1. The office shall adopt rules and regulations in conformity with the provisions of this article, and specify a model internet privacy policy for state agencies that maintain state agency websites. Such model privacy policy shall include, but not be limited to, the following elements: (a) a statement of any information, including personal information, the state agency website will collect with respect to the user and the use of the information; (b) the circumstances under which information, including personal information, collected may be disclosed; (c) whether any information collected will be retained by the state agency, and, if so, the period of time that such information will be retained; (d) the procedures by which a user may gain access to the collected information pertaining to that user; (e) the means by which information is collected and whether such collection occurs actively or passively; (f) whether the collection of information is voluntary or required, and the consequences, if any, of a refusal to provide the required information; and (g) the steps being taken by the state agency to protect the confidentiality and integrity of oluntary or required, and the consequences, if any, of a refusal to provide the required information; and (g) the steps being taken by the state agency to protect the confidentiality and integrity of the information. 2. Each state agency that maintains a state agency website shall adopt an internet privacy policy which shall, at a minimum, include the information required by the model internet privacy policy. Each state agency shall post its internet privacy policy on its website. Such posting shall include a conspicuous and direct link to such privacy policy. 3. The model internet privacy policy specified by the office shall also be made available at no charge to other public and private entities.
New York Legal Code