New York A 3629: Prohibits sharing or selling personal data to third parties by government entities and contractors

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
A03629 Summary:

BILL NOA03629 

&nbsp

SAME ASNo Same As

&nbsp

SPONSORRozic

&nbsp

COSPNSRJensen

&nbsp

MLTSPNSR

&nbsp

Add Art 5-A §§81 - 84, Exec L

&nbsp

Prohibits sharing or selling personal data to third parties by government entities and contractors.

Go to top A03629 Actions:

BILL NOA03629 

&nbsp

01/29/2025referred to governmental operations

01/07/2026referred to governmental operations

Go to topA03629 Committee&nbspVotes:

Go to topA03629 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topA03629 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 3629

 2025-2026 Regular Sessions

 IN ASSEMBLY

 January 29, 2025
 ___________

 Introduced by M. of A. ROZIC, JENSEN -- read once and referred to the
 Committee on Governmental Operations

 AN ACT to amend the executive law, in relation to prohibiting sharing or
 selling personal data to third parties by government entities and
 contractors

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. The executive law is amended by adding a new article 5-A to
 2 read as follows:
 3 ARTICLE 5-A
 4 SHARING AND SELLING OF PERSONAL DATA
 5 Section 81. Definitions.
 6 82. Data collection disclosure.
 7 83. Sharing and selling of personal information prohibited.
 8 84. Limitation on restrictions.
 9 § 81. Definitions. As used in this article, the following terms shall
 10 have the following meanings unless otherwise specified:
 11 1. "Aggregate personal information" shall mean information that
 12 relates to a group or category of individuals, from which individual
 13 identities have been removed, that is not linked or reasonably linkable
 14 to any individual or household, including via a device. "Aggregate
 15 personal information" shall not mean one or more individual's records
 16 that have been deidentified.
 17 2. "Collects", "collected", or "collection" shall mean gathering,
 18 obtaining, receiving, or accessing any personal information pertaining
 19 to an individual by any means. This includes receiving information from
 20 such individual either actively or passively.
 21 3. "Contractor" means a contractor, or subcontractor of a contractor,
 22 that contracts to process information on behalf of a government entity
 23 and to which such government entity discloses an individual's personal
 24 information for a legitimate government purpose pursuant to a written

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD04682-01-5

 A. 3629 2

 1 contract, provided that such contract prohibits such contractor or
 2 subcontractor receiving such personal information from retaining, using,
 3 or disclosing such personal information for any purpose other than for
 4 the specific purpose of performing the services specified in such
 5 contract, or as otherwise permitted by this article, including retain-
 6 ing, using, or disclosing such personal information for a commercial
 7 purpose other than providing the services specified in the contract.
 8 4. "Deidentified" shall mean information that cannot reasonably iden-
 9 tify, relate to, describe, be capable of being associated with, or be
 10 linked to, directly or indirectly, a particular individual, provided
 11 that a government entity that uses such deidentified information:
 12 (a) has implemented technical safeguards and processes that prohibit
 13 reidentification of the individual to whom such information may pertain;
 14 (b) has implemented processes to prevent inadvertent release of
 15 deidentified information; and
 16 (c) makes no attempt to reidentify such information.
 17 5. "Device" shall mean any physical object that is capable of connect-
 18 ing to the internet, directly or indirectly, or to another device.
 19 6. "Government entity" or "entity" shall mean any state agency or any
 20 part, body, or subdivision thereof.
 21 7. "Individual" shall mean a person who is a resident of New York
 22 state.
 23 8. (a) "Personal information" shall mean information that identifies,
 24 relates to, describes, is capable of being associated with, or could
 25 reasonably be linked to, directly or indirectly, a particular individual
 26 or househo