Establishes a private right of action for malicious disclosure of personally identifying information by another individual
This bill would amend the New York Civil Rights Law to create a new private right of action for the malicious disclosure of personally identifying information. A person could sue another individual who intentionally discloses their information without consent, or with reckless disregard for harm, when the disclosure is intended to harass, threaten, intimidate, or cause harm and results in harassment, physical harm, substantial emotional distress, threats or fear of violence, stalking, or damage to property or livelihood.
The bill authorizes courts to grant injunctive or declaratory relief, actual damages, punitive damages up to $50,000, and reasonable attorney’s fees and court costs. It defines covered “personally identifying information” broadly to include home addresses, phone numbers, email addresses, Social Security numbers, financial account numbers, driver’s license or state ID numbers, biometric data, and geolocation data tied to a person’s home, workplace, school, or other habitual location. The bill also states that prior public availability of the information is not, by itself, a defense if the disclosure was made with the required harmful intent or reckless disregard.
The bill would add a new section 52-e to the Civil Rights Law, creating a standalone civil remedy for doxxing-like conduct by private individuals. It would expand potential liability for intentional harmful disclosure of personal information while preserving existing remedies and making clear that the measure does not alter federal Communications Decency Act Section 230 protections for interactive computer services. The bill also includes exceptions for reporting unlawful conduct, lawful law-enforcement and legal proceedings, disclosures made under subpoena/warrant/court order, and matters of legitimate public concern protected by the state and federal constitutions.
Based on the bill text and the absence of recorded committee debate or votes, the overall sentiment appears to be protective of privacy and safety, with the measure framed as a response to harassment and intimidation through disclosure of personal information. The bill’s structure suggests an intent to provide victims with meaningful civil remedies while avoiding interference with journalism, public-interest speech, and lawful government processes.
The main points of potential contention are the scope of liability and the balance between privacy protection and free-expression interests. Critics could focus on the broad definition of personally identifying information, the inclusion of information previously made public, and the possibility of litigation over intent or reckless disregard. Supporters would likely emphasize the need to deter doxxing, stalking, threats, and other harms, while the bill’s explicit carveouts for news reporting, commentary, public concern, and lawful disclosures appear designed to address First Amendment and public-record concerns.