Source: https://www.nysenate.gov/legislation/bills/2019/s8327
Timestamp: 2020-08-15 17:16:49
Document Index: 491751072

Matched Legal Cases: ['§250', '§209', '§899', '§79', '§ 250', '§  2', '§ 250', '§ 3', '§  209', '§ 899', '§  5', '§ 79']

NY State Senate Bill S8327
senate Bill S8327
Relates to protecting people's privacy during contact tracing
Get Status Alerts for S8327
Aug 11, 2020 recommit, enacting clause stricken
May 11, 2020 referred to codes
S8327 (ACTIVE) - Details
Add §§250.70 & 250.75, Pen L; add §209, St Tech L; add §899-cc, Gen Bus L; add §79-p, Civ Rts L
S8327 (ACTIVE) - Summary
Protects people's privacy during contact tracing by creating the crimes of unlawful dissemination of contact tracing information and unlawful use of a surveillance drone and requires certain privacy measures be implemented in contact tracing applications.
S8327 (ACTIVE) - Sponsor Memo
BILL NUMBER: S8327
An act to amend the penal law, the state technology law, the general
business law and the civil rights law, in relation to protecting
people's privacy during contact tracing
To amend the penal law, the state technology law, and the general busi-
ness law, in relation to protecting people's privacy during contact
Section one of the bill amends penal law, by adding new section 250.70
to establish the crime of unlawful dissemination of contact tracing
information, a class E felony.
Section two of the bill amends penal law, by adding new section 250.75
to establish the crime of unlawful use of a surveillance drone, a class
Section three of the bill amends state technology law, by adding new
section 209 to define contract tracing information and to ensure that
the download and use of any contact tracing technology, including appli-
cation shall be voluntary and that any user must provide consent to the
download, use and sharing of information. Users must be provided with a
plain language explanation of any technology, including application
functionality prior to consenting to the download of such technology.
Users will be afforded to ability to revoke their consent at any time
and to remove contact tracing technology from their device or devices.
Any user data stored must be encrypted for security purposes and all
information collected must be destroyed upon the end of the public
Section four of the bill amends general business law by adding new
section 899-cc to protect the privacy interests of consumers during
public health emergencies, and to ensure that the download and use of
any contact tracing technology, including application shall be voluntary
and that any user must provide consent to the download, use and sharing
of information. Users must be provided with a plain language explanation
of any technology, including application functionality prior to consent-
ing to the download of such technology.  Users will be afforded to abil-
ity to revoke their consent at any time and to remove contact tracing
technology from their device or devices. Any user data stored must be
encrypted for security purposes and all information collected must be
destroyed upon the end of the public health emergency.
Section five of the bill amends civil rights law by adding new section
79-p, to establish and define a right to privacy as it relates to
contact tracing technology and to prevent any loss or restriction of any
rights or privileges for refusal to utilize any such technology, includ-
ing refusal to download or use a contact tracing application. A cause of
action is also established to provide any person or persons with the
ability to sue the entity responsible for any violation of his or her
right to privacy as it relates to contact tracing. An aggrieved
individual(s) will be allowed to seek damages or declaratory or injunc-
tive relief.
Section six of the bill is the effective date; immediately upon being
As our nation and New York State take much needs steps to recover from
the many hardships inflicted by the novel coronavirus disease 2019, or
the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), here-
after "COVID-19," New Yorkers agree that we must take action to protect
against the further spread of COVID-19. In order to proactively address
the COVID-19 pandemic that has ravaged our state, contact tracing is
vital. According to the Center for Disease Control and Prevention (CDC),
the key concepts of contact tracing involve a multifaceted approach in
order to "trace and monitor contacts of infected people," through a
combination of the quarantining of infected individuals, an expansion of
staffing resources and lastly, the "adoption and evaluation of digital
tools," which the CDC states "may expand reach and efficacy of contact
tracers."  While the digital tools used by contact tracers such as moni-
toring cell phone data, social media or other indicators that form one's
"digital footprint," certainly have the ability to ensure that anyone
who came into contact with a person infected by COVID-19 is identified
and quarantined, there is always the potential for not just privacy
violations, but disclosure to unauthorized parties who are not partic-
ipating in contact tracing.
