R2v3 Certified Facilities in New York

The New York State Electronic Equipment Recycling and Reuse Act was signed 28 May 2010 and is codified at ECL Article 27, Title 26, §§ 27-2601 to 27-2621, with regulations at 6 NYCRR Subpart 368-3.

Sources: ECL Article 27, Title 26

The ban hit businesses three years before households

ECL § 27-2611(2) provides that beginning January first, two thousand twelve, no person except for an individual or household shall place or dispose of any electronic waste in any solid waste management facility. Businesses were bound from 1 January 2012; households from 1 January 2015; manufacturers, retailers and facilities from 1 April 2011.

And NYSDEC's own public page does not say so. Its consumer page states that as of January 1, 2015, consumers could no longer dispose of certain types of electronic equipment in landfills — and on the same page defines a consumer as any individual, business, corporation, limited partnership, not-for-profit corporation and so on. A business reading that page is told it is a consumer and given the 2015 date. The year 2012 does not appear on the page at all. The statute controls: businesses have been banned since 2012.

Sources: ECL § 27-2611 · NYSDEC, recycling consumer electronic waste

But it does not reach most enterprise IT

ECL § 27-2601(5) defines covered electronic equipment as a computer; computer peripheral; small electronic equipment; small-scale server; cathode ray tube; or television — and expressly excludes a server other than a small-scale server, a stand-alone storage product intended for use in industrial, research and development or commercial settings, and equipment that is functionally or physically part of a larger piece of equipment intended for use in an industrial, research and development or commercial setting. Two narrower exclusions do the same work: § 27-2601(2) writes server out of the definition of computer, and § 27-2601(3) writes out any document scanner or printer which weighs one hundred pounds or more.

Rack servers and SAN or NAS arrays fall outside § 27-2611 entirely. A data centre refresh in New York does not run through the e-waste Act at all — it runs through 6 NYCRR Parts 370 to 374 and 376, and the C7 scrap-metal exemption.

Sources: ECL § 27-2601

One further carve-out is easy to over-read. ECL § 27-2601(6) provides that for purposes of section 27-2611 of this title, electronic waste does not include the case, shell, or other enclosure of covered electronic equipment from which incorporated assemblies, sub-assemblies, components, materials, wiring, circuitry and commodities have been removed. It sits in the definition of electronic waste rather than of covered electronic equipment, and it is scoped to the disposal ban alone — so a stripped enclosure escapes § 27-2611, not the hazardous waste rules.

NYSDEC reads the same boundary the other way on the hazardous waste side: an all-plastic case that was separated from a computer monitor could no longer qualify for the scrap metal exemption, and CRT glass, once the scrap metal pieces have been separated from the glass may be regulated as hazardous waste. Stripping a unit can move material out of one regime and into a stricter one.

Sources: ECL § 27-2601 · NYSDEC, guidance for collectors, dismantlers and recyclers

What you actually have to keep

Title 26 imposes no registration or reporting duty on a business disposing of its own equipment; those sit on manufacturers, retailers and registered facilities. The record-keeping duty comes from the hazardous waste side instead. NYSDEC's general rule is that a generator claiming an exemption or exclusion must notify DEC Central Office in writing before using it. Used electronics are one of only four things carved out of that duty — alongside precious metals, used lead acid batteries and dental amalgam — where the claim rests on 6 NYCRR 371.1(g)(1)(iii)(b) or 371.1(e)(1)(xxi).

The carve-out removes the filing, not the record. NYSDEC states that generators still need to keep the information required in these notifications in their records on-site, keep them up-to-date and provide them to DEC inspectors upon request, even where no C7 need be submitted. In practice: complete the generic C7 form citing the exemption and retain it on site. NYSDEC states no retention period.

Sources: NYSDEC, hazardous waste notification forms

One line on that page is worth carrying verbatim, because it sets the ceiling on what the exemption buys you: an item which qualifies as hazardous scrap metal is still a hazardous waste. It is merely exempted from regulation.

