First, the NYPA would allow citizens of New York to have control over the data companies use. New York consumers would have the right to see how their data is shared, request edits including deletion, and prevent their data from being shared with third parties. The NYPA would require companies to respond to requests in 30 days and provide a 12-month look-back period.

Second, the NYPA would allow consumers to sue companies directly—unlike the CCPA. The CCPA attempted to have a private right to action (sue), but a provision to do so was voted down after extensive lobbying by Silicon Valley-based tech companies.

Third, the proposed NYPA would impact ALL companies. The CCPA applies to organizations that have $25 million in annual gross revenue. The NYPA could place a large regulatory burden on small businesses and startups. The cost to manage consumer claims and the threat of litigation could cut deeply into the profits of small businesses. Presumably, technology companies such as Facebook, Google, Amazon, Apple, and Microsoft could be impacted the most by NYPA, and lobbyists certainly have their work cut out for them to mitigate the requirements of the NYPA.

On June 4th, 2019, there was a public hearing for online privacy and the role of legislation. At the hearing, Senator John C. Liu stated he supported the bill and that the U.S. Congress is sometimes slow to act––and that states can take the lead to protect the consumer. Ed Potrikus, the President and CEO of Retail Council of New York State, responded to Liu that this type of bill would be burdensome to retailers and he would oppose this bill at the state as well as federal level as written. It is likely the NYPA will be modified as written, but it has yet to be determined how far the Act will go to empower citizens of New York to control how their data is used. The other concern brought up at the hearing was discriminatory advertising practices that hurt consumers, such as African Americans not seeing housing ads, older citizens not seeing job ads, and other digital ads that could be used to discriminate.

How sensitive data is defined in the Act and how opt-in is defined will likely determine the strength and power provided to citizens to bring a private action against companies. The privacy fight is far from over in New York, and the rest of the country is watching to determine how the legislature reacts. This Act also supports the trend that the federal government may provide the floor with basic privacy legislation, and states will take it upon themselves to strengthen privacy laws for their citizens.

Editor’s Update:  The NYPA failed to pass in a recent legislative session.