A recent proposal in Australia announced on April 24, 2020 would make it
illegal for any non-health official to access data collection on smart-
phone software to trace the spread of COVID19, according to Australian
Prime Minister Scott Morrison. The news outlet Channel News Asia
reported that Prime Minister Morrison's proposal would utilize a smart-
phone application that would allow health officials to "identify who a
person with the illness has had contact with," once that infected person
downloaded the application. However, there has been controversy
surrounding this proposal due to not just privacy concerns but also the
accessibility of an infected person's data by non-health officials.
This bill would seek to eliminate the potential for non-health officials
from accessing personal data obtained by contact tracers and impose a
criminal penalty against any individual who shares such personal data
with an unauthorized individual or entity that is not involved in
contact tracing. Additionally, the usage of any technology to access the
personal data of an infected person would be voluntary and require an
"opt-in." Absent the consent of the infected person, no entity - includ-
ing local government - could access the data or mandate usage of the
contact tracing technology in its jurisdiction.
Additionally, this bill would allow the infected person - should they
choose to opt-in - the ability to close, stop, shut down and fully
remove the contact tracing technology from any device in their
possession at any time, as well as require such personal data be
encrypted. The use of this would ensure that the infected person is in
full control of their privacy and also their data is secure.  Finally,
once the public health emergency has officially ended any and all data
collected through the contact tracing technology must be destroyed by
the Department of Health, as well as the companies that create the
contact tracing technology. While New York State is living through
unprecedented times, we must not forgo New Yorkers' fundamental right to
privacy and this bill would ensure the appropriate steps are taken to
ensure that does not happen.
This bill shall take effect immediately upon being signed into law.
S8327 (ACTIVE) - Bill Text download pdf
AN ACT to amend the penal law, the state  technology  law,  the  general
business  law  and  the  civil  rights  law, in relation to protecting
§ 250.70 UNLAWFUL DISSEMINATION OF CONTACT TRACING INFORMATION.
A PERSON IS GUILTY OF UNLAWFUL DISSEMINATION OF CONTACT TRACING INFOR-
MATION WHEN HE OR SHE:
1. KNOWINGLY USES, CAUSES TO BE USED, OR ACCESSES A COMPUTER, COMPUTER
SERVICE, OR COMPUTER NETWORK WITHOUT AUTHORIZATION AND HE OR SHE THEREBY
KNOWINGLY GAINS ACCESS TO CONTACT TRACING INFORMATION; OR
2. KNOWINGLY DISSEMINATES CONTACT TRACING INFORMATION  TO  ANY  PERSON
NOT  AUTHORIZED BY THE GOVERNOR OR THE COMMISSIONER OF THE DEPARTMENT OF
HEALTH TO RECEIVE SUCH INFORMATION.  FOR THE PURPOSES OF  THIS  SECTION,
THE  TERM  "CONTACT  TRACING  INFORMATION"  SHALL  MEAN  ANY INFORMATION
COLLECTED FOR THE PURPOSES OF PERFORMING THE PROCESS  OF  IDENTIFICATION
OF  PERSONS  WHO MAY HAVE COME INTO CONTACT WITH OR INTO CLOSE PROXIMITY
TO AN INFECTED PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL INFOR-
MATION ABOUT THESE PERSONS AND CONTACTS.
UNLAWFUL DISSEMINATION OF CONTACT TRACING INFORMATION  IS  A  CLASS  E
§  2.  The penal law is amended by adding a new section 250.75 to read
§ 250.75 UNLAWFUL USE OF A SURVEILLANCE DRONE.
A PERSON IS GUILTY OF UNLAWFUL USE OF A SURVEILLANCE DRONE WHEN HE  OR
SHE  KNOWINGLY  USES  OR  CAUSES  TO BE USED A DRONE FOR THE PURPOSES OF
SURVEILLANCE WITHOUT THE CONSENT OF ALL PERSONS WITHIN  THE  AREA  SURV-
EILLED  BY  SUCH  DRONE  FOR  THE PURPOSES OF COLLECTING CONTACT TRACING
INFORMATION OR FOR MONITORING THE VITAL SIGNS OR SOCIAL DISTANCING PRAC-
TICES OF INDIVIDUALS.
