New York A 257: Restricts the disclosure of personal information by businesses

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
A00257 Summary:

BILL NOA00257 

&nbsp

SAME ASSAME AS S09672

&nbsp

SPONSORRozic

&nbsp

COSPNSRDinowitz, Weprin

&nbsp

MLTSPNSR

&nbsp

Amd Art 39-F Art Head, add §899-cc, Gen Bus L

&nbsp

Restricts the disclosure of personal information by businesses; provides that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all of the customer's personal information retained by the business.

Go to top A00257 Actions:

BILL NOA00257 

&nbsp

01/08/2025referred to consumer affairs and protection

01/07/2026referred to consumer affairs and protection

Go to topA00257 Committee&nbspVotes:

Go to topA00257 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topA00257 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 257

 2025-2026 Regular Sessions

 IN ASSEMBLY

 (Prefiled)

 January 8, 2025
 ___________

 Introduced by M. of A. ROZIC, DINOWITZ, WEPRIN -- read once and referred
 to the Committee on Consumer Affairs and Protection

 AN ACT to amend the general business law, in relation to restricting the
 disclosure of personal information by businesses

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. This act shall be known and may be cited as the "right to
 2 know act".
 3 § 2. The legislature hereby finds and declares that the right to
 4 privacy is a personal and fundamental right protected by the United
 5 States Constitution. All individuals have a right of privacy in informa-
 6 tion pertaining to them.
 7 This state recognizes the importance of providing consumers with tran-
 8 sparency about how their personal information has been shared by busi-
 9 nesses. For free market forces to have a role in shaping the privacy
 10 practices and for "opt-in" and "opt-out" remedies to be effective,
 11 consumers must be more than vaguely informed that a business might share
 12 personal information with third parties. Consumers must be better
 13 informed about what kinds of personal information are purchased by busi-
 14 nesses for direct marketing purposes. With these specifics, consumers
 15 can knowledgeably choose to opt-in or opt-out or choose among businesses
 16 that disclose information to third parties for direct marketing purposes
 17 on the basis of how protective the business is of consumers' privacy.
 18 Businesses are now collecting personal information and sharing and
 19 selling it in ways not contemplated or properly covered by the current
 20 law. Some web sites are installing up to one hundred tracking tools when
 21 consumers visit web pages and sending very personal information such as
 22 age, gender, race, income, health concerns, and recent purchases to
 23 third-party advertising and marketing companies. Third-party data broker
 24 companies are buying, selling, and trading personal information obtained

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD01360-01-5

 A. 257 2

 1 from mobile phones, financial institutions, social media sites, and
 2 other online and brick and mortar companies.
 3 Some mobile applications are sharing personal information, such as
 4 location information, unique phone identification numbers, and age,
 5 gender, and other personal details with third-party companies.
 6 Consumers need to know the ways that their personal information is
 7 being collected by companies and then shared or sold to third parties in
 8 order to properly protect their privacy, personal safety, and financial
 9 security.
 10 § 3. The article heading of article 39-F of the general business law,
 11 as amended by chapter 117 of the laws of 2019, is amended to read as
 12 follows:
 13 [NOTIFICATION OF UNAUTHORIZED] ACQUISITION AND USE
 14 OF PRIVATE
 15 INFORMATION; DATA SECURITY PROTECTIONS
 16 § 4. The general business law is amended by adding a new section 899-
 17 cc to read as follows:
 18 § 899-cc. Disclosure of a customer's personal information to a third
 19 party. 1. (a) A business that retains a customer's personal information
 20 shall make available to the customer free of charge access to, or copies
 21 of, all of the customer's personal