Bill > S09658

This bill establishes a new legal pathway, called a "private right of action," allowing individuals to sue someone who intentionally shares their "personally identifying information" without consent, if that disclosure was done to harass, threaten, intimidate, or harm them, or with a reckless disregard for whether it would cause harm. "Personally identifying information" is broadly defined to include details like home addresses, phone numbers, email addresses, Social Security numbers, financial account numbers, driver's license numbers, biometric data, and specific location data, as long as it's not already lawfully and widely available to the public. The bill specifies that "disclose" means to publish, post, transmit, or otherwise make information available to another person through any medium. If successful in a lawsuit, individuals can seek court orders to stop the disclosure, recover actual damages (including financial losses and emotional distress), punitive damages up to $50,000, and legal costs. However, this right of action does not apply to reporting unlawful conduct, disclosures made during lawful law enforcement or legal proceedings, those made under a subpoena or court order, or disclosures related to matters of legitimate public concern like news reporting or protected expressive activities. The bill also clarifies that previous public availability of information doesn't automatically prevent a lawsuit if the disclosure was intentional and harmful, and it explicitly states that a criminal complaint or conviction is not required to bring a civil action under this law. The provisions of this bill are in addition to any other legal rights or remedies that may exist.

Housing and Urban Affairs

https://www.nysenate.gov/legislation/bills/2025/S9658