New York S 8524: Relates to the use of MWBE investments for New York state funds

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S08524 Summary:

BILL NOS08524 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORGONZALEZ

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Add Art 42-A §§1200 - 1207, Gen Bus L

&nbsp

Enacts the New York privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.

Go to top S08524 Actions:

BILL NOS08524 

&nbsp

10/08/2025REFERRED TO RULES

01/07/2026REFERRED TO INTERNET AND TECHNOLOGY

Go to topS08524 Committee&nbspVotes:

Go to topS08524 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS08524 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 8524

 2025-2026 Regular Sessions

 IN SENATE

 October 8, 2025
 ___________

 Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when
 printed to be committed to the Committee on Rules

 AN ACT to amend the general business law, in relation to the management
 and oversight of personal data

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. Short title. This act shall be known and may be cited as
 2 the "New York data protection act".
 3 § 2. Legislative intent. 1. Privacy is a fundamental right and an
 4 essential element of freedom. Advances in technology have produced ramp-
 5 ant growth in the amount and categories of personal data being gener-
 6 ated, collected, stored, analyzed, and potentially shared, which
 7 presents both promise and peril. Companies collect, use and share our
 8 personal data in ways that can be difficult for ordinary consumers to
 9 understand. Opaque data processing policies make it impossible to evalu-
 10 ate risks and compare privacy-related protections across services,
 11 stifling competition. Algorithms quietly make decisions with critical
 12 consequences for New York consumers, often with no human accountability.
 13 Behavioral advertising generates profits by turning people into products
 14 and their activity into assets. New York consumers deserve more notice
 15 and more control over their data and their digital privacy.
 16 2. This act seeks to help New York consumers regain their privacy. It
 17 gives New York consumers the ability to exercise more control over their
 18 personal data and requires businesses to be responsible, thoughtful, and
 19 accountable managers of that information. To achieve this, this act
 20 provides New York consumers a number of new rights, including clear
 21 notice of how their data is being used, processed and shared; the abili-
 22 ty to access and obtain a copy of their data in a commonly used elec-
 23 tronic format, with the ability to transfer it between services; and the
 24 ability to correct inaccurate data and to delete their data. This act
 25 also imposes obligations upon businesses to maintain reasonable data

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD02963-01-5

 S. 8524 2

 1 security for personal data, to notify New York consumers of foreseeable
 2 harms arising from use of their data and to obtain specific consent for
 3 that use, and to conduct regular assessments to ensure that data is not
 4 being used for unacceptable purposes. These data assessments can be
 5 obtained and evaluated by the New York State Attorney General, who is
 6 empowered to obtain penalties for violations of this act and prevent
 7 future violations.
 8 § 3. The general business law is amended by adding a new article 42-A
 9 to read as follows:
 10 ARTICLE 42-A
 11 NEW YORK DATA PROTECTION ACT
 12 Section 1200. Definitions.
 13 1201. Jurisdictional scope.
 14 1202. Consumer rights.
 15 1203. Controller, processor, and third party responsibilities.
 16 1204. Data brokers.
 17 1205. Limitations.
 18 1206. Enforcement.
 19 1207. Miscellaneous.
 20 § 1200. Definitions. The following definitions apply for the purposes
 21 of this article unless the context clearly requires otherwise:
 22 1. "Biometric information" means any personal data generated from the
 23 measurement or specific technological processing of a natural person's
 24 biological, physic