Sources: NYSDEC, guidance for collectors, dismantlers and recyclers

Penalties under the e-waste Act are trivial, and are not the exposure

ECL § 71-2729(1)(a) caps a consumer violation of § 27-2611 at $100. Subdivision 1(b) sets $250 for any person, except a consumer, manufacturer, or an owner or operator of a collection site, consolidation facility or recycling facility. Since ECL § 27-2601(4) makes a person who owns or uses covered electronic equipment a consumer — expressly including a business, corporation, limited partnership and not-for-profit — a business disposing of its own equipment sits in the $100 tier. The $250 tier reaches those who dispose without owning or using: haulers, transporters, liquidators, a landlord clearing a tenant's equipment.

So the e-waste Act exposure is $100 a violation. That is not where the risk is. Where equipment is managed as hazardous waste and mishandled, ECL § 71-2705 applies instead: a first civil violation up to $65,000 plus up to $65,000 for each day it continues, rising to $125,000 and $125,000 per day on a second, with any permit or certificate liable to be revoked, suspended or a pending renewal denied.

Sources: ECL § 71-2729 · ECL § 27-2601 · ECL § 71-2705

Section 71-2705(2) adds a criminal tier. A person who violates the hazardous waste titles with any of the culpable mental states defined in section 15.05 of the penal law is guilty of a misdemeanour, punishable on a first conviction by a fine not to exceed $65,000 per day of violation or imprisonment for not more than one year, or both — and after a first conviction, up to $125,000 per day or not more than two years, or both.

Four orders of magnitude between the two regimes, turning on whether the material was handled as hazardous waste or under the exemption. Which is the practical argument for holding the C7 record.

Sources: ECL § 71-2705

On the data — New York has all three

Records disposal sits at GBL § 399-h(2), which bars any business from disposing of a record containing personal identifying information unless it shreds the record, destroys the information, modifies the record to make it unreadable, or takes actions consistent with commonly accepted industry practices that it reasonably believes will ensure that no unauthorized person will have access to the personal identifying information contained in the record. Section 399-h(3) authorises an Attorney General injunction and a civil penalty of not more than $5,000, counts acts arising out of the same incident or occurrence as a single violation, and provides an affirmative defence where the business shows it used due diligence.

That fourth option is the one people quote as a catch-all, and it is not one. The clause does not end at industry practices — it carries a reasonable-belief standard tied to a specific outcome, which is that no unauthorised person gets access.

Sources: GBL § 399-h

Two limits on § 399-h matter more than the duty itself. Under § 399-h(1)(a), dispose means to throw out or away or to get rid of and shall not include a sale of a record or the transfer of a record for value. And § 399-h(1)(d) defines personal identifying information narrowly — personal information combined with a social security number, driver's licence or non-driver ID number, or mother's maiden name, financial account, debit card, ATM, electronic serial or personal identification number. No health data. No biometrics. No email and password.

Sell the equipment rather than scrap it and § 399-h does not reach the transaction, because a transfer for value is not disposal. Which is the resale path most ITAD engagements take. The SHIELD Act is what covers it.

Sources: GBL § 399-h

And the SHIELD Act extends the standard into transit

The duty is at GBL § 899-bb(2)(a): any business that owns or licenses computerized data including private information of a New York resident shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data. Disposal is named in the substantive obligation, not left to be inferred from the safe harbour.

Sources: GBL § 899-bb, the SHIELD Act

The physical-safeguards safe harbour at GBL § 899-bb(2)(b)(ii)(C) then requires a business to assess risks of information storage and disposal, to protect against unauthorized access to or use of private information during or after the collection, transportation and destruction or disposal of the information, and to dispose of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.

Like Illinois, New York reaches the vendor in transit rather than only at the point of destruction. Non-compliance is deemed a GBL § 349 violation, enforceable by the Attorney General with civil penalties under GBL § 350-d of not more than $5,000 for each violation. Section 899-bb(2)(e) provides no private right of action.

