Consumer Reports supports S. 6701, the New York Privacy Act. Though the collection and monetization of New Yorkers’ personal data has dramatically expanded over the last thirty years, consumers have almost no say over whether their information will be shared by a company with countless others. This important bill will protect New Yorkers’ privacy online, by default, ensure that New Yorkers cannot be charged for protecting their data, and provide appropriate incentives for companies to comply.
Now more than ever, New Yorkers need strong rules to ensure their privacy. These protections are long overdue: consumers are constantly tracked, and information about their online and offline activities are combined to provide detailed insights into a consumers’ most personal characteristics, including health conditions, political affiliations, and sexual preferences. This information is sold as a matter of course, is used to deliver targeted advertising, facilitates differential pricing, and enables opaque algorithmic scoring—all of which can lead to disparate outcomes along racial and ethnic lines.
This bill corrects that imbalance by establishing strong privacy protections over consumers’ personal information, including the following key protections:
- Requirement that companies obtain consumers’ permission before processing their data. Measures largely based on an opt-out model could require consumers to contact hundreds, if not thousands, of different companies in order to fully protect their privacy—which simply isn’t workable. Making matters worse, Consumer Reports has documented that some California Consumer Privacy Act (CCPA) opt-out processes are so onerous that they have the effect of preventing consumers from stopping the sale of their information. In contrast, this bill would require that companies get consumers’ permission before collecting, using, or sharing their data.
- Strong enforcement: Importantly, this bill includes a private right of action—and does not include a so-called “right to cure” in the administrative enforcement section. “Right to cure” provisions could force law enforcement to waste precious time and money building cases that go nowhere. And a private right of action is key to incentivizing companies to comply. Further, it’s appropriate that consumers are able to hold companies accountable in some way for violating their rights.
- Non-discrimination. Not only does the non-discrimination language in NYPA clarify that consumers cannot be charged for exercising their rights under the law, but it makes it clear that legitimate loyalty programs, that reward consumers for repeated patronage, are supported by the law.
- Authorized agent rights. Appropriately, the NYPA allows consumers to delegate to third parties the ability to submit privacy requests on their behalf—allowing for a practical option for consumers to exercise their privacy rights.
For years, companies have freely collected and monetized New Yorkers’ personal information without their consent or awareness. The NYPA would give consumers meaningful privacy protections, and we urge support of the bill.