91 – Short Title.

§ 91. Short title. This article shall be known as the “personal privacy protection law”.

92 – Definitions.

§ 92. Definitions. (1) Agency. The term “agency” means any state board, bureau, committee, commission, council, department, public authority, public benefit corporation, division, office or any other governmental entity performing a governmental or proprietary function for the state of New York, except the judiciary or the state legislature or any unit of local government and […]

93 – Powers and Duties of the Committee.

§ 93. Powers and duties of the committee. (1) The committee shall prepare a directory derived from the information provided pursuant to section three of chapter six hundred seventy-seven of the laws of nineteen hundred eighty and subdivision four of section ninety-four of this article. The directory shall include the name of each system of […]

94 – Agency Obligations.

§ 94. Agency obligations. (1) Each agency that maintains a system of records shall: (a) except when a data subject provides an agency with unsolicited personal information, maintain in its records only such personal information which is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive […]

95 – Access to Records.

§ 95. Access to records. (1) (a) Each agency subject to the provisions of this article, within five business days of the receipt of a written request from a data subject for a record reasonably described pertaining to that data subject, shall make such record available to the data subject, deny such request in whole […]

96 – Disclosure of Records.

§ 96. Disclosure of records. (1) No agency may disclose any record or personal information unless such disclosure is: (a) pursuant to a written request by or the voluntary written consent of the data subject, provided that such request or consent by its terms limits and specifically describes: (i) the personal information which is requested […]

96-A – Prohibited Conduct.

§ 96-a. Prohibited conduct. 1. Beginning on January first, two thousand ten the state and its political subdivisions shall not do any of the following, unless required by law: (a) Intentionally communicate to the general public or otherwise make available to the general public in any manner an individual’s social security account number. This paragraph […]

97 – Civil Remedies.

§ 97. Civil remedies. (1) Any data subject aggrieved by any action taken under this article may seek judicial review and relief pursuant to article seventy-eight of the civil practice law and rules. (2) In any proceeding brought under subdivision one of this section, the party defending the action shall bear the burden of proof, […]

98 – No Waiver.

§ 98. No waiver. Any agreement purporting to waive a data subject’s rights under this article is hereby declared to be void as against public policy.

99 – Executive Authority.

§ 99. Executive authority. Nothing in this article shall limit the authority of the governor to exercise his or her responsibilities.