New York Considers a Radical Privacy Bill

ANA, along with the 4A’s, AAF, IAB, and NAI, recently wrote to the Chairman of the New York Senate’s Consumer Protection Committee, Senator Kevin Thomas, about his legislation, the New York Privacy Act (S6701).  We have a number of concerns with the bill, as we pointed out in the letter, and hope the legislature will reconsider the troublesome provisions in the bill before moving forward in the limited time remaining in this year’s session.

First, the bill would set an extremely broad opt-in requirement for all data processing activity. Our fear is that this will create “consent fatigue” among consumers who receive multiple, onerous notices from every business they interact with online, leading to an all or nothing result where consumers either provide consent to get the service they want or deny all requests out of frustration. We urge the legislature to refine this provision to provide consumers with true protections that allow them to engage in routine activities online without these overly burdensome requirements.

Second, the bill would impose new duties of care and loyalty for data on business, which are untested and not actively being considered anywhere else in the United States.  These obligations, including determining whether it is “reasonably foreseeable…that a process will be against a consumer’s physical, financial, psychological, or reputational interest,” would place unprecedented burdens on companies making well-meaning decisions that would nonetheless face arduous compliance and legal costs.  

Additionally, the law would create a sweepingly broad private right of action.  We are strongly against private rights of action, which create a complex and flawed compliance system providing consumers with tangible benefits.  Instead, the courts will be confronted with an enormous number of frivolous lawsuits that will only benefit the trial lawyer’s bar, instead of the consumer. Additionally, a private right of action would have a negative economic impact, as businesses would face crippling costs for technical violations while encumbering their attempts to innovate.