LBD16269-02-0
S. 8327                             2
FOR THE PURPOSES OF THIS SECTION, THE TERM "CONTACT  TRACING  INFORMA-
TION"  SHALL MEAN ANY INFORMATION COLLECTED FOR THE PURPOSES OF PERFORM-
ING THE PROCESS OF IDENTIFICATION OF PERSONS  WHO  MAY  HAVE  COME  INTO
CONTACT  WITH  OR  INTO  CLOSE  PROXIMITY  TO AN INFECTED PERSON AND ANY
SUBSEQUENT  COLLECTION  OF  FURTHER  INFORMATION ABOUT THESE PERSONS AND
UNLAWFUL USE OF A SURVEILLANCE DRONE IS A CLASS E FELONY.
§ 3. The state technology law is amended by adding a new  section  209
§  209.  CONTACT  TRACING  APPLICATION PRIVACY. 1. FOR THE PURPOSES OF
THIS SECTION, THE TERM:
(A) "CONTACT TRACING INFORMATION" SHALL MEAN ANY INFORMATION COLLECTED
FOR THE PURPOSES OF PERFORMING THE PROCESS OF IDENTIFICATION OF  PERSONS
WHO  MAY  HAVE  COME  INTO  CONTACT  WITH  OR INTO CLOSE PROXIMITY TO AN
INFECTED PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL  INFORMATION
ABOUT THESE PERSONS AND CONTACTS.
(B) "APPLICATION" SHALL MEAN COMPUTER SOFTWARE, APPLICATIONS AND OTHER
FORMS  OF  TECHNOLOGY  CREATED  AND  USED FOR THE PURPOSES OF COLLECTING
CONTACT TRACING INFORMATION.
2. THE USE OF APPLICATIONS  CREATED  FOR  THE  PURPOSE  OF  COLLECTING
CONTACT TRACING INFORMATION SHALL BE VOLUNTARY. THE USER OF ANY APPLICA-
TION SHALL BE REQUIRED TO GIVE EXPLICIT CONSENT TO THE APPLICATION BEING
DOWNLOADED,  TO  THE  APPLICATION  BEING  USED,  AND  TO THE APPLICATION
PROVIDING ANY INFORMATION COLLECTED TO ANY PERSON.   THE USER  SHALL  BE
PROVIDED  WITH A CONSPICUOUS, PLAIN LANGUAGE EXPLANATION OF THE APPLICA-
TION, THE APPLICATION'S FUNCTIONS AND ANY INFORMATION THAT THE  APPLICA-
TION  WILL  COLLECT  PRIOR TO THE USER BEING ABLE TO GIVE CONSENT TO THE
DOWNLOAD OF THE APPLICATION.  SUCH CONSENT SHALL BE REVOCABLE AT ANYTIME
AT WHICH POINT THE APPLICATION  SHALL  TERMINATE  THE  FUNCTIONALITY  TO
WHICH  THE USER IS NO LONGER CONSENTING. IF CONSENT TO HAVING THE APPLI-
CATION DOWNLOADED IS REVOKED, THE APPLICATION SHALL FULLY REMOVE  ITSELF
OR  ENABLE  THE USER TO EASILY REMOVE THE APPLICATION FROM THE DEVICE IT
IS DOWNLOADED ONTO.
3. ANY INFORMATION STORED OR TRANSMITTED BY AN  APPLICATION  SHALL  BE
STORED  OR TRANSMITTED IN AN ENCRYPTED MANNER AS TO PREVENT ACCESS BY AN
4. ANY INFORMATION COLLECTED BY AN  APPLICATION  SHALL  BE  COMPLETELY
DELETED,  DESTROYED  AND  ERASED  AND  NO  FURTHER  INFORMATION SHALL BE
COLLECTED UPON THE END OF  THE  STATE  PUBLIC  EMERGENCY  REQUIRING  THE
CREATION OF THE APPLICATION.
