New York Senate Bill S03392

New York 2025-2026 Regular Session

• Introduced: 1/27/25
• Refer: 1/27/25
• Report Pass: 5/20/25
• Refer: 1/7/26

Caption

Establishes the "one city act" which applies to cities with a population of one million or more and provides for an agency to disclose the personal information of individuals that would otherwise be restricted from disclosure to another agency or agent thereof for the limited purpose of providing benefits, services, or care coordination to individuals or a research study concerning the provision of benefits, services or care coordination.

Summary

S03392, the “one city act,” authorizes agencies within a city with a population of one million or more to share otherwise restricted personal information with one another for limited purposes related to delivering benefits, services, and care coordination. The bill is aimed at improving cross-agency coordination so that city government can function more like a single integrated system when serving residents with complex needs, including food, shelter, mental health services, public benefits, education, and health care. The bill defines key terms such as “benefits,” “services,” “care coordination,” “human services agency,” and “personal information,” and it permits disclosure only when federal confidentiality law allows it. It also allows sharing for certain research studies on the provision of benefits and services, so long as those studies comply with applicable human-subjects laws. The measure expressly excludes use of the data-sharing authority for criminal investigations. To protect privacy and cybersecurity, the bill requires any disclosure to be governed by a written agreement approved by legal counsel and relevant security/privacy officials. Those agreements must limit access to employees or agents who need the information for their duties, specify what information is shared and why, prohibit redisclosure without permission except where required by law, and impose security requirements at least as strict as the city’s cyber-defense standards. The bill would amend the General Municipal Law by adding a new section 139-f and would take effect immediately. Its practical effect would be to create a statutory framework for interagency data sharing in New York City-type governments, potentially easing barriers to coordinated social services while preserving confidentiality safeguards. Overall, the bill appears to have favorable committee support, as reflected by a unanimous 7-0 Senate Cities 1 Committee vote. The main policy tension is between improving service delivery through data sharing and protecting individual privacy, with the bill attempting to address that concern through narrow purpose limits, written agreements, and cybersecurity requirements.

Impact

The bill would add a new section 139-f to the General Municipal Law, creating explicit authority for agencies in cities of one million or more residents to disclose personal information to other city agencies or agents for benefits delivery, services, care coordination, and certain compliant research. It would override existing local disclosure restrictions only to the extent permitted by federal confidentiality law and only within the bill’s narrow purposes, while also imposing mandatory written-agreement, access-control, anti-redisclosure, and cybersecurity requirements. It would not authorize disclosures for criminal investigations.

Sentiment

The available voting history suggests the bill was received positively in committee, with a unanimous 7-0 vote in the Senate Cities 1 Committee. The bill’s findings and structure indicate a policy consensus around improving coordination for vulnerable residents, especially in human services, while also acknowledging the need for strong privacy and cybersecurity protections. No opposing committee discussion is provided, but the design of the bill reflects an effort to balance administrative efficiency with confidentiality concerns.

Contention

The principal point of contention is the use of personal information across city agencies: supporters are likely focused on better coordination of benefits and services for residents with complex needs, while privacy advocates may be concerned about expanded internal government access to sensitive data. The bill responds to those concerns by limiting disclosure to specified purposes, requiring written agreements and security controls, and barring use for criminal investigations. Another potential area of concern is the bill’s application only to cities of one million or more, which effectively targets New York City and may raise questions about why the authority is limited to that jurisdiction.