Senate Bill S9483

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   9483
 
                             I N  S E N A T E
 
                              March 17, 2026
                                ___________
 
 Introduced  by  Sen.  MAY  --  read  twice and ordered printed, and when
   printed to be committed to the Committee on Banks
 
 AN ACT to amend the banking law, in relation  to  the  accessibility  of
   consumer  financial  data and the prohibition of fees for the transfer
   of such data to authorized parties
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Short  title. This act shall be known and may be cited as
 the "New York financial data rights act".
   § 2. The banking law is amended by adding a new article 14-C  to  read
 as follows:
                               ARTICLE 14-C
             CONSUMER AND SMALL BUSINESS FINANCIAL DATA RIGHTS
 SECTION 800. DEFINITIONS.
         801. CONSUMER AND SMALL BUSINESS RIGHT TO DATA PORTABILITY.
         802. PROHIBITION OF FEES FOR DATA ACCESS.
         803. AUTHORIZED REPRESENTATIVE OBLIGATIONS.
         804. SECURITY STANDARDS.
         805. ENFORCEMENT AND PENALTIES.
   § 800. DEFINITIONS. AS USED IN THIS ARTICLE, THE FOLLOWING TERMS SHALL
 HAVE THE FOLLOWING MEANINGS:
   1."AUTHORIZED  REPRESENTATIVE"  MEANS ANY PERSON OR ENTITY, OTHER THAN
 THE FINANCIAL INSTITUTION HOLDING THE DATA, THAT SEEKS TO ACCESS COVERED
 DATA WITH THE CONSUMER'S OR SMALL BUSINESS'S CONSENT PURSUANT TO SECTION
 EIGHT HUNDRED THREE OF THIS ARTICLE.
   2. "CONSUMER" MEANS AN INDIVIDUAL WHO RESIDES  IN  THE  STATE  OF  NEW
 YORK.
   3. "FINANCIAL INSTITUTION" MEANS:
   (A) A BANKING ORGANIZATION AS DEFINED IN SUBDIVISION ELEVEN OF SECTION
 TWO OF THIS CHAPTER;
   (B)  ANY  OUT-OF-STATE  STATE  BANK  AS  DEFINED IN SUBDIVISION TWO OF
 SECTION TWO HUNDRED TWENTY-TWO OF THIS CHAPTER THAT MAINTAINS  A  FINAN-
 CIAL PRODUCT OR SERVICE FOR A RESIDENT IN THIS STATE;
   (C) ANY PERSON OR ENTITY ACTING AS A CUSTODIAN FOR FINANCIAL ASSETS AS
 DESCRIBED IN SECTION 11-1.9 OF THE ESTATES, POWERS AND TRUSTS LAW; AND
   (D) ANY OTHER DATA PROVIDER REGULATED BY THE DEPARTMENT THAT MAINTAINS
 A FINANCIAL PRODUCT OR SERVICE FOR A RESIDENT OF THIS STATE.
              

 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD15201-02-6
 S. 9483                             2
 