5.  NOTWITHSTANDING  ANY  OTHER  PROVISION OF LAW TO THE CONTRARY, ANY
PERSON, BUSINESS OR GOVERNMENTAL ENTITY IN  VIOLATION  OF  THIS  SECTION
SHALL  BE  LIABLE TO ANY PERSON WHO USED AN APPLICATION INVOLUNTARILY OR
WITHOUT GIVING PROPERLY INFORMED CONSENT OR WHOSE CONTACT TRACING INFOR-
MATION WAS DISCLOSED OR USED IMPROPERLY. LIABILITY UNDER THIS SECTION IS
IN ADDITION TO ANY OTHER APPLICABLE PENALTIES AND CAUSES OF  ACTION.  AN
ACTION  TO  RECOVER  DAMAGES  UNDER  THIS SECTION MAY BE MAINTAINED AS A
CLASS ACTION, NOTWITHSTANDING SUBDIVISION B OF SECTION NINE HUNDRED  ONE
cc to read as follows:
§ 899-CC. CONTACT TRACING APPLICATION PRIVACY. 1. FOR THE PURPOSES  OF
FOR  THE PURPOSES OF PERFORMING THE PROCESS OF IDENTIFICATION OF PERSONS
WHO MAY HAVE COME INTO CONTACT  WITH  OR  INTO  CLOSE  PROXIMITY  TO  AN
S. 8327                             3
INFECTED  PERSON AND ANY SUBSEQUENT COLLECTION OF ADDITIONAL INFORMATION
DOWNLOAD OF THE APPLICATION.   SUCH CONSENT SHALL BE  REVOCABLE  AT  ANY
TIME AT WHICH POINT THE APPLICATION SHALL TERMINATE THE FUNCTIONALITY TO
§  5.  The civil rights law is amended by adding a new section 79-p to
§ 79-P. RIGHT TO PRIVACY; CONTACT  TRACING.  1.  THE  FOLLOWING  DEFI-
NITIONS ARE APPLICABLE TO THIS SECTION:
INFECTED    PERSON   AND ANY SUBSEQUENT COLLECTION OF FURTHER ADDITIONAL
INFORMATION ABOUT THESE PERSONS AND CONTACTS.
(B) "APPLICATION" SHALL MEAN COMPUTER SOFTWARE,  OR  APPLICATIONS  AND
OTHER  FORMS OF TECHNOLOGY CREATED AND USED FOR THE PURPOSES OF COLLECT-
ING CONTACT TRACING INFORMATION.
2. (A) NO PERSON, BUSINESS, OR GOVERNMENTAL ENTITY SHALL REQUIRE  THE
DOWNLOAD,  INSTALLATION  OR  USE  OF  AN  APPLICATION OF THE PURPOSES OF
COLLECTING CONTACT TRACING INFORMATION FOR ANY REASON  AND  THE  USE  OF
SUCH APPLICATIONS SHALL BE VOLUNTARY.
(B)  NO  PERSON,  BUSINESS,  OR GOVERNMENTAL ENTITY SHALL RESTRICT THE
RIGHTS AND PRIVILEGES OF A PERSON BASED ON SUCH PERSONS REFUSAL TO DOWN-
LOAD, INSTALLATION OR USE OF AN APPLICATION FOR THE PURPOSES OF COLLECT-
S. 8327                             4
(C)  NO PERSON, BUSINESS, OR GOVERNMENTAL ENTITY SHALL  COLLECT,  USE,
OR DISTRIBUTE CONTACT TRACING INFORMATION IN VIOLATION OF SECTION 250.70
OR  250.75 OF THE PENAL LAW, SECTION TWO HUNDRED NINE OF THE STATE TECH-
NOLOGY LAW, OR SECTION EIGHT HUNDRED NINETY-NINE-CC OF THE GENERAL BUSI-
NESS LAW.
3.  ANY  PERSON AGGRIEVED BY A VIOLATION OF THE PROTECTIONS CREATED BY
THIS SECTION SHALL HAVE THE RIGHT TO BRING AN ACTION OR SPECIAL PROCEED-
ING IN A COURT  OF  APPROPRIATE  JURISDICTION  TO  SEEK  DAMAGES  AND/OR
DECLARATORY  AND  INJUNCTIVE RELIEF OR ANY OTHER REMEDIES AS PROVIDED BY
LAW WITH RESPECT TO SUCH VIOLATION. THE RIGHT TO BRING AN  ACTION  UNDER
THIS SECTION IS IN ADDITION TO ANY OTHER APPLICABLE PENALTIES AND CAUSES
View More (141 Lines)