N.Y. State Technology Law 203 – Model internet privacy policy
§ 203. Model internet privacy policy. 1. The office shall adopt rules and regulations in conformity with the provisions of this article, and specify a model internet privacy policy for state agencies that maintain state agency websites. Such model privacy policy shall include, but not be limited to, the following elements:
Terms Used In N.Y. State Technology Law 203
- Collect: shall mean to store information, including via cookie technology, for purposes of retrieval at a later time to initiate communication with or make determinations about the person who is the subject of such information. See N.Y. State Technology Law 202
- Internet: shall mean a system of linked computer networks, international in scope, that facilitate data transmission and exchange. See N.Y. State Technology Law 202
- Office: shall mean the state office of information technology services. See N.Y. State Technology Law 202
- Personal information: shall mean any information concerning a natural person which, because of name, number, symbol, mark or other identifier, can be used to identify that natural person. See N.Y. State Technology Law 202
- State agency website: shall mean an internet website operated by or for a state agency. See N.Y. State Technology Law 202
- User: shall mean any natural person who uses the internet to access a state agency website. See N.Y. State Technology Law 202
(a) a statement of any information, including personal information, the state agency website will collect with respect to the user and the use of the information;
(b) the circumstances under which information, including personal information, collected may be disclosed;
(c) whether any information collected will be retained by the state agency, and, if so, the period of time that such information will be retained;
(d) the procedures by which a user may gain access to the collected information pertaining to that user;
(e) the means by which information is collected and whether such collection occurs actively or passively;
(f) whether the collection of information is voluntary or required, and the consequences, if any, of a refusal to provide the required information; and
(g) the steps being taken by the state agency to protect the confidentiality and integrity of the information.
2. Each state agency that maintains a state agency website shall adopt an internet privacy policy which shall, at a minimum, include the information required by the model internet privacy policy. Each state agency shall post its internet privacy policy on its website. Such posting shall include a conspicuous and direct link to such privacy policy.
3. The model internet privacy policy specified by the office shall also be made available at no charge to other public and private entities.