Establishes a private right of action for any person whose personally identifying information was intentionally disclosed by another individual, without consent, for the purpose of harassing, threatening, intimidating, or causing harm to such person, or with reckless disregard as to whether such disclosure would cause such harm; defines personal information.
S09658 would amend the New York Civil Rights Law to create a new private right of action for the malicious disclosure of personally identifying information. A person could sue another individual who intentionally publishes or otherwise makes available their personal information without consent, when done to harass, threaten, intimidate, or cause harm, or with reckless disregard for those consequences, and the disclosure results in harassment, physical harm, emotional distress, threats or fear of violence, stalking, or damage to property or livelihood.
The bill defines “personally identifying information” broadly to include items such as home address, phone number, email address, Social Security number, financial account information, driver’s license or state ID number, biometric data, and geolocation data tied to a person’s home, workplace, school, or habitual location. It also authorizes injunctive or declaratory relief, actual damages, punitive damages up to $50,000, and attorney’s fees and costs, while preserving other legal remedies and stating that no prior criminal complaint or conviction is required.
If enacted, the bill would add a new civil remedy to New York law for doxxing-style conduct and related privacy invasions, expanding potential liability for individuals who intentionally expose another person’s identifying information with harmful intent. It would not apply to reporting unlawful conduct, lawful law-enforcement or legal proceedings, disclosures made under subpoena, warrant, or court order, or matters of legitimate public concern such as news reporting and protected expressive activity. The bill also states that prior public availability of the information is not, by itself, a defense, and it expressly preserves federal Communications Decency Act Section 230 protections for interactive computer services.
Based on the bill text and the lack of recorded committee discussion or votes, the measure appears to be framed as a privacy and anti-harassment protection rather than a controversial regulatory expansion. Its structure suggests an intent to target harmful, intentional disclosures while carving out exceptions for journalism, public concern, and legal process, which may make it broadly palatable to privacy advocates and civil liberties interests. No formal vote history or transcript record is available here to show support or opposition.
The main points of potential contention are the breadth of the definition of personally identifying information, the inclusion of information previously made public, and the scope of liability for individuals who repost or share information online. Critics could argue that the bill may chill speech or create uncertainty around public-interest reporting, while supporters would likely emphasize the intent requirement, the harm threshold, and the explicit exceptions for lawful reporting, legal process, and constitutionally protected expression. Another possible issue is the interaction with online platforms and Section 230, though the bill expressly says it does not alter those federal protections.