New York Assembly Member Felix Ortiz (D-51) has introduced A.B. 1324, legislation which would forbid "Any person, firm, partnership, or corporation, which provides an online  computer service" from intentionally disclosing "personal information concerning a subscriber" without notice and consent. Also, "upon request a subscriber shall be provided access to all personal information regarding such subscriber that is collected and maintained by an on-line computer service... [and] reasonable opportunity" to correct any errors in such information." Disclosure may be allowed if "necessary to render or conduct business or provide service to the subscriber" or for various commercial transactions.

"On-line computer service" is defined as "the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing or making available information using computer-based telecommunications." It "shall also include a service that permits a subscriber to retrieve stored information from or file information for storage to retrieve stored information from or file information for storage in information storage facilities, electronic publishing or an electronic messaging service."

A.B. 1324 defines "personal information" as any data that "identifies either a specific file or service utilized" in combination with information that identifies "the subscriber and/or such subscriber’s online computer address." "File" is defined as "a collection of related records treated as a unit" and "records" means "a group of distinct data items in a computer system, manipulated as a unit". "Disclose" or "disclosure" is defined as "the sale, rental or other dissemination of personal information".

The bill allows for enforcement by private rights of action for any alleged violation that may result in damages and court orders compelling remediation. The
New York State Attorney General can also bring suit to enforce.

A.B. 1324 is vague in definition and broad in scope and could adversely impact pretty much any research organization involved in research online by requiring informed consumer consent for the transfer of a consumer's data to a third party and requiring access and correction. Although part of a broader legislative interest in data privacy, A.B. 1324 is likely too convoluted to advance very far. Regardless, MRA will seek to either amend or defeat this bill.