STATE OF NEW YORK ________________________________________________________________________ 7900 2025-2026 Regular Sessions IN ASSEMBLY April 11, 2025 ___________ Introduced by M. of A. CRUZ -- read once and referred to the Committee on Corporations, Authorities and Commissions AN ACT to amend the public authorities law, in relation to prohibiting the disclosure of individualized fare payment data by the metropolitan commuter transportation authority and the New York city transit authority The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Section 1266 of the public authorities law is amended by 2 adding a new subdivision 16-a to read as follows: 3 16-a. If a passenger station's entry system requires the purchase of 4 a card, token, or other device in order to enter the passenger station, 5 then (i) such card, token, or other device shall be available for 6 purchase, including by cash, throughout all hours of operation of the 7 passenger station, (ii) such card, token, or other device shall not be 8 registered to or otherwise associated with the identity of any individ- 9 ual, and (iii) such card, token, or other device shall not cost in 10 excess of the present-day value of five dollars as of January first, two 11 thousand twenty-five. 12 § 2. The public authorities law is amended by adding a new section 13 1279-j to read as follows: 14 § 1279-j. Customer privacy. 1. For the purposes of this section, the 15 following terms shall have the following meanings: 16 (a) "Data subject" shall have the same meaning as such term is defined 17 pursuant to subdivision three of section ninety-two of the public offi- 18 cers law. 19 (b) "Disclose" shall have the same meaning as such term is defined 20 pursuant to subdivision four of section ninety-two of the public offi- 21 cers law. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD09533-02-5
A. 7900 2 1 (c) "Police agency" shall have the same meaning as such term is 2 defined pursuant to subdivision eight of section eight hundred thirty- 3 five of the executive law. 4 (d) "Law enforcement agency" shall mean any agency which is empowered 5 by law to conduct an investigation or to make an arrest for a crime, and 6 any agency which is authorized by law to prosecute or participate in the 7 prosecution of a crime, and shall include any agency that primarily 8 enforces immigration law. 9 (e) "Law enforcement officer" shall mean a police officer or peace 10 officer, including transit police under subdivision sixteen of section 11 one thousand two hundred four of this article and including any person 12 employed by the authority police force established pursuant to section 13 one thousand two hundred sixty-six of this title as well as any person 14 employed by any agency that primarily enforces immigration law. 15 (f) "Police officer" shall have the same meaning as such term is 16 defined pursuant to subdivision thirty-four of section 1.20 of the crim- 17 inal procedure law. 18 (g) "Peace officer" shall mean any individual listed pursuant to 19 section 2.10 of the criminal procedure law. 20 (h) "Person employed" shall mean any employee, independent contractor, 21 or volunteer under the statutory and common law of the state of New York 22 acting in the scope of their duties as an employee, independent contrac- 23 tor, or volunteer. 24 (i) "Individualized fare payment data" shall mean personal informa- 25 tion, as defined in subdivision seven of section ninety-two of the 26 public officers law, related to payment of fares to the authority or its 27 subsidiary corporations in order to enter, access, or otherwise use a 28 transportation system administered by the authority or its subsidiary 29 corporations. "Individualized fare payment data" shall include, but not 30 be limited to, data that correlates a card, token, or device used to pay 31 a fare and the locations at which such card, token or device was used. 32 2. (a) The authority, its subsidiary corporations, or any other person 33 or entity in possession of a data subject's individualized fare payment 34 data shall not disclose such individualized fare payment data to a 35 police agency, law enforcement agency, or law enforcement officer, or 36 use a data subject's individualized fare payment data for law enforce- 37 ment purposes, unless such a disclosure is: 38 (i) reasonably necessary to prevent a serious and imminent threat to 39 the life or safety of the data subject or others, and notification of 40 the disclosure is transmitted to the data subject within twenty days if 41 such notice is practicable; or 42 (ii) pursuant to a search warrant, supported by particularized proba- 43 ble cause with respect to each data subject whose individualized fare 44 payment data is disclosed. 45 (b) The authority, its subsidiary corporations, or any other person or 46 entity in possession of a data subject's individualized fare payment 47 data shall not sell such individualized fare payment data to any third 48 party. 49 (c) If the authority enters into a partnership or agreement with 50 another entity to provide services, including but not limited to fare 51 payment services, and such other entity directly collects individualized 52 fare payment data pursuant to such a partnership or agreement, the enti- 53 ty shall not disclose such individualized fare payment data other than 54 pursuant to paragraphs (a) and (b) of this subdivision.