   4."COVERED DATA" MEANS THE FOLLOWING INFORMATION RELATING TO A CONSUM-
 ER  OR SMALL BUSINESS IN THE CONTROL OR POSSESSION OF A FINANCIAL INSTI-
 TUTION:
   (A)  TRANSACTION INFORMATION, INCLUDING AMOUNTS, DATES, PAYMENT TYPES,
 PENDING OR AUTHORIZED STATUS, AND PAYEE OR MERCHANT NAMES, FOR AT  LEAST
 TWENTY-FOUR MONTHS PRECEDING THE REQUEST;
   (B) ACCOUNT BALANCE INFORMATION;
   (C)  INFORMATION  TO  INITIATE  PAYMENT  TO OR FROM A COVERED ACCOUNT,
 INCLUDING ACCOUNT NUMBERS;
   (D) TERMS AND CONDITIONS OF THE CONSUMER OR SMALL BUSINESS,  FINANCIAL
 PRODUCT  OR  SERVICE, INCLUDING INTEREST RATES, CREDIT LIMITS, OVERDRAFT
 COVERAGE, REWARDS, AND FEE SCHEDULES;
   (E) UPCOMING BILL INFORMATION, INCLUDING AMOUNTS AND DUE DATES; AND
   (F) ACCOUNT AND IDENTITY  VERIFICATION  INFORMATION,  INCLUDING  NAME,
 ADDRESS, AND CONTACT INFORMATION.
   5. "EXEMPT DATA" MEANS INFORMATION THAT A FINANCIAL INSTITUTION IS NOT
 REQUIRED  TO  MAKE AVAILABLE, SUBJECT TO THE REQUIREMENTS IN SUBDIVISION
 TWO OF SECTION EIGHT HUNDRED ONE OF THIS ARTICLE, CONSISTING OF:
   (A) ANY CONFIDENTIAL  COMMERCIAL  INFORMATION,  INCLUDING  PROPRIETARY
 ALGORITHMS USED TO DERIVE CREDIT OR RISK SCORES;
   (B)  INFORMATION  COLLECTED SOLELY FOR THE PURPOSE OF PREVENTING FRAUD
 OR MONEY LAUNDERING;
   (C)  INFORMATION  REQUIRED  TO  BE  KEPT  CONFIDENTIAL  BY  ANY  OTHER
 PROVISION OF LAW; AND
   (D)  ANY  INFORMATION THE FINANCIAL INSTITUTION CANNOT RETRIEVE IN THE
 ORDINARY COURSE OF BUSINESS.
   § 801. CONSUMER AND SMALL BUSINESS RIGHT TO DATA PORTABILITY. 1.  UPON
 THE REQUEST OF A CONSUMER, SMALL BUSINESS, OR THEIR AUTHORIZED REPRESEN-
 TATIVE,  A  FINANCIAL  INSTITUTION SHALL MAKE AVAILABLE ALL COVERED DATA
 THEY HAVE REQUESTED IN A SECURE, ELECTRONIC, AND MACHINE-READABLE FORMAT
 BY WHICH THE CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE  CAN
 RETRIEVE,  RETAIN, AND TRANSFER SUCH DATA FOR PROCESSING INTO A SEPARATE
 INFORMATION SYSTEM.
   2. FINANCIAL INSTITUTIONS SHALL MAINTAIN A DEVELOPER  INTERFACE,  SUCH
 AS  A  STANDARDIZED  APPLICATION  PROGRAMMING  INTERFACE, TO RECEIVE AND
 RESPOND TO REQUESTS FOR ACCESS TO COVERED DATA AS SET FORTH IN  SUBDIVI-
 SION ONE OF THIS SECTION.
   3.(A) A FINANCIAL INSTITUTION SHALL NOT ENGAGE IN OR BE A PARTY TO ANY
 UNREASONABLE DENIAL OR IMPAIRMENT OF ACCESS BY A CONSUMER, A SMALL BUSI-
 NESS,  OR  AUTHORIZED  REPRESENTATIVE,  INCLUDING WITHOUT LIMITATION ANY
 DENIAL OR IMPAIRMENT RELATED TO RISK OR SECURITY STANDARDS.
   (B) UNREASONABLE DENIAL OR IMPAIRMENT  UNDER  PARAGRAPH  (A)  OF  THIS
 SUBDIVISION INCLUDES CONDUCT THAT:
   (I)  IS  LIKELY  TO  EVADE  OR  UNREASONABLY DELAY COMPLIANCE WITH, OR
 INTERFERE WITH, PREVENT, OR MATERIALLY DISCOURAGE ACCESS OF COVERED DATA
 BY A CONSUMER, A SMALL BUSINESS, OR AN AUTHORIZED REPRESENTATIVE;
   (II) DEGRADES, IMPAIRS, OR CREATES BARRIERS  THAT  WOULD  RESTRICT  OR
 SYSTEMATICALLY  IMPEDE  ACCESS  TO  COVERED  DATA BY A CONSUMER, A SMALL
 BUSINESS OR AUTHORIZED REPRESENTATIVE; OR
   (III) IS APPLIED TO A CONSUMER, A SMALL BUSINESS, OR AUTHORIZED REPRE-
 SENTATIVE IN A DISCRIMINATORY MANNER.
   (C) A FINANCIAL INSTITUTION IS NOT ENGAGED IN OR A PARTY TO AN  UNREA-
 SONABLE  DENIAL  OF  ACCESS  BY  AN AUTHORIZED REPRESENTATIVE BY DENYING
 ACCESS IF THE DENIAL:
   (I) IS NECESSARY TO ENSURE COMPLIANCE WITH SPECIFIC SAFETY AND  SOUND-
 NESS  OBLIGATIONS  OF  THE FINANCIAL INSTITUTION'S PRUDENTIAL REGULATOR,
 S. 9483                             3
 
