Int. No. 708
By the Public Advocate (Mr. Williams) and Council Members Louis, Salaam and Brewer
A Local Law to amend the administrative code of the city of New York, in relation to collecting and disclosing personal and sensitive information about New York city residents
Be it enacted by the Council as follows:
Section 1. Title 20 of the administrative code of the city of New York is amended by adding a new subchapter 27 to read as follows:
SUBCHAPTER 27
DIGITAL DATA Governance
§ 20-900 Definitions. For the purposes of this subchapter, the following terms have the following meanings:
Affiliate. The term “affiliate” means an entity that controls, is controlled by, or is under common control with, a collecting entity.
Agent. The term “agent” means a third party that processes personal or sensitive information on behalf of, and for the purpose of fulfilling the services or functions of, the entity that collected the data.
Biometric information. The term “biometric information” means a record of one or more measurable biological or behavioral characteristics that can be used singularly or in combination with other characteristics, or with other information, for automated recognition of an individual; such term shall include, but need not be limited to, fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, gait patterns, handwriting, key stroke dynamics, and mouse movements.
Collect. The term “collect” means to buy, rent, gather, obtain, receive, or access any personal or sensitive information pertaining to an individual by any means, whether online or offline, including receiving information from the individual or from a third party.
Collecting entity. The term “collecting entity” means any corporation, partnership, sole proprietorship, or other legal entity that conducts business in New York city, and collects personal or sensitive information from twenty thousand or more New York city residents.
Disclosure. The term “disclosure” means the act of making personal or sensitive information available to a third party or an affiliate, whether for a fee or otherwise.
Personal information. The term “personal information” means any information that identifies, relates to, describes, or is reasonably capable of being associated with or linked to a particular individual, including but not limited to first and last name, address, telephone number, email address, internet protocol address, account number, credit or debit card number, social security number, date of birth, marketing identifier, or any similar unique identifier.
Resident. The term “resident” means any individual whom a collecting entity knows or has reason to know is residing within the city at the time of interacting with the entity.
Sensitive information. The term “sensitive information” means personal information that reveals or relates to an individual’s genetic or biometric information, gender identity, precise geolocation, image of government-issued identification, or technological information, such as device identifier, including media access control address, or internet mobile equipment identifier.
Third party. The term “third party” means a person or legal entity that is neither the collecting entity, nor an affiliate of the collecting entity, nor the individual to whom the personal information pertains.
§ 20-901 Requirements for data collecting entities. a. Collection and disclosure of sensitive information. It shall be unlawful for a collecting entity to collect or disclose sensitive information pertaining to a resident for purposes that are not reasonably necessary for and compatible with the purposes provided to such resident pursuant to subdivision b of this section, unless such resident affirmatively and expressly consents to such collection or disclosure or such collection or disclosure is required by law or court order. A collecting entity shall allow a resident to opt out of sensitive information collection or disclosure for one or more such purposes at any time.
b. Privacy notice. Each collecting entity shall provide to residents a reasonably accessible and clear privacy notice that includes:
1. The categories of personal and sensitive information collected;
2. The purpose for such collection;
3. The retention period for such information;
4. The categories of third parties and affiliates to whom the information is disclosed and the purpose of such disclosure;
5. The methods by which individuals can request information about the disclosure of their personal and sensitive information; and
6. The procedures for requesting the deletion of sensitive information or opting out from further disclosure.
c. Notice regarding the use of personal or sensitive information by artificial intelligence. Each collecting entity shall provide notice to residents and obtain separate, express written consent before using personal or sensitive information to train or develop an artificial intelligence or machine learning model.
d. Obligations of affiliates and agents. Affiliates and agents shall treat personal and sensitive information in accordance with this section and with the same standards and privacy policies as the collecting entity.
e. Non-discrimination. Collecting entities shall not deny goods or services, charge different prices, or otherwise discriminate against residents who exercise their rights under this section, including choosing not to consent to the disclosure of their sensitive information.
f. Transparency. Each collecting entity shall, within 90 days of receiving a resident’s request, provide a list of the specific third parties to whom the resident’s personal or sensitive information has been disclosed, except where providing the resident with such information would violate a law or a court order.
g. Deletion of information. Each collecting entity shall, within 90 days of receiving a resident’s request, delete personal or sensitive information pertaining to a resident, unless retention of such information is required by law or court order.
h. Withdrawal of previously given consent. Each collecting entity shall provide a mechanism for residents to withdraw previously given consent for any further collection or disclosure of sensitive information. Such withdrawal of consent shall take effect within 30 days.
§ 20-902 Exceptions. a. Requirements for collecting entities as set forth in this subchapter shall not apply to any:
1. Governmental entity or a third party under contract with a governmental entity when the third party is acting on behalf of a governmental entity;
2. Collecting entity governed by sections 6801 - 6809 of title 15 of the United States code;
3. Collecting entity governed by section 1320d of title 42 of the United States code or sections 17931 - 17941 of title 42 of the United States code;
4. Personal information regulated by sections 6501 - 6506 of title 15 of the United States code;
5. Collecting entity governed or consumer report information used, maintained, or disclosed in compliance with sections 1681 - 1681x of title 15 of the United States code;
6. Collecting entity governed by section 1232g of title 20 of the United States code; or
7. Personal data collected, used, or disclosed in the course of clinical research governed by part 46 of title 45 of the code of federal regulations, regarding protection of human subjects in research.
§ 20-903 Penalties. a. Any collecting entity that violates any provision of this subchapter shall be liable for a civil penalty of not more than $500 for a first violation and each additional violation occurring on the same day, and not less than $500 nor more than $1,500 for each subsequent violation within a 12-month period.
b. Failure to provide any notice in violation of subdivision c of section 20-901 shall constitute a separate violation.
§ 20-904 Enforcement. The corporation counsel or such other persons designated by the corporation counsel may initiate in any court of competent jurisdiction any action or proceeding that may be appropriate or necessary for correction of any violation issued pursuant this subchapter, including mandating compliance with the provisions of this subchapter or such other relief as may be appropriate.
§ 20-905 Complaint portal. The department of information technology and telecommunication, in collaboration with any relevant agency, shall establish and maintain an online portal to enable residents to submit complaints alleging violations of section 20-901. Such department shall prepare and submit to the speaker of the council and the mayor an annual report, which shall be due by October 1 of each year, detailing the number, nature, and disposition of such complaints.
§ 20-906 Construction. The provisions of this subchapter shall not be construed to limit any right of any resident to bring a civil action in any court of competent jurisdiction, or to limit the authority of the commission on human rights to enforce the provisions of title 8, in accordance with law.
§ 2. This local law takes effect 180 days after it becomes law, provided that where the provisions of section 20-901 of the administrative code of the city of New York, as added by section one of this local law, cannot be applied consistently with currently applicable contracts, such provisions shall only apply with respect to contracts entered into or renewed after the effective date of this local law.
IB
LS #2569/18798
Int. #1521-2025
1/7/2026 5:03 PM