Can I use third-party marketing automation tools that collect personal information in New York? What are the requirements?

Use of Third-Party Marketing Automation Tools in New York

If you are using third-party marketing automation tools that collect personal information in New York, you must comply with the relevant laws and regulations.

NYCL GBS § 640

NYCL GBS § 640 prohibits manufacturers or distributors of home-use medical diagnostic devices from disclosing personal identifiable information of a user for target marketing purposes without first affording the user the right to prohibit such disclosure. The warranty registration card, owner’s registration card, or other similar form must conspicuously disclose that a user’s personal identifiable information may be used for target marketing purposes and provide the user with the opportunity to be excluded from any such target marketing list by means of a check-off box contained on the card or other similar form.

11 NYCRR 420.14

11 NYCRR 420.14 provides exceptions to notice and opt-out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions. The requirements for initial notice to the consumer do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with servicing or processing an insurance product or service that a consumer requests or authorizes.

11 NYCRR 420.13

11 NYCRR 420.13 provides an exception to opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. The opt-out requirements in sections 420.7 and 420.10 of this Part do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with section 420.4 of this Part and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in section 420.14 or 420.15 of this Part in the ordinary course of business to carry out those purposes.

Conclusion

Based on the available information, it is clear that if you are using third-party marketing automation tools that collect personal information in New York, you must comply with the relevant laws and regulations. You must comply with NYCL GBS § 640, which prohibits manufacturers or distributors of home-use medical diagnostic devices from disclosing personal identifiable information of a user for target marketing purposes without first affording the user the right to prohibit such disclosure. Additionally, you must comply with 11 NYCRR 420.14, which provides exceptions to notice and opt-out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions, and 11 NYCRR 420.13, which provides an exception to opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. It is recommended that you consult with a legal professional to ensure compliance with all applicable laws and regulations.

Jurisdiction

New York

• Privacy