NY A10640

Establishes the "New York Financial Data Rights Act" requiring financial institutions to provide consumers and small businesses access to their financial data in secure, electronic, machine-readable formats upon request

Prohibits financial institutions from charging any fees to consumers, small businesses, or authorized representatives for accessing or transferring covered data

Covered data includes transaction history for at least 24 months, account balances, payment initiation information, account terms and conditions, upcoming bill information, and identity verification details

Requires financial institutions to maintain a developer interface (such as an API) to process data access requests and prohibits unreasonable denial or impairment of data access

Authorized representatives must obtain express consent, provide mechanisms for consumers to revoke data sharing, limit data collection to what is necessary, and comply with federal information security standards (Gramm-Leach-Bliley Act or FTC safeguarding standards)

Violations are subject to civil penalties of up to $10,000 per violation, enforced by the Superintendent of Financial Services