Int. No. 1588-A

By Council Members Williams, The Speaker (Council Member Mark-Viverito), Espinal, Ferreras-Copeland, Barron, Levin, Kallos, Dromm, Menchaca, Chin, Gentile, Rosenthal and Constantinides

A Local Law to amend the administrative code of the city of New York, in relation to identifying information

Be it enacted by the Council as follows:Section 1. Title 23 of the administrative code of the city of New York is amended by adding a new chapter 12 to read as follows:

CHAPTER 12

IDENTIFYING INFORMATION

§ 23-1201 Definitions. As used in this chapter, the following terms have the following meanings:

Chief privacy officer.  The term “chief privacy officer” means the person designated by the mayor pursuant to subdivision h of section 8 of the charter to act as the city’s chief privacy officer, or their designee.

Contracting agency. The term “contracting agency” means a city, county, borough, or other office, position, administration, department, division, bureau, board or commission, or a corporation, institution, or agency of government, the expenses of which are paid in whole or in part from the city treasury.

Contractor. The term "contractor" means a person who is a party to a contract with a contracting agency to provide human services, or other services designated in policies and protocols of the chief privacy officer.

Employee. The term "employee" means any officer or other person whose salary or wages are paid by a city agency.

Human services. The term “human services” has the meaning set forth in subdivision c of section 6-129.

Identifying information. The term "identifying information" means any information obtained by or on behalf of the city that may be used on its own or with other information to identify or locate an individual, including, but not limited to: name, sexual orientation, gender identity, race, marital or partnership status, status as a victim of domestic violence or sexual assault, status as a crime victim or witness, citizenship or immigration status, eligibility for or receipt of public assistance or city services, all information obtained from an individual’s income tax records, information obtained from any surveillance system operated by, for the benefit of, or at the direction of the police department, motor vehicle information or license plate number, biometrics such as fingerprints and photographs, languages spoken, religion, nationality, country of origin, place of birth, arrest record or criminal conviction, employment status, employer information, current and previous home and work addresses, contact information such as phone number and email address, information concerning social media accounts, date and/or time of release from the custody of the administration for children’s services, the department of correction, or the police department, any scheduled court appearances, or any scheduled appointments with any employee, contractor, or subcontractor.

Privacy officer. The term “privacy officer” means the person designated by the head of each city agency to act as such agency’s privacy officer. Where a disclosure of identifying information is in response to a request pursuant to the state freedom of information law, city agencies’ freedom of information law officers may perform the functions otherwise performed by the privacy officer with respect to such request.

                     Routine collection or disclosure. The term “routine collection or disclosure” means the collection or disclosure of identifying information that is made during the normal course of city agency business and furthers the purpose or mission of such agency. Routine collection or disclosure also includes the collection or disclosure of identifying information that occurs between agencies of the city when the privacy officers of the collecting agency and the disclosing agency agree that the collection or disclosure furthers the purpose or mission of their respective agencies.

Subcontractor. The term "subcontractor" means a person who is a party to a contract with a contractor to provide human services, or other services designated in policies and protocols of the chief privacy officer.

Third party. The term “third party” means any person other than: (i) personnel of the city, the department of education, or a local public benefit corporation or local public authority, or (ii) personnel of a contractor or subcontractor where such contractor or subcontractor is authorized to possess the relevant identifying information. 

§ 23-1202 Collection, retention and disclosure of identifying information.

a. Employees, contractors, and subcontractors shall collect, retain, and disclose identifying information only in accordance with this chapter.

b. Collection. 1. Absent exigent circumstances, no employee shall collect identifying information without the written approval of the privacy officer of such employee’s agency. In addition, such collection shall not be allowed unless it:

(a) furthers the purpose or mission of such city agency; or

(b) is required by law or treaty.

2. Notwithstanding the provisions of paragraph 1 of this subdivision:

(a) the privacy officer of an employee's agency may approve in advance certain routine collections of identifying information;

(b) the chief privacy officer may approve in advance a collection of identifying information not otherwise authorized by paragraph 1 of this subdivision upon the determination that such collection is in the best interests of the city; and

(c) the provisions of paragraph 1 of this subdivision do not apply:

(1) to any collection of identifying information by or to the police department in connection with an investigation of a crime that has been committed or credible information about an attempted or impending crime, or

(2) where the collection is in connection with an open investigation by a city agency concerning the welfare of a minor or an individual who is otherwise not legally competent.

