After stalling last summer, the New York Privacy Act is back in play as legislators returned to Albany for the 2020 session. Featured in our roundup of top headlines from 2019, this bill has the potential to provide New York residents with more control over their data -- and businesses with more obligations -- making this a bill that Beckage is closely watching.
What is the New York Privacy Act?
When introducing this bill, sponsor Kevin Thomas (D, 6th Senate District) said “New York should be a leader in protecting the privacy of its residents and their personal data.” Many would agree that Thomas and his co-sponsors have delivered on that vision; in many respects this legislation is bolder than even the California Consumer Protection Act (CCPA), which became effective January 1, 2020.
The New York Privacy Act provides strong privacy protections. For example, the bill:
- requires companies to disclose their methods of de-identifying personal information;
- places special safeguards around data sharing and allows consumers to obtain the names of all entities with whom their information is shared; and
- creates a special account to fund a new office of privacy and data protection.
The bill expressly states that organizations handling New Yorkers’ personal information must act in the best interest of those individuals, without regard to their own business interests.
What’s the Current Status of the Bill?
The bill failed to make progress last year, but has been revived for the 2020 legislative session and is considered a priority. It’s currently sitting with the Senate Committee on Consumer Protection and it has five co-sponsors in the Senate and three in the Assembly.
Why We’re Paying Attention
As noted, this bill includes a number of consumer protections that go beyond the CCPA. For example, the draft bill requires that organizations collecting consumer data notify consumers of their rights under the bill and provide them with the opportunity to opt in or out of the processing of their data. Moreover, in some circumstances, businesses may be required to correct or delete consumer data, an obligation that is burdensome and often difficult to implement.
The legislation also proposes to enable a private right of action, allowing individuals to sue companies for data breaches and other unauthorized uses of personal data. This is significant because legal action in data breach cases is typically taken by the state Attorney General or federal agencies. This legislation, if passed, will likely result in a large uptick in litigation.
Beckage continues to watch for momentum with this bill. The New York Privacy Act has strong opposition from the business community, but legislators are looking to follow and surpass California’s lead in consumer privacy protections. Our experts will be monitoring legislative developments and expect to see similar efforts popping up across the country. Beckage will continue to look for opportunities for businesses to voice concerns about potential unintended consequences of this bill during the legislative process. We work with businesses on a daily basis as they develop proactive data security programs that can stand the test of time through this fast-moving legal landscape.