Bill > A04947

This bill enacts the New York Privacy Act, a comprehensive data privacy law aimed at giving consumers more control over their personal information. The bill defines personal data broadly and applies to businesses that meet certain revenue or data processing thresholds. Key provisions include requiring companies to obtain explicit opt-in consent before processing personal data, providing consumers with rights to access, correct, delete, and transfer their data, and mandating that companies conduct regular risk assessments of their data processing practices. Companies must provide clear, easy-to-understand privacy notices, limit data collection and retention, and obtain consent before sharing data with third parties. The bill also requires special safeguards for automated decision-making, particularly in areas like financial services, housing, and healthcare, and mandates annual impact assessments to check for potential discrimination. Data brokers must register with the Attorney General, and the law provides both regulatory enforcement through the Attorney General and a private right of action for consumers. The bill aims to increase transparency, give consumers more agency over their personal information, and hold companies accountable for responsible data management. Most provisions will take effect two years after becoming law, with the private right of action taking effect three years after enactment.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/A4947