Can I sell personal information without obtaining consent in New York? What are the requirements?

Based on the documents provided, selling personal information without obtaining consent in New York is generally prohibited. However, there are exceptions to this rule.

Exceptions to Selling Personal Information without Consent

Under 11 NYCRR 420.15, a licensee may disclose nonpublic personal financial information without obtaining consent in the following circumstances:

• With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction.
• To protect the confidentiality or security of a licensee’s records pertaining to the consumer, service, product, or transaction.
• To protect against or prevent actual or potential fraud or unauthorized transactions, claims, or other liabilities.
• For required institutional risk control or for resolving consumer disputes or inquiries.
• To persons holding a legal or beneficial interest relating to the consumer.
• To persons acting in a fiduciary or representative capacity on behalf of the consumer.
• To provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants, and auditors.
• To comply with Federal, State, or local laws, rules and other applicable legal requirements.
• To comply with a properly authorized civil, criminal or regulatory investigation, or subpoena or summons by Federal, State or local authorities.
• To respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance or other purposes as authorized by law.
• For purposes related to the replacement of a group benefit plan, a group health plan, a group welfare plan or a workers’ compensation plan.

Under 11 NYCRR 420.13, a licensee may provide nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf without obtaining consent if the licensee provides the initial notice in accordance with section 420.4 of this Part and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.

Requirements for Selling Personal Information

If a licensee is permitted to sell personal information without obtaining consent, there are still requirements that must be met. For example, under 11 NYCRR 420.15(a)(2), a licensee may only disclose nonpublic personal financial information to its affiliates, but the affiliates may, in turn, disclose and use the information only to the extent that the licensee may disclose and use the information. Additionally, under 11 NYCRR 420.13(a)(1)(ii), the licensee must enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.

Disclosure of Records or Personal Information

Under 21 NYCRR 2053.4, a corporation may not disclose any record or personal information unless such disclosure is pursuant to a written request by or the voluntary written consent of the data subject, provided that such request or consent by its terms limits and specifically describes the personal information which is requested to be disclosed, the person or entity to whom such personal information is requested to be disclosed, and the uses which will be made of such personal information by the person or entity receiving it. However, there are exceptions to this rule, such as when the disclosure is subject to disclosure under the Freedom of Information Law, or pursuant to a court ordered subpoena or other compulsory legal process.

Authorization Required for Disclosure of Nonpublic Personal Health Information

Under 11 NYCRR 420.17, a licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed. However, there are exceptions to this rule, such as when the disclosure is for the performance of insurance functions by or on behalf of the licensee, or when the disclosure is required pursuant to governmental reporting authority or to comply with legal process.

Conclusion

In general, selling personal information without obtaining consent in New York is prohibited. However, there are exceptions to this rule, such as when the disclosure is made to comply with legal requirements or to protect against fraud. If a licensee is permitted to sell personal information without obtaining consent, there are still requirements that must be met, such as entering into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information. Additionally, there are specific requirements for disclosing nonpublic personal financial information and nonpublic personal health information.

Jurisdiction

New York

• Privacy