New York Consolidated Laws, Vehicle and Traffic Law - VAT § 1243. Shared bicycle and shared bicycle with electric assist systems;  data protection

1. The governing body of any city, town or village may, by local law, ordinance, order, rule or regulation, authorize and regulate shared bicycle systems or shared bicycle with electric assist systems within such city, town or village.  No such shared systems shall operate within a city, town or village except as authorized by such local law, ordinance, order, rule or regulation.  For the purposes of this subdivision, the term shared bicycle system or shared bicycle with electric assist system shall mean a network of self-service and publicly available bicycles or bicycles with electric assist in which a bicycle or bicycle with electric assist trip begins and/or ends on any public highway.

2. Notwithstanding any other provision of law to the contrary, all trip data, personal information, images, videos, and other recorded images collected by any shared bicycle system or shared bicycle with electric assist system which is authorized to operate within a city, town or village pursuant to this section:  (a) shall be for the exclusive use of such shared bicycle or shared bicycle with electric assist system and shall not be sold, distributed, or otherwise made available for any commercial purpose and (b) shall not be disclosed or otherwise made accessible except (i) to the person who is the subject of such data, information or record;  or (ii) if necessary to comply with a lawful court order, judicial warrant signed by a judge appointed pursuant to article III of the United States constitution, or subpoena for individual data, information or records properly issued pursuant to the criminal procedure law or the civil practice law and rules.  Provided, however, that nothing contained in this paragraph shall be deemed to preclude the exchange of such data, information or recorded images solely for the purpose of administering such authorized shared system.  For the purposes of this subdivision, “personal information” shall mean information that identifies an individual, including but not limited to name, address, telephone number, and the type and form of payment including credit card number, debit card number, or other payment method.