Sources: GBL § 899-bb, the SHIELD Act · GBL § 350-d

Smaller organisations get a scaled standard rather than an exemption. GBL § 899-bb(1)(c) defines a small business as one with fewer than fifty employees, or less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets. Under § 899-bb(2)(c) such a business complies if its safeguards are appropriate for its size and complexity, the nature and scope of its activities, and the sensitivity of the personal information it collects.

Sources: GBL § 899-bb, the SHIELD Act

Breach notification

GBL § 899-aa(2) requires disclosure without unreasonable delay and within thirty days of discovery. A determination that an inadvertent authorised-person disclosure is not notifiable must be documented in writing and kept five years, and where more than 500 New York residents are affected that determination goes to the Attorney General within ten days. Penalties for a knowing or reckless violation are the greater of $5,000 or $20 per instance, capped at $250,000.

The penalty is not the whole of it. Section 899-aa(6)(a) lets the court award damages for actual costs or losses incurred by a person entitled to notice, including consequential financial losses, on top of the civil penalty.

Sources: GBL § 899-aa

The regulator notice has no threshold. GBL § 899-aa(8)(a) provides that in the event that any New York residents are to be notified, the business shall notify the state attorney general, the department of state, the division of state police, and — if it is a covered entity as defined in 23 NYCRR 500.1 — the department of financial services, giving the timing, content and distribution of the notices, the approximate number of affected persons, and a copy of the notice template. Above five thousand residents, § 899-aa(8)(b) adds the consumer reporting agencies.

One affected New York resident triggers notice to three state agencies. There is no small-breach floor, and no discretion in it.

Sources: GBL § 899-aa

On timing: GBL § 899-aa(6)(c) bars an action brought more than three years after the Attorney General became aware of the violation or the date of the § 899-aa(8)(a) notice, whichever is first — and in no event after six years from the date of discovery of the breach by the company, unless the company took steps to hide the breach.

Sources: GBL § 899-aa

And the pivot that catches people

Reuse status decides which regime applies. NYSDEC puts it plainly, though in guidance addressed to the vendor rather than to you: a notification is required of collectors, dismantlers and recyclers that receive used electronic equipment from non-household entities, except when the equipment is all working and will be sold or donated for reuse — because electronic products that are sold or donated for reuse are not considered to be discarded, and thus, cannot be subject to the solid or hazardous waste regulations.

Nobody knows that status at the moment of pickup, and NYSDEC says as much: where the recycler does not know the condition or value of the equipment, the generator status of the supplier, or whether the equipment will be reused rather than dismantled, having a notification on file allows for all these possibilities. Read as a buyer, that is an argument for a vendor who notifies and for disposition recorded per asset rather than per load.

Sources: NYSDEC, guidance for collectors, dismantlers and recyclers

The rulemaking that governs this has finished. NYSDEC filed a Notice of Adoption on 8 February 2022 to repeal and replace 6 NYCRR Part 368, published in the 23 February 2022 State Register, and Subpart 368-3 took effect 1 January 2023.

Older NYSDEC pages still describe that rulemaking as in development or on hold. They are stale. Subpart 368-3 is in force.

Sources: NYSDEC, electronic waste recycling

NYSDEC. It maintains a list of electronic waste recycling facilities registered under the Act, sorted alphabetically by county, with the express caveat that inclusion in this list does not constitute an endorsement by the Department. It adds a second caveat that is easy to miss: an address on that list might not represent a drop-off acceptance location for your equipment, as this type of facility is not required to accept electronic waste directly from consumers under the Act.

A facility can be registered with NYSDEC without being certified, and certified without being registered. This directory does not cross-reference the two, so a listing here is not a statement about NYSDEC registration either way — check the Department's list separately, and call before assuming an address takes deliveries.

Sources: NYSDEC, registered e-waste recycling facilities