A. 7900 3 1 (d) The authority shall not enter into an agreement described in para- 2 graph (c) of this subdivision with any police agency or law enforcement 3 agency. 4 (e) The authority shall not transfer individualized fare payment data 5 except pursuant to paragraphs (a) and (c) of this subdivision. 6 3. (a) Any data subject or caller whose communication was disclosed in 7 violation of this section may seek judicial review and relief against 8 any private person or entity responsible for such disclosure for: 9 (i) five thousand dollars per violation or actual damages, whichever 10 is greater; 11 (ii) punitive damages; and 12 (iii) any other relief the court deems warranted. 13 (b) In assessing the amount of punitive damages awarded to a plaintiff 14 in an action brought under paragraph (a) of this subdivision, the court 15 shall consider: 16 (i) the defendant's pattern of violations of this section; and 17 (ii) the impact of the violation on the data subject's or caller's 18 exercise of constitutional and statutory rights, including, but not 19 limited to, religion, political views, and medical care. 20 (c) In any action brought under paragraph (a) of this subdivision, the 21 court shall award reasonable attorneys' fees, expenses, and costs to a 22 prevailing plaintiff. 23 (d) The attorney general may seek an injunction from any court of 24 proper jurisdiction for any violation of this section. 25 (e) (i) The authority shall, quarterly, provide to the inspector 26 general a list of each instance in which it shared individualized fare 27 payment data with a police agency, law enforcement agency, or law 28 enforcement officer, which shall be kept by the inspector general for a 29 period of five years. 30 (ii) Such list provided pursuant to this paragraph shall contain the 31 date of the disclosure; a detailed description of the data shared, 32 anonymized to prevent identification of the individuals to whom such 33 data relates; the individual, agency, and division of such agency, if 34 applicable, to which it was shared; if such data was shared pursuant to 35 subparagraph (i) of paragraph (a) of subdivision two of this section, a 36 detailed description of the exigency and the date of notification of the 37 data subject, or, if notice was not practicable, a detailed description 38 of the efforts made to notify the data subject; if such data was shared 39 pursuant to subparagraph (ii) of paragraph (a) of subdivision two of 40 this section, a copy of the warrant. 41 (iii) The inspector general shall review each disclosure, and if the 42 inspector general finds an instance of disclosure made in violation of 43 this section, the inspector general refer such improper disclosure to 44 the attorney general for potential legal action. 45 4. Nothing in this section shall be construed to: 46 (a) limit or abridge the right of any person to obtain judicial review 47 or pecuniary or other relief, in any other form or upon any other basis, 48 otherwise available to a person; or 49 (b) require the authority or any other entity to collect or retain any 50 information about a caller or data subject. 51 § 3. Section 1205 of the public authorities law is amended by adding a 52 new subdivision 9 to read as follows: 53 9. If a passenger station's entry system requires the purchase of a 54 card, token, or other device in order to enter the passenger station, 55 then (i) such card, token, or other device shall be available for 56 purchase, including by cash, throughout all hours of operation of the
A. 7900 4 1 passenger station, (ii) such card, token, or other device shall not be 2 registered to or otherwise associated with the identity of any individ- 3 ual, and (iii) such card, token, or other device shall not cost in 4 excess of the present-day value of five dollars as of January first, two 5 thousand twenty-five. 6 § 4. The public authorities law is amended by adding a new section 7 1204-g to read as follows: 8 § 1204-g. Customer privacy. 1. For the purposes of this section, the 9 following terms shall have the following meanings: 10 (a) "Data subject" shall have the same meaning as such term is defined 11 pursuant to subdivision three of section ninety-two of the public offi- 12 cers law. 13 (b) "Disclose" shall have the same meaning as such term is defined 14 pursuant to subdivision four of section ninety-two of the public offi- 15 cers law. 16 (c) "Police agency" shall have the same meaning as such term is 17 defined pursuant to subdivision eight of section eight hundred thirty- 18 five of the executive law. 19 (d) "Law enforcement agency" shall mean any agency which is empowered 20 by law to conduct an investigation or to make an arrest for a crime, and 21 any agency which