a. A food service establishment may request customer data from a third-party food delivery service. Upon such a request, a third-party food delivery service shall provide to the food service establishment all applicable customer data, until such food service establishment requests to cease receiving such customer data.
b. Notwithstanding the requirements of subdivision a of this section, a third-party food delivery service shall not share customer data applicable to an online order pursuant to subdivision a of this section if such customer requests that such data not be shared in relation to such online order. The customer shall be presumed to have consented to the sharing of such customer data applicable to all online orders unless such customer has made such a request in relation to a specific online order. The third-party food delivery service shall provide in a conspicuous manner on its website, in a style and form required by the commissioner, a means for a customer to make such request. To assist its customers with deciding whether their data should be shared, a third-party food delivery service shall clearly and conspicuously disclose to the customer the customer data that may be shared with the food service establishment and shall identify the food service establishment fulfilling such customer's online order as a recipient of such data.
c. Third-party food delivery services that share customer data pursuant to this section shall provide such data in a machine-readable format, disaggregated by customer, on an at least monthly basis. Third-party food delivery services shall not limit the ability of food service establishments to download and retain such data, nor limit their use of such data for marketing or other purposes outside of the third-party food delivery service website, mobile application or other internet service.
d. Food service establishments that receive customer data pursuant to this section shall not sell, rent, or disclose such customer data to any other party in exchange for financial benefit, except with the express consent of the customer from whom the customer data was collected; shall enable a customer to withdraw their consent to use of their data by the food service establishment; and shall delete any such customer data upon request by a customer.
e. Nothing in this section shall prevent a third-party food delivery service or a food service establishment from complying with any other law or rule.
(L.L. 2021/100, 9/26/2021, eff. 1/24/2022)