal data or on sets of personal data, 5 whether or not by automated means. 6 11. (a) "Sell", "selling", "sale", or "sold" shall mean selling, rent- 7 ing, releasing, disclosing, disseminating, making available, trans- 8 ferring, or otherwise communicating orally, in writing, or by electronic 9 or other means, an individual's personal information by a government 10 entity or contractor to a third party for monetary or other valuable 11 consideration. 12 (b) A government entity or contractor does not sell personal informa- 13 tion within the meaning of this article when: 14 (i) An individual uses or directs such government entity or contractor 15 to intentionally disclose personal information to a third party, 16 provided such third party also does not sell such personal information, 17 unless such disclosure would be consistent with the provisions of this 18 article. 19 (ii) Such government entity or contractor uses or shares with a third 20 party personal information of an individual that is necessary to perform 21 a legitimate government purpose if both of the following conditions are 22 met: 23 (1) the government entity or contractor has provided notice that 24 information is being used or shared; and 25 (2) the third party does not further collect, sell, or use the 26 personal information of such individual except as necessary to perform 27 the business purpose for which it received such information. 28 (iii) A contractor who transfers to a third party an individual's 29 personal information as an asset that is part of a merger, acquisition, 30 bankruptcy, or other transaction in which such contractor or third party 31 assumes control of all or part of such third party provided that such 32 information is used or shared consistently with this article. If a third 33 party materially alters how it uses or shares personal information of an 34 individual in a manner that is materially inconsistent with the promises 35 made at the time of collection, it shall provide prior notice of the new 36 or changed practice to such individual. Such notice shall be sufficient- 37 ly prominent and robust to ensure that individuals can easily exercise 38 their choices consistently with section eighty-three of this article. 39 12. "Service" or "services" shall mean work, labor, and services, 40 including services furnished in connection with the sale or repair of 41 goods. 42 13. "Third party" shall mean a person or business entity who is not 43 another government entity or contractor thereof. 44 14. "Unique identifier" or "unique personal identifier" shall mean a 45 persistent identifier that can be used to recognize an individual, a 46 family, or a device that is linked to an individual or family, over time 47 and across different services, including, but not limited to, a device 48 identifier; an internet protocol address; cookies, beacons, pixel tags, 49 or similar technology; unique pseudonym, or user alias; telephone 50 numbers, or other forms of persistent or probabilistic identifiers that 51 can be used to identify a particular individual or device. For purposes 52 of this subdivision, "family" means a custodial parent or guardian and 53 any minor children over which such parent or guardian has custody. 54 § 82. Data collection disclosure. 1. A government entity or contractor 55 that collects an individual's personal information shall, at or before 56 the point of collection, inform such individual as to the categories of 
 A. 3629 4 1 personal information to be collected and the purposes for which such 2 categories of personal information shall be used. A government entity or 3 contractor shall not collect additional categories of personal informa- 4 tion or use personal information collected for additional purposes with- 5 out providing such individual with notice consistent with this article. 6 2. This section shall not require a government entity or contractor 7 to: 8 (a) retain any personal information collected for a single, one-time 9 transaction if such information is not shared or retained by such 10 government entity or contractor; or 11 (b) reidentify or otherwise link information that is not maintained in 12 a manner that would be considered personal information. 13 § 83. Sharing and selling of personal information prohibited. 1. No 14 government entity or contractor shall share any individual's personal 15 information with a contractor or subcontractor unless such information 16 is crucial to the purpose for which such government entity or contractor 17 has contracted such contractor or subcontractor's services. 18 2. No government entity or contractor shall share any individual's 19 personal information with another government entity or contractor unless 20 such information is crucial to the performance of such other government 21 entity or contractor's duties, and such other government entity or 22 contractor cannot procure such personal information on its own without 23 serious hardship. 24 3. No government entity or contractor shall sell personal information 25 about an individual. 26 § 84. Limitation on restrictions. 1. The obligations imposed on 27 government entities and contractors by this article shall not restrict 28 any government entity or contractor's ability to: 29 (a) otherwise comply with federal, state, or local laws; 30 (b) comply with a civil, criminal, or regulatory inquiry, investi- 31 gation, subpoena, or summons by federal, state, or local authorities; 32 (c) comply with a request made under the freedom of information law; 33 or 34 (d) exercise or defend legal claims. 35 2. This article shall not apply to the sale of personal information to 36 or from a consumer reporting agency if such information is to be 37 reported in, or used to generate, a consumer report as defined by the 38 federal fair credit reporting act (15 USC 1681), and use of that infor- 39 mation is limited by such act. 40 3. A government entity that discloses personal information to a 41 contractor shall not be liable under this article if such contractor 42 uses such personal information in violation of the restrictions set 43 forth in this article, provided that, at the time of disclosing such 44 personal information, such government entity does not have actual know- 45 ledge or reason to believe that such contractor intends to commit such a 46 violation. No contractor shall be liable under this article for the 47 obligations of a government entity for which it provides services as set 48 forth in this article. 49 4. This article shall not be construed to require a government entity 50 to reidentify or otherwise link information that is not maintained in a 51 manner that would be considered personal information. 52 5. The rights afforded to individuals and the obligations imposed on 53 government entities and contractors by this article shall not adversely 54 affect the rights and freedoms of any other person. 55 § 2. This act shall take effect one year after it shall have become a 56 law.