Makes insurance decisions, in New York

N.Y. Gen. Bus. Law section 899-bb (Article 39-F, added by L. 2019, ch. 117 (S5575-B/A5635-B), section 4) · Read the law's page

• This binds any person or business that owns, licenses, or maintains computerized data including the private information of a New York resident; a business already a compliant regulated entity under Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or 23 NYCRR Part 500 (the New York Department of Financial Services cybersecurity regulation for a financial-services licensee) is deemed to comply.
• Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).
• A small business, fewer than 50 employees, under $3,000,000 in gross annual revenue in each of the last three fiscal years, or under $5,000,000 in year-end total assets, may scale its program's administrative, technical, and physical safeguards to its own size, complexity, and the sensitivity of the personal information it collects.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of General Business Law 349, seeking injunctive relief and a civil penalty of up to $5,000 per violation under General Business Law 350-d.

N.Y. Gen. Bus. Law § 349-a (ch. 58 of 2025, Part X) · Read the law's page

• This duty binds the entity that sets the price and communicates it to the consumer; the section assigns no separate duty to a provider of pricing software.
• If you are a natural person, firm, organization or other entity domiciled or doing business in New York and you set the price of a specific good or service using an algorithm that uses personal data, and you advertise, promote, label or publish that price to a consumer in New York using personal data specific to that consumer, include with it a clear and conspicuous disclosure.
• State in the disclosure, in the same medium as and contemporaneous with the advertisement, display, image, offer or announcement of the price: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA".
• This disclosure duty does not apply to a person subject to the insurance law, to a financial institution or affiliate subject to Title V of the Gramm Leach Bliley Act, to a financial institution as defined in the financial services law, or to a price offered under an existing subscription-based agreement that is less than the price set in that agreement.

N.Y. Civ. Rights Law art. 10-A (proposed §§ 105-115); amd. Exec. Law § 296, S1169-B, pending in the Assembly · Read the law's page

• Inform the affected individual, at the immediate onset of the engagement, that a high-risk AI system will be used to make or assist in making a consequential decision (Section 108(1)).
• Inform the affected individual and any covered agent within 10 days that a high-risk AI system has been used to make a consequential decision, and provide and explain a process to appeal it (Section 108(2)(a)).
• If you are a covered developer, file a report with the Department of Financial Services within 6 months after you complete development of the high-risk AI system and first offer it to a deployer (or, if you are the first deployer, after initial deployment), and another within 6 months of any substantial change to the system (Section 111(3)).
• If you are a covered deployer, file a report with the Department of Financial Services within 6 months after initial deployment of the high-risk AI system, and another within 6 months of any substantial change to the system (Section 111(4)).
• Conduct regular impact assessments of the high-risk AI system for algorithmic discrimination.
• Preserve the individual's option to request human review of the decision.