What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

The Agriculture Improvement Act of 2018 formally removed low-THC hemp, used to extract CBD, from the schedule 1 category. 21 U.S.C § 802(16)(b).

Hemp is defined at the Federal level as “the plant Cannabis sativa L. and any part of that plant, including the seeds thereof and all derivatives, extracts, cannabinoids, isomers, acids, salts, and salts of isomers, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.” 7. U.S.C § 1639(o). New York State also defines hemp in this manner. NY Agri & Mkts L § 505(1).

Under New York law, “in cooperation with the commission of health and the commission of criminal justice services, the commissioner shall develop regulations….for… the disposition of industrial hemp after it has been grown or cultivated and studied.” NY Agri & Mkts L § 508(b). In December 2018, the New York State Department of Agriculture and Markets provided guidelines for the sale and distribution of CBD products. The guidance states that one cannot sell any item for human consumption that has CBD as an ingredient unless the item is produced as a dietary-supplement and is properly labeled and packaged for sale pursuant to FDA regulations for dietary supplements. Further one cannot sell a CBD product for use in any vaping or inhalation system. The guidelines allow for the cultivation of hemp and extraction of its CBD-rich extracts completely legal assuming it is grown under the regulation guidelines of the Department of Agriculture and individual U.S. states, such as New York. New York has not passed any legislation forbidding the use of CBD oil in products such as cosmetics.

See www.agriculture.nv.gov/PI/Hemp FAQ CBD Processor and Hemp Research Pilot Program.pdf.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

New York has not passed any legislation in response to GDPR, however, several bills were proposed over the past years that address consumer data protections.

The Proposed Right to Know Act of 2019 (Senate Bill S224, Assembly Bill A3739), proposes an amendment to New York’s General Business Law Art. 39-F to add §899- b99. Various versions of this bill were proposed in the New York Legislature since 2013. It is currently referred out to the Senate’s Consumer Protection Committee. This proposed bill directs businesses that retain “a customer’s personal information shall make available to the customer free of charge access to, or copies of, all of the customer’s personal information retained by the business.” The proposed bill also directs companies to provide individuals with “the names and contact information of all third parties that received the customer’s personal information from the business, including the third party’s designated request address or addresses if available.”

Currently in New York, data breach cases are litigated by the State Attorney General as individuals do not have a private right of action. A proposed bill, Senate Bill SI 749, proposes to create a private right of action for individuals whose data is accessed as the result of a data breach. This proposal seeks to add §380-mm to New York’s General Business Law. As of June of 2019, the Consumer Protection Committee is considering the bill.

Should a company fail to disclose a data breach, the Attorney General can bring suit pursuant to General Business Law § 899-aa, which requires companies that experience a breach involving certain personal information, including driver’s license numbers, to provide notice “in the most expedient time possible and without unreasonable delay.”