Copyright 2015, 2018, 2019, 2022 Solutions by Design
A Proposal to Enhance Personal Privacy
And to Make Personally Identifiable Data a Property Right
There have been many incidents of companies failing to secure personal information that they collect about customers or others. Several changes to the New York State General Business Law could better protect the public.
These changes should include:
1. Defining personal data (“private data” in the language of the General Business Law) to include any data about an individual or family.
2. Any item of data that alone or together with any other data, can be used to identify an individual. One example might be the last 4 digits of a person’s Social Security number together with age and place of birth.
3. Defining the owner of any personally identifiable data as the person(s) that the data identifies. This would impose real liability on holders of data (such as credit bureaus).
4. Defining a custodian of data as a company that holds any personally identifiable data.
5. Stating that personal data shall be treated under the law as any other item of personal property including, in terms of unlawful possession and theft under the Penal Law.
6. Imposing significant penalties on custodians for loss or misuse of personally identifiable data.
7. Creating a cause of action for loss or misuse of personally identifiable data and allowing such cases to be brought in small claims court and other courts, and encouraging class action suits for violations.
8. Prohibiting arbitration clauses in matters involving loss or misuse of personally identifiable data.
9. Prohibit any entity from requiring that a person have any particular form of identification, noting that a natural born citizen is not and may not be required to have any identification other than proof of birth in the United States.
My proposed changes to the General Business Law -
Proposed changes to the General Business Law -
“Notification; person without valid authorization has acquired private information.”
Text is available at http://codes.findlaw.com/ny/general-
1. 1. (a) add after “other identifier,” the following “or any collection or amalgamation of data,”
2. 1. (b) (1) add “or part of a social security number which, together with other data may be used to reconstruct a social security number.”
3. 1. (b) (3) strike “financial account” and replace with personal data including financial, legal, medical or any other information about an individual or family."
4. 1. (b) add “(4) or any other data or combination of data which could be used to uniquely identify an individual or family.”
5. 1. (b) add “(5) ownership of data shall vest in the person or entity described in the data.”
6. 1. (b) add “a person or entity having lawful possession of data shall be the custodian of the data.”
7. Add a new section immediately before 1. (c): (bb) (1)“Private information is the personal property of the person or person(s) described in the information.”
8. Add another new section following the above: (bb) (2) “A custodian of records is one who has lawful possession of private information about another.”
9. Modify 1. (c) by adding after “computerized” “or other data” to include data in audio, video, photographic, or paper form
10. 5 (b) add at the end, after “transaction” but if there is any indication that an electronic notification may not have been received, then the notice shall be provided in another way.”
11. 5. (d) (3) after “media” add including every network television station and every daily newspaper in the city of New York, city of Albany, and the city of Buffalo..
12. A new section shall be added at the end: “Any person injured by an action of a custodian shall have a right of recovery against the custodian and any person or entity that furnished any data to the custodian. The right of recovery shall include payment for time required, postage, transportation and any other expense to correct any loss incurred by the injured party and if an action is brought in small claims court the court shall allow these expenses. Time shall be billed at one half the hourly salary of a justice of the Supreme Court unless the claimant establishes that s/he normally is employed at a higher rate.”
13. Another new section shall be added: “No custodian of records shall ask any person about whom records are held to agree to arbitration of any matter under §899 or §349 of this law. A violation of this section shall be a class E felony and shall be punished by a fine of one hundred thousand dollars.”
14. Another new section shall be added: “no person shall require any citizen to have, posses, or secure any particular form of identification for any purpose other than identification issued by the custodian.