Int. No. 1632

By Council Members Brannan, Salamanca, Adams, Rivera, Reynoso, Ampry-Samuel, Louis, Menchaca, Koo, Chin, Maisel, Dromm and Cornegy

A Local Law to amend the administrative code of the city of New York, in relation to a prohibition on sharing location data with third parties

Be it enacted by the Council as follows:

Section 1. Title 23 of the administrative code of the city of New York is amended by adding a new chapter 13 to read as follows:

CHAPTER 13

PROHIBITION ON SHARING LOCATION DATA

§ 23-1301 Definitions.

§ 23-1302 Prohibition on sharing location data.

                     § 23-1303 Exceptions.

                     § 23-1304 Enforcement.

                     § 23-1305 Penalties.

                     § 23-1306 Private right of action.

§ 23-1307 Rulemaking.

                     § 23-1301 Definitions. As used in this chapter, the following terms have the following meanings:

Authorized use. 1. The term “authorized use” means the sharing of a customer’s location data:

(a) For the purpose of providing a service explicitly requested by such customer;

(b) Exclusively for the purpose of providing a service explicitly requested by such customer; and

(c) Where such data is not collected, shared, stored or otherwise used by a third party for any purpose other than providing a service explicitly requested by such customer.

2. Such term does not include any instance in which a customer’s location data is shared in exchange for products or services.

                     Customer. The term “customer” means a current or former subscriber to a telecommunications carrier or a current or former user of a mobile application.

                     Location data. The term “location data” means information related to the physical or geographical location of a person or the person’s mobile communications device, regardless of the particular technological method used to obtain this information.

Mobile application. The term “mobile application” means a software program that runs on the operating system of a mobile communications device.

Mobile application developer. The term “mobile application developer” means a person that owns, operates or maintains a mobile application and makes such application available for the use of customers, whether for a fee or otherwise.

                     Mobile communications device. The term “mobile communications device” means any portable wireless telecommunications equipment that is utilized for the transmission or reception of data, including location data, and that is or may be commonly carried by or on a person or commonly travels with a person, including in or as part of a vehicle a person drives.
                     Share. The term “share” means to make location data available to another person, whether for a fee or otherwise.

                     Telecommunications carrier. The term “telecommunications carrier” means a service offered to the public for a fee that transmits sounds, images or data through wireless telecommunications technology.

                     § 23-1302 Prohibition on sharing location data. a. It is unlawful for a mobile application developer or a telecommunications carrier to share a customer’s location data where such location data was collected while the customer’s mobile communications device were physically present in the city.

b. It is unlawful for a person who receives location data that is shared in violation of subdivision a of this section to share such data with any other person.

c. Each instance in which a mobile application developer, telecommunications carrier or other person shares a customer’s location data with another person in a manner prohibited by this section constitutes a separate violation of this section.

                     § 23-1303 Exceptions. Section 23-1302 does not apply to:

1. Information provided to a law enforcement agency in response to a lawful process;

2. Information provided to an emergency service agency responding to a 911 communication or any other communication reporting an imminent threat to life or property;

3. Information required to be provided by federal, state or local law; or

4. A customer providing the customer’s own location data to a mobile application or telecommunications carrier to be shared for an authorized use.

                     § 23-1304 Enforcement. The department of information technology and telecommunications shall enforce the provisions of this section.

                     § 23-1305 Penalties. a. Except as provided in subdivision b, any person who violates section 23-1302 shall be subject to a civil penalty of $1,000 for each such violation.

b. Where a person commits multiple violations of subdivisions a or b of section 23-1302 on the same day, the maximum civil penalty assessed against such person for all violations occurring on such day shall be a cumulative penalty of $10,000 per person whose location data was shared unlawfully.

                     § 23-1306 Private right of action. a. Any customer whose location data has been shared in violation of this chapter may bring an action in any court of competent jurisdiction. If a court of competent jurisdiction finds that a person has violated a provision of this chapter, the court may award: (i) actual damages, computed at a rate of $1,000 per violation up to $10,000 per day; and (ii) reasonable attorney’s fees and costs incurred in maintaining such civil action.

b. The private right of action provided by this section does not supplant any other claim or cause of action available to a customer under common law or by statute. The provisions of this section are in addition to any such common law and statutory remedies.

c. Nothing in this chapter shall be construed as creating a private right of action against the city or any agency or employee thereof.

§ 23-1307 Rulemaking. The commissioner of information technology and telecommunications may promulgate and amend rules in furtherance of the administration of this chapter.

§ 2. This local law takes effect 120 days after it becomes law, provided that where the provisions of section 23-1302 of the administrative code of the city of New York, as added by section one of this local law, cannot be applied consistently with currently applicable contracts, such provisions shall only apply with respect to contracts entered into or renewed after the effective date of this local law. AM

LS #9645

3/27/19