Section 640. Target marketing; prohibitions

1. Definitions. For purposes of
  this article, the following terms shall have the following meanings:
    (a)  "Personal  identifiable  information"  shall mean any information
  obtained  by  a  manufacturer  or  distributor  of  a  home-use  medical
  diagnostic  device  by  means of its warranty registration card, owner's
  registration card, or otherwise which information was furnished to it by
  or on behalf of a user of such device. Such  information  shall  include
  but  not  be  limited  to  the user's name, address, telephone number or
  personal medical information. Such term shall  not  include  data  which
  does not identify a user.
    (b)  "Target  marketing" shall mean the compilation of a list of users
  by a manufacturer  or  distributor  of  a  home-use  medical  diagnostic
  device,  for  purposes  of direct marketing transactions or solicitation
  which is based on users' personal identifiable information.
    (c) "User" shall mean any natural person who uses a  home-use  medical
  diagnostic device.
    (d)  "Home-use  medical  diagnostic device" shall have such meaning as
  prescribed  by  the  Federal  Food,  Drug  and  Cosmetic  Act  and   the
  regulations  thereunder,  as  such  act and regulations may from time to
  time be amended.
    (e) "Person" shall mean any individual, partnership, association, firm
  or corporation.
    2. Restrictions on disclosure. (a) A manufacturer or distributor of  a
  home-use  medical  diagnostic device shall not disclose to a marketer of
  goods or services or to a third party  acting  on  behalf  of  any  such
  marketer  any  personal  identifiable  information  of a user for target
  marketing purposes without having first afforded such user the right  to
  prohibit  such  disclosure  as  set  forth  in  paragraph  (b)  of  this
  subdivision.
    (b) The warranty registration card, owner's registration card or other
  similar form shall conspicuously disclose, if applicable, that a  user's
  personal  identifiable  information  may  be  used  for target marketing
  purposes and shall provide such user the opportunity to be excluded from
  any such target marketing list by means of a check-off box contained  on
  the   card   or   other  similar  form.  Such  notice  shall  include  a
  pre-addressed postage paid form by which a user can exercise  the  right
  to prohibit disclosure.
    3.  Private  remedy.  Any person who has been injured by reason of any
  violation of this article may bring an action  for  recovery  of  actual
  damages  or  two  hundred fifty dollars, whichever is greater. The court
  may, in its discretion, increase the award of damages to an  amount  not
  to  exceed three times the actual damages up to one thousand dollars, if
  the court finds that the defendant willfully or knowingly  violated  the
  provision  of  this  section.  The court may award reasonable attorney's
  fees to a prevailing plaintiff.
    4. Additional remedies of users. Nothing in this article shall in  any
  way  contravene  or  limit  the rights, remedies or privileges which are
  otherwise available to a user under any other law.
    5. Enforcement. In addition to the other remedies  provided,  whenever
  there  shall  be a violation of this article, application may be made by
  the attorney general in the name of the people of the state of New  York
  to a court or justice having jurisdiction by special proceeding to issue
  an  injunction,  and  upon notice to the defendant of not less than five
  days, to enjoin and restrain the continuance of such violation;  and  if
  it  shall  appear  to  the satisfaction of the court or justice that the
  defendant has, in fact, violated this  article,  an  injunction  may  be
  issued  by  such court or justice, enjoining and restraining any further
  violation, without requiring proof that any person has,  in  fact,  been

  injured  or  damaged thereby. In any such proceeding, the court may make
  allowances to the attorney general  as  provided  in  paragraph  six  of
  subdivision  (a)  of  section  eighty-three  hundred  three of the civil
  practice law and rules, and direct restitution. Whenever the court shall
  determine  that  a violation of this article has occurred, the court may
  impose a civil penalty of not more than five hundred  dollars  for  each
  violation.  In  connection  with  any  such  proposed  application,  the
  attorney general is authorized to take proof and make a determination of
  the relevant facts and to issue subpoenas in accordance with  the  civil
  practice law and rules.