is authorized by law to prosecute or participate in the 22 prosecution of a crime, and shall include any agency that primarily 23 enforces immigration law. 24 (e) "Law enforcement officer" shall mean a police officer or peace 25 officer, including transit police under subdivision sixteen of section 26 one thousand two hundred four of this title and including any person 27 employed by the authority police force established pursuant to section 28 one thousand two hundred sixty-six of this article as well as any person 29 employed by any agency that primarily enforces immigration law. 30 (f) "Police officer" shall have the same meaning as such term is 31 defined pursuant to subdivision thirty-four of section 1.20 of the crim- 32 inal procedure law. 33 (g) "Peace officer" shall mean any individual listed pursuant to 34 section 2.10 of the criminal procedure law. 35 (h) "Person employed" shall mean any employee, independent contractor, 36 or volunteer under the statutory and common law of the state of New York 37 acting in the scope of their duties as an employee, independent contrac- 38 tor, or volunteer. 39 (i) "Individualized fare payment data" shall mean personal informa- 40 tion, as defined in subdivision seven of section ninety-two of the 41 public officers law, related to payment of fares to the authority or its 42 subsidiary corporations in order to enter, access, or otherwise use a 43 transportation system administered by the authority or its subsidiary 44 corporations. "Individualized fare payment data" shall include, but not 45 be limited to, data that correlates a card, token, or device used to pay 46 a fare and the locations at which such card, token or device was used. 47 2. The authority shall comply with the requirements of subdivision two 48 of section one thousand two hundred seventy-nine-j of this article. 49 3. (a) Any data subject or caller whose communication was disclosed in 50 violation of this section may seek judicial review and relief against 51 any private person or entity responsible for such disclosure for: 52 (i) five thousand dollars per violation or actual damages, whichever 53 is greater; 54 (ii) punitive damages; and 55 (iii) any other relief the court deems warranted.
A. 7900 5 1 (b) In assessing the amount of punitive damages awarded to a plaintiff 2 in an action brought under paragraph (a) of this subdivision, the court 3 shall consider: 4 (i) the defendant's pattern of violations of this section; and 5 (ii) the impact of the violation on the data subject's or caller's 6 exercise of constitutional and statutory rights, including, but not 7 limited to, religion, political views, and medical care. 8 (c) In any action brought under paragraph (a) of this subdivision, the 9 court shall award reasonable attorneys' fees, expenses, and costs to a 10 prevailing plaintiff. 11 (d) The attorney general may seek an injunction from any court of 12 proper jurisdiction for any violation of this section. 13 (e) (i) The authority shall, quarterly, provide to the inspector 14 general a list of each instance in which it shared individualized fare 15 payment data with a police agency, law enforcement agency, or law 16 enforcement officer, which shall be kept by the inspector general for a 17 period of five years. 18 (ii) Such list provided pursuant to this paragraph shall contain the 19 date of the disclosure; a detailed description of the data shared, 20 anonymized to prevent identification of the individuals to whom such 21 data relates; the individual, agency, and division of such agency, if 22 applicable, to which data was shared; if such data was shared pursuant 23 to subparagraph (i) of paragraph (a) of subdivision two of this section, 24 a detailed description of the exigency and the date of notification of 25 the data subject, or, if notice was not practicable, a detailed 26 description of the efforts made to notify the data subject; if such data 27 was shared pursuant to subparagraph (ii) of paragraph (a) of subdivision 28 two of this section, a copy of the warrant. 29 (iii) The inspector general shall review each disclosure, and if the 30 inspector general finds an instance of disclosure made in violation of 31 this section, the inspector general refer such improper disclosure to 32 the attorney general for potential legal action. 33 4. Nothing in this section shall be construed to: 34 (a) limit or abridge the right of any person to obtain judicial review 35 or pecuniary or other relief, in any other form or upon any other basis, 36 otherwise available to a person; or 37 (b) require the authority or any other entity to collect or retain any 38 information about a caller or data subject. 39 § 5. This act shall take effect immediately.