Restricts the disclosure of personal information by businesses; provides that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all of the customer's personal information retained by the business.
This bill, titled the “Right to Know Act,” would amend New York’s General Business Law to give consumers stronger rights to learn what personal information businesses retain about them and share with third parties. A business that retains a customer’s personal information would have to provide, free of charge, access to or copies of that information upon request. If the business discloses personal information to third parties, it would also have to identify the categories of information disclosed and provide the names and contact information of the third parties that received it, subject to specified procedures and exceptions.
The bill defines “personal information” broadly to include identifiers such as names, addresses, phone numbers, account numbers, government IDs, location data, internet or mobile activity, medical and financial information, and content provided by the customer. It also sets out what counts as a “business,” “customer,” “disclose,” “retain,” and “third party,” and it includes exceptions for disclosures needed to provide services, comply with law, address fraud or security issues, or handle publicly available information. The bill would take effect immediately and would authorize civil actions by customers and public prosecutors for violations.
The bill would create a new section of the General Business Law, section 899-cc, and would also rename article 39-F to reflect broader coverage of unauthorized acquisition and use of private information and data security protections. It would impose new disclosure and access obligations on businesses operating in New York, including many private companies and nonprofits, while excluding public corporations as defined by law. The measure would expand consumer privacy rights and create potential civil liability for noncompliance, with enforcement available to private customers as well as the attorney general and local prosecutors.
The bill text reflects a strongly pro-privacy posture, emphasizing consumer transparency, personal safety, and financial security. No committee transcripts or recorded votes were provided, so there is no documented legislative debate or roll-call sentiment to assess. Based on the bill’s framing, the measure appears intended to respond to concerns about data brokers, online tracking, and the sale of personal information.
The main points of contention likely concern the scope of the disclosure mandate, the breadth of the definition of personal information, and the compliance burden on businesses that collect or share consumer data. Businesses may object to having to identify third parties and provide detailed disclosure records, especially where data is shared through complex advertising or analytics ecosystems. Privacy advocates, by contrast, would likely support the bill’s broad consumer access rights and its inclusion of sensitive categories such as health, location, and internet activity data. The bill’s exceptions for service providers, legal compliance, fraud prevention, and publicly available information are likely intended to limit those concerns.