N.Y. General Business Law § 907: Data privacy protections

§ 907. Data privacy protections. Notwithstanding any other provision

of the law to the contrary, all trip data, personal information, images,

videos, and other recorded images collected by any peer-to-peer car

sharing program administrator that is authorized to operate pursuant to

this article shall be for the exclusive use of such peer-to-peer car

sharing program and shall not be sold, distributed, or otherwise made

accessible except:

1. to the person who is the subject of such data information or

record, or to enable or facilitate such person's use of the car sharing

program in accordance with the peer-to-peer car sharing agreement;

2. to respond to, process, facilitate, adjust, or defend an insurance

claim; or

3. if necessary to comply with a lawful court order, judicial warrant

signed by a judge appointed pursuant to article three of the United

States Constitution, or subpoena for individual data, information or

records properly issued pursuant to the criminal procedure law or the

civil practice law and rules.

Provided, however, that nothing contained in this paragraph shall be

deemed to preclude the exchange of anonymized trip data, information, or

recorded images solely for the purpose of administering such authorized

car sharing program, and provided further that aggregated anonymized

trip data may be shared with this state or any of its political

subdivisions for non-commercial transportation research or traffic

management purposes. Any such exchanges or sharing shall exclude

personal information, images, videos, and other recorded images

collected by any peer-to-peer car sharing program administrator. For the

purposes of this section, "personal information" shall mean information

that identifies an individual, including but not limited to name,

address, telephone number, and the type and form of payment including

credit card number, debit card number, or other payment method.