 AND IS BASED ON STANDARDIZED SAFETY AND SOUNDNESS CRITERIA AVAILABLE  TO
 AUTHORIZED REPRESENTATIVES UPON REQUEST; OR
   (II) TO COMPLY WITH APPLICABLE LAW.
   (D)  A  FINANCIAL  INSTITUTION  SHALL BEAR THE BURDEN OF DEMONSTRATING
 THAT A DENIAL OF ACCESS UNDER  PARAGRAPH  (C)  OF  THIS  SUBDIVISION  IS
 REASONABLE  BASED  ON A SPECIFIC, KNOWN RISK LIKELY TO CAUSE SUBSTANTIAL
 INJURY TO CONSUMERS OR SMALL BUSINESSES, AND THAT SUCH DENIAL IS APPLIED
 CONSISTENTLY TO AUTHORIZED REPRESENTATIVES FACING THE SAME OR MATERIALLY
 SIMILAR RISK.
   (E) A FINANCIAL INSTITUTION SHALL PROVIDE PROMPT NOTICE OF ANY  DENIAL
 OF ACCESS TO A CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE.
   § 802. PROHIBITION  OF  FEES FOR DATA ACCESS. NO FINANCIAL INSTITUTION
 SHALL DIRECTLY OR INDIRECTLY IMPOSE A  FEE,  ASSESSMENT,  OR  ANY  OTHER
 CHARGE  TO  A  CONSUMER, SMALL BUSINESS, OR AUTHORIZED REPRESENTATIVE IN
 CONNECTION WITH RECEIVING REQUESTS FOR OR MAKING AVAILABLE COVERED  DATA
 AS  REQUIRED BY SECTION EIGHT HUNDRED ONE OF THIS ARTICLE. THIS PROHIBI-
 TION APPLIES TO THE ESTABLISHMENT, MAINTENANCE, AND USAGE OF THE  DEVEL-
 OPER INTERFACE.
   § 803. AUTHORIZED  REPRESENTATIVE OBLIGATIONS. 1. AN AUTHORIZED REPRE-
 SENTATIVE MUST OBTAIN EXPRESS, INFORMED CONSENT FROM A CONSUMER OR SMALL
 BUSINESS IN ORDER TO REQUEST ACCESS TO COVERED DATA ON THE CONSUMER'S OR
 SMALL BUSINESS'S BEHALF.
   2. AUTHORIZED REPRESENTATIVES SHALL PROVIDE A SIMPLE  AND  TRANSPARENT
 MECHANISM  FOR  A  CONSUMER  OR  SMALL  BUSINESS  TO VIEW AND REVOKE ANY
 AUTHORIZATIONS FOR DATA SHARING AT ANY TIME.
   3. AN AUTHORIZED REPRESENTATIVE MUST LIMIT ITS  COLLECTION,  USE,  AND
 RETENTION OF COVERED DATA TO WHAT IS REASONABLY NECESSARY TO PROVIDE THE
 CONSUMER'S OR SMALL BUSINESS'S REQUESTED PRODUCT OR SERVICE.
   4.  AN  AUTHORIZED  REPRESENTATIVE  MUST  APPLY TO ITS SYSTEMS FOR THE
 COLLECTION, USE, AND RETENTION OF COVERED DATA AN  INFORMATION  SECURITY
 PROGRAM  THAT  SATISFIES THE APPLICABLE RULES ISSUED PURSUANT TO SECTION
 FIVE HUNDRED ONE OF THE GRAMM-LEACH-BLILEY ACT (15 U.S.C. 6801)  OR,  IF
 THE AUTHORIZED REPRESENTATIVE IS NOT SUBJECT TO SECTION FIVE HUNDRED ONE
 OF  THE  GRAMM-LEACH-BLILEY  ACT,  THE  THIRD  PARTY  SHALL APPLY TO ITS
 SYSTEMS FOR THE COLLECTION, USE,  AND  RETENTION  OF  COVERED  DATA  THE
 INFORMATION  SECURITY PROGRAM REQUIRED BY THE FEDERAL TRADE COMMISSION'S
 STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION, 16 CFR PART 314.
   § 804. SECURITY STANDARDS. FOR THE PURPOSE OF AUTHENTICATING A CONSUM-
 ER'S OR SMALL BUSINESS'S REQUEST PURSUANT TO SUBDIVISION ONE OF  SECTION
 EIGHT  HUNDRED ONE OF THIS ARTICLE, FINANCIAL INSTITUTIONS SHALL USE, AT
 A MINIMUM, THE SAME PROCESSES AND INFORMATION THAT  THEY  RELY  UPON  TO
 AUTHENTICATE  A  CONSUMER  OR  SMALL  BUSINESS  FOR THEIR ONLINE BANKING
 PORTALS.
   § 805. ENFORCEMENT AND PENALTIES. 1. THE SUPERINTENDENT  OF  FINANCIAL
 SERVICES SHALL HAVE THE POWER TO ENFORCE THE PROVISIONS OF THIS ARTICLE.
   2. ANY FINANCIAL INSTITUTION FOUND TO BE IN VIOLATION OF THIS ARTICLE,
 INCLUDING THE IMPROPER CHARGING OF FEES OR THE RESTRICTIONS SET FORTH IN
 SUBDIVISION THREE OF SECTION EIGHT HUNDRED ONE OF THIS ARTICLE, SHALL BE
 SUBJECT  TO  A  CIVIL  PENALTY OF NOT MORE THAN TEN THOUSAND DOLLARS PER
 VIOLATION.
   § 3. This act shall take effect on the sixtieth  day  after  it  shall
 have become a law.