New York has been in the mix for one of the next states to pass a privacy law since the Consumer Protection Committee reintroduced the New York Privacy Act into the senate in May 2021. The NYPA is a comprehensive consumer privacy law that seeks to safeguard the privacy of New Yorkers by giving people more influence over their personal data and by holding businesses responsible.

How Does the New York Privacy Act Compare?

Truyo president Dan Clarke says, “The proposed law in New York isn’t a copy and paste of other laws. Where we’ve seen other bills introduced that are heavily based on Virginia, CPRA, or GDPR, this has similarities and is better aligned with GDPR, but actually has stronger consent requirements and introduces a limited private right of action. It includes a revenue number that’s not included in other state laws and introduces a new threshold for people outside of the company’s consumers. They want to have a unique imprint on the privacy space and achieve their own goals.”

As with many other current and proposed privacy laws, the location of your organization becomes irrelevant when you meet the following criteria to be in scope of NYPA:

• Have annual gross revenue of $25 million or more;
• Controls or processes personal data of 100,000 consumers or more;
• Controls or processes personal data of 500,000 natural persons or more nationwide, and controls or processes personal data of 10,000 consumers or more; or
• Derives over 50% of gross revenue from the sale of personal data, and controls or processes personal data of 25,000 consumers or more.

New York Privacy Act Specifics

Key Elements of NYPA

• Sensitive data processing requires opt-in by consumers
• Introduces private right of action for opt-out violations
• Requires data impact assessments
• Targeted advertising is not regarded as “essential” to offer consumers services or commodities
• Consumers can appeal judgments made by automated decision-making, but first, it must be assessed to see if the results are discriminatory

Consumer Rights Under NYPA

• Right to Notice – Consumers will have the right to notification, which includes information such as what data is being processed, who is processing it, and why.
• Opt-In Consent – Consumer consent must be clear and informed before any personal data is collected or processed.
• Right to Access, Correct Data – Companies will be required to offer simple methods for consumers to get information about the personal data that is being held about them and request adjustments.
• Right to Delete – Companies will be required to give data subjects frictionless ways to ask that their personal information be deleted. This also entails making sure that third parties dispose of material in accordance with the same parameters.

Only time will tell if the New York Privacy Act can make it through the State Senate Committee on Consumer Protection this year and we anticipate the momentum behind NYPA could result in a law being passed this year.