At this point, over 15 states have proposed privacy legislation similar to the California Consumer Privacy Act (CCPA). Most recently, however, New York has drafted a proposed law that, in some instances, goes well beyond the protections afforded by the CCPA. Sponsored by Kevin Thomas, the NY Privacy Act gives New York residents more control over their data than any other state and funds a new office of privacy and data protection.
Like the CCPA, the NY Privacy Act would allow residents to see what data companies are collecting on them, where it is being shared, request that it be corrected or deleted and opt-out of having their data shared or sold to third parties. But as currently drafted, the bill offers residents more protections than the CCPA. Here are some of the key distinctions:
-
Private Right of Action. While the CCPA did attempt to include such a right of action, it failed, leaving the state’s attorney general the responsibility of enforcement actions. As written, the bill would give individuals the right to sue companies directly for violations of the law.
-
Expanded Coverage. The CCPA applies to businesses that make more than $25 million annual gross revenue. The New York bill applies to companies of any size.
-
Data Fiduciaries. In the biggest departure from other state privacy laws, the bill would require businesses to act as “data fiduciaries.” Similar to the way other professions, like an attorney for example, are required to hold data and not share it without a purpose, companies would be banned from using data in a way that causes residents financial or physical harm or in a way that would be “unexpected and highly offensive to a reasonable consumer.” The bill also states that this duty supersedes companies’ fiduciary duties to shareholders.
As expected, this bill isn’t sitting well with many companies. While the requirements under this bill are increasingly more restrictive than other states, the simple burden of having to track and comply with various state laws is motivating many companies to push for a federal law.
The full text of the bill can be read here.