NY A03158

Creates the "Electronic Fund Transfer Privacy Act" as Article 24-D of General Business Law to protect privacy of consumers engaged in electronic fund transfers.

Prohibits financial institutions from disclosing existence, location, date, time, contents, or meaning of electronic fund transfers except to the consumer, parties necessary to effectuate the transfer, account servicers, authorized legal persons, regulatory agencies, government authorities with court orders, or consumers with written authorization valid for up to 45 days.

Prohibits financial institutions from selling or disclosing lists containing personally identifiable information about consumers using electronic fund transfer systems and requires reasonable procedures to prevent unauthorized disclosures, with notification to consumers within three days of discovering unauthorized disclosure.

Requires search warrants to particularly describe information and mandates immediate written notice to affected individuals unless warrant provides otherwise; requires seven-day notice period before complying with subpoenas unless subpoena is from judgment creditor or court orders otherwise.

Establishes civil remedies allowing consumers to sue for damages of at least $100 or actual damages (whichever is greater), reasonable attorney's fees, and potential punitive damages, with a two-year discovery period or seven-year absolute deadline for filing suit.