Can I collect device information from participants in New York? What are the requirements?

Yes, you can collect device information from participants in New York, but there are certain requirements that must be followed. According to 9 NYCRR 5401.1, members of the public may assert rights granted by the Personal Privacy Protection Law. Applications shall be made on printed forms prescribed by the board and submitted either personally or by mail to the New York State Gaming Commission, One Broadway Center, Schenectady, NY 12305, Attention: Privacy Compliance Officer. The person to whom such requests shall be made, and from whom such records or copies thereof may be obtained and certified, shall be the individual(s) designated by the executive director as the commission’s Privacy Compliance Officer(s). The duties of the Privacy Compliance Officer shall be: (1) assisting data subject in identifying and requesting personal information, if necessary; (2) describing the contents of systems records orally or in writing in order to enable a data subject to learn if a system of records includes a record or personal information identifiable to a data subject requesting such record or personal information; (3) taking one of the following actions upon locating the record sought: (i) make the record available for inspection, in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided; (ii) deny access to the record in whole or in part and explain in writing the reasons therefor; (iii) make a copy available, upon request, upon payment of established fees, if any, or permitting the data subject to copy the records; and (4) (i) upon request, certifying that copy of the record is a true copy; or (ii) certifying, upon request, that: (a) the commission does not have possession of the record sought; (b) the commission cannot locate the record sought after having made a diligent search; or (c) the information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject without extraordinary search methods being employed by the commission.

Therefore, you can collect device information from participants in New York, but you must follow the procedures outlined in 9 NYCRR 5401.1.

Jurisdiction

New York

• Privacy