New York Legislators Re-Introduce the New York Privacy Act

On January 6, 2021, New York legislators introduced the New York Privacy Act (AB680).  The bill is identical to AB8526 which never made it out of the Consumer Affairs and Protection Committee in 2020.

The New York Privacy Act would apply to legal entities that conduct business in New York state or produce products or services that are intentionally targeted to the residents of New York.  The law would not apply to data sets maintained for employment records purposes, however.

The most striking feature of the Privacy Act is imposition of fiduciary duty on every company that collects, sells, or licenses personal information of consumers with respect to securing that data against broadly defined privacy risks.  The organizations would be required to act in the best interests of the consumers with respect to their data in a manner expected by a reasonable consumer under the circumstances.  Indeed, this fiduciary duty to consumers would expressly supersede any duty owed to the organizations’ owners or shareholders.

The duties imposed on the organizations under the Act would include transparency and accountability, reasonably securing personal data from unauthorized access, promptly informing consumers of any breach of fiduciary duty, limitation on the use, disclosure, and sharing of personal data, as well as auditing and monitoring of data processors.

Consumers, in turn, would gain rights to opt in and out of processing of their personal data, rights to know and access their data, a right to portability of personal data, rights to correct and delete personal data, as well as a right not to be subject to a decision based solely on profiling which produces legal effects concerning a consumer.

The Act would empower the State Attorney General to bring actions to enforce the Act and provide for a private right of action to unjoin its violations and to recover actual damages.

The New York Privacy Act is one of several privacy legislations introduced in the Empire State in January of 2021.  The other bills include New York Biometric Privacy Act as well as SB567 which is similar to the California Consumer Privacy Act.  We will continue to follow these bills as they progress through the New York State Legislature and report on the developments in our blog.

Improve customer trust with Clarip’s privacy governance platform.  Schedule a demo of the Clarip data mapping software for Privacy Compliance by calling 1-888-252-5653.