Any such collections shall not require any additional approval by the privacy officer or chief privacy officer.

c. Disclosure. 1. Absent exigent circumstances, no employee shall disclose identifying information to any party outside such employee’s agency, including an employee of another city agency, without the written approval of the privacy officer of such agency. In addition, such disclosure shall not be allowed unless it:

(a) has been authorized in writing by the individual to whom such information pertains or, if such individual is a minor or is otherwise not legally competent, by such individual's parent, legal guardian, or other person with legal authority to consent on behalf of the individual;

(b) furthers the purpose or mission of such city agency; or

(c) is required by law or treaty.

2. Notwithstanding the provisions of this subdivision:

(a) the privacy officer of an employee's agency may approve in advance certain routine disclosures of identifying information;

(b) the chief privacy officer may approve in advance a disclosure to another city agency or agencies not otherwise authorized by paragraph 1 of this subdivision upon the determination that such disclosure is in the best interests of the city; and

(c) the provisions of paragraph 1 of this subdivision do not apply:

(1) to any disclosure of identifying information by or to the police department in connection with an investigation of a crime that has been committed or credible information about an attempted or impending crime, or

(2) where the disclosure is in connection with an open investigation by a city agency concerning the welfare of a minor or an individual who is otherwise not legally competent.

Any such disclosure shall not require any additional approval by the privacy officer or chief privacy officer.

3. Any request for identifying information or a proposal for the unsolicited disclosure of identifying information by an employee that does not concern a routine disclosure shall be sent to the privacy officer of such employee's agency as soon as practicable.

4. If an individual’s identifying information is disclosed in violation of this chapter, the privacy officer of such employee's agency that becomes aware of such disclosure shall notify the chief privacy officer as soon as practicable and, if such disclosure is one described in policies and protocols issued pursuant to subdivision 6 of section 23-1203, the agency responsible for the disclosure shall make reasonable efforts to notify such individual in writing of the identifying information disclosed and to whom it was disclosed as soon as practicable; provided, however, that this paragraph shall not require any notification that would violate the provisions of subdivision e of section 23-1204. The chief privacy officer shall submit a quarterly report containing an anonymized compilation or summary of such disclosures to the speaker of the council and shall make such report available online. Such report may be combined with the report required by subdivision d of this section. 

d. Exigent circumstances. 1. In the event identifying information is collected or disclosed under exigent circumstances, information about such collection or request and disclosure, along with an explanation of why such exigent circumstances existed, shall be sent to the chief privacy officer as soon as practicable after such collection or disclosure. This subdivision shall not require any such notification where:

(a) the collection or disclosure  is by or to the police department in connection with an open investigation of criminal activity; 

(b) the collection or disclosure is in connection with an open investigation concerning the welfare of a minor or an individual who is otherwise not legally competent; or

(c) the collection or disclosure is by or to an employee acting in furtherance of law enforcement or public health or safety powers of such employee’s agency under exigent circumstances and such collections or disclosures occur during the normal course of such agency’s business.

2. The chief privacy officer shall submit a quarterly report containing an anonymized compilation or summary of such disclosures to the speaker of the council and make such report available online.

e. Retention. A city agency shall retain identifying information where required by law. In addition, a city agency may retain identifying information to further the purpose or mission of such city agency, or when retention is in the interest of the city and is not contrary to the purpose or mission of such agency. This subdivision shall not prohibit a city agency from retaining aggregate demographic information that is anonymized.

f. Agency policies and protocols. Each city agency, acting in accordance with the policies and protocols of the chief privacy officer, may issue additional agency-specific guidance in furtherance of this chapter, including the policies and protocols promulgated pursuant to section 23-1203. 

g. Contractors and subcontractors. Each city agency shall require contractors that obtain identifying information, whether directly or through subcontractors, to apply the requirements of subdivisions b, c, d, and e of this section and any applicable policies and protocols adopted pursuant to this chapter; provided, however, that the duties of the privacy officer may be exercised by such contractors and subcontractors by designation of the agency.

h. Private right of action. Nothing in this chapter shall be construed to create a private right of action to enforce any provision of such chapter.

i. Construction. Nothing in this chapter shall prohibit city officers and employees from performing their duties in accordance with federal, state, and local law. 

§ 2. This local law takes effect 180 days after it becomes law; provided that effective immediately, affected agencies may take all steps necessary for timely implementation. In addition, where the provisions of chapter 12 of title 23 of the administrative code of the city of New York, as added by section one of this local law, cannot be applied consistently with currently applicable contracts, such provisions shall only apply with respect to contracts entered into or renewed after the effective date of this local law.

11/8/17 10:03AM

LS 9603