Hochul has not commented on the bill. In January, she launched a Data Privacy Week statewide and underscored consumers’ role in protecting themselves online, especially from scams. “[We are] urging all New Yorkers to protect themselves and their personal information to avoid becoming a target of these unscrupulous actors,” she said in a statement.
The New York State Attorney General would be in charge of enforcement, should the bill pass. The office could initiate special proceedings or bring them following consumer complaints; a court would then assess the amount of a penalty.
The players
Consumers have handed over a great deal of data to companies in exchange for the pleasure of browsing Facebook for free or the convenience of scanning their credit card to ride the subway. Not everyone is happy with the status quo. In 2021, New Yorkers said that internet issues including data privacy were their chief consumer complaint. Attorney General Letitia James said her office has received 8,000 reports related to data privacy. “During the pandemic, we have seen a substantial rise in bad actors seeking to take advantage of us by exploiting our personal data and invading our digital privacy online,” James said in early 2022. The complaint dropped to number six on the list in 2022 in terms of number of complaints received, with retail price gouging and tenant harassment emerging ahead.
The federal government has urged lawmakers to pass legislation that brings more oversight to technology companies. “We need serious federal protections for Americans’ privacy,” President Joe Biden wrote in a January op-ed for the Wall Street Journal. “It’s not enough for companies to disclose what data they’re collecting. Much of that data shouldn’t be collected in the first place.” A handful of bills and hearings followed, but none have yet come to a vote.
Smaller tech firms are concerned that the hodgepodge of laws will be challenging, especially for startups that do not have compliance departments, said Julie Samuels, executive director of Tech:NYC, a membership organization that represents the industry.
Larger firms have already had to act in accordance with privacy laws in Europe and other states including California, Colorado and Connecticut to name a few. Google has a complicated tiered system of data processing that allows advertisers to restrict data collection where required. In December, a French agency fined Google 50 million euros on charges that it had violated privacy rules in its ad personalization. In May, Ireland’s Data Protection Commission fined Meta, Facebook’s parent, $1.3 billion for sharing data collected in Europe with the United States.
Yeah, but…
In 2018, the European Union implemented the strictest standards around consumer data privacy, called the General Data Protection Regulation. City companies with global operations may have already decided to set their data privacy to GDPR standards, making a New York law possibly moot.
Kait Stephens, co-founder and CEO of Brij, a company that allows consumer brands to connect directly with their customers, said her team decided to adhere to Europe’s rules from the beginning. Brij’s conceit is that brands can reward customers with information, warranties, discounts or entrance into sweepstakes in exchange for them willingly providing email addresses and other personal data. Stephens said that the company seeks to protect the interest of the consumer and ensures the privacy of all information they decide to share.
Redmond, Washington-based Microsoft has also come out in support. “We have supported privacy legislation in New York and appreciate the leadership of Senator Thomas and Assemblymember Rozic in advancing consumer data privacy protection at the state level,” a Microsoft spokesperson said. “We will continue working with both houses of the legislature and stakeholders to support the enactment of comprehensive privacy legislation.”
It is also not yet clear how much the higher privacy standards end up protecting consumers, who often click through required disclosures on their way to buy things, post thoughts on social media or otherwise interact online.
Some background
Arguments about regulating data collection on the internet are almost as old as the public internet itself. In 1998, the Federal Trade Commission wrote in a report to Congress that 85% of websites surveyed collected personal information from consumers, with just 14% notifying users of this fact. The report established the idea of “notice and choice,” as a guiding principle for governing online data privacy, an extension of the philosophy around fair information practice before the internet.
“These core principles require that consumers be given notice of an entity’s information practices; that consumers be given choice with respect to the use and dissemination of information collected from or about them; that consumers be given access to information about them collected and stored by an entity; and that the data collector take appropriate steps to ensure the security and integrity of any information collected,” reads the report. Consumers, companies and lawmakers have been trying to figure out how this works in practice ever since.
What’s next?
With the legislative session ending, tech companies have up to nine months to regroup and try to fight the bill from advancing further. Samuels said they are up for it.
To pass the Assembly, the bill would need 50 votes. If Assemblymembers amend the bill, it would go back to the Senate. Then Hochul would need to sign it into law.
“The data privacy bill that came close to passing this year would have reordered much of how companies and nonprofits operate online and I’m glad we’ll have time before the session in 2024 to work with the legislators working on these matters to find a path forward that works for everyone,” she said, adding that she hoped Congress would take up the mantle in the meantime. “At the end of the day, it’s unfortunate we are dealing with it in Albany.”
