New York is fighting federal demands for sensitive personal information. Its own pied-à-terre tax rollout exposes a privacy gap closer to home.
Thirty states (red, blue and purple) and the District of Columbia have been sued by the Trump Justice Department for refusing to turn over voter-registration records containing residents’ birth dates, partial Social Security numbers and driver’s license and non-driver photo ID numbers.
New York called DOJ’s demand “breathtaking in scope” and a “grave and wholly unjustified threat” to the privacy of millions of New Yorkers. DOJ, the state argued, sought protected information from state systems, asked for more than it had shown it needed and didn’t adequately explain how the data would be used, safeguarded or further disclosed once handed over.
Meanwhile, the City’s pied-à-terre rollout demands much of the same information — and more — outside the protected channels through which the state ordinarily safeguards it. The result is a new City repository of sensitive records, with no explanation of who may access them, for what purpose, or what privacy protections or limits on use govern it. The Department of Finance (DOF) has confirmed that surcharge submissions will not receive tax secrecy protections. Questions about what protections do apply remained largely unanswered through rulemaking and the City Council’s August oversight hearing.
On Sept. 29, a Staten Island judge ruled that the rollout was arbitrary and capricious, citing, among other flaws, some of the privacy risks created, and ordered the City to restart the process. The City immediately appealed, triggering an automatic stay. The City’s collection of personal information continues as the Oct. 6 deadline approaches. Owners who have not established primary residence by then can expect to be billed on Nov. 15, with payment due Jan. 1. And whatever happens on appeal, the decision does not answer the privacy questions created by what the City has already collected from thousands of homeowners and published about the owners of nearly a million properties.
Fixing this is not only the right thing for Albany and the City to do; it is a compelling opportunity for New York to lead as personal data is increasingly collected, combined and reused in ways people may never have anticipated.
What the City asks for
In late July and early August, the City sent notices to approximately 17,000 owners of apartments with DOF market values starting at $1 million, and one-, two- and three-family homes valued at $5 million or more. Former Finance Commissioner Martha Stark has estimated that roughly two-thirds of those properties are primary residences, which are not subject to the surcharge at all. Each notice stated the amount due unless the owner obtained an exemption by applying to DOF within 30 days of the date printed on the notice. Many owners did not actually receive their notices until weeks after that date.
Owners could apply by uploading copies of prescribed proofs of primary residency to a new online portal or, less conveniently, by mail. The path of least resistance DOF offered was the full tax return of every primary resident — though for individually owned homes, one qualifying owner is enough. Without a return, the portal required two or more of the following: a copy of the front and back of a DMV-issued ID, a voter identification card or “other proof” DOF deems acceptable, including proof of occupancy for the prior 12 months. DOF gave no examples or prominent guidance about what that other proof might be. This effectively forces applicants to turn over some combination of the named documents — which contain the same information the state is fighting to keep out of federal hands, and more, including full rather than partial Social Security numbers.
Owners who hold their homes through trusts, LLCs or partnerships must also submit ownership documents. People hold homes this way for ordinary reasons: setting rules for shared ownership, providing for nontraditional families, limiting liability and planning for succession. Indeed, the court noted that more than half of the notified properties are held this way. While a short form is provided for trusts, LLCs and partnerships must submit their full operating or partnership agreements.
Each of these documents reveals far more than the one fact DOF needs. Under DOF’s own rule, a tax return listing the property as the filer’s permanent home establishes primary residence absent contrary evidence. Yet the full return also discloses income, Social Security numbers, dependents, employers, investments, charitable giving and sometimes health or family circumstances. A DMV-issued ID adds a photograph, date of birth and government identifier; a voter card can show party enrollment. Operating and partnership agreements can expose finances, family relationships and succession plans unrelated to residency. And DOF has not clearly said it will accept copies of any of these documents with unrelated information blacked out.
Declining to submit the required documents to preserve privacy is not a reasonable or realistic choice for many homeowners. Refusing can trigger a surcharge starting at $40,000 per year for apartments at the $1 million threshold and escalating quickly, even for primary residences — an amount that can be several times a home’s total annual property taxes, billed as a single lump sum rather than spread over the year like ordinary property taxes. Nor did DOF tell owners why it had flagged them: In rulemaking, it said it would not explain its initial determinations in the first year. For a homeowner facing that cost on a short deadline, with no stated concern to answer, the safest course is to hand over everything.
Why government privacy laws are so strict
The laws protecting tax, driver and voter records differ, but they guard against the same danger: personal information can be used not only to steal identities but to profile, target and intimidate people. New York law imposes criminal consequences on the person responsible for an unauthorized disclosure of tax-return information and requires that a state officer or employee who willfully discloses it be dismissed and barred from public office for five years. Federal and state law limit what the DMV may release; New York shields a driver’s photograph and Social Security number, and even the documents people show to prove their identity. Voter records are generally public, but New York bars release of license and Social Security numbers and forbids using the published statewide voter list for non-election purposes.
These protections recognize that records combined can reveal far more than any one appears to show. Government files can be assembled to track associations, identify critics or discourage civic participation, and intimate details can be selectively exposed to discredit a critic. These concerns about the potential for government surveillance and misuse of personal information are not new. When the federal government first began computerizing its records and increasingly used Social Security numbers to link them, lawmakers worried about what that new power would let it do — years before Watergate galvanized passage of the federal Privacy Act in 1974. Today’s tools are vastly more powerful.
This is not only about any one individual’s privacy. Some homeowners may not mind what the City now holds about them, and many will never see their records misused. But a new City collection of residents’ finances, families, identities and civic lives, held with fewer protections than the law ordinarily requires, is a public problem. Privacy rules are a critical check on government power: They let people deal with their government, and criticize it, without wondering what it holds on them.
When protected information enters a new system
Homeowners might assume that what they give a tax agency in connection with a tax application receives the same secrecy as their state income tax filings. That assumption is reasonable but wrong — though given the surcharge they faced, a warning would likely have changed little.
Here’s why: Existing statutes protect records held in specific agency systems, not the information itself. Because DOF required homeowners to submit new copies to a separate City collection, those protections do not necessarily apply.
State tax law gives DOF a protected route: When the City requests tax-return information to administer the surcharge, the state must provide it, and the information remains shielded from New York’s public-records law, the Freedom of Information Law. But when DOF requires the same return from a homeowner, tax secrecy does not apply. Asked during rulemaking, DOF said that while it “takes the privacy of personal information very seriously,” surcharge submissions are “not subject to any statutory tax secrecy provisions.” Saying it takes privacy seriously is not a safeguard; offered in a public rulemaking in place of one, it is a non-answer. The court identified the same gap, warning that the process could “render formerly private information available for public consumption.”
Once submitted, the documents become City records. The Freedom of Information Law exists so the public can see what government is doing, not to expose the private lives of the people it serves. Yet unless a specific law makes records confidential, it presumes public access. DOF may withhold information whose release would be an unwarranted invasion of privacy, but staff decide request by request, and homeowners have no guarantee of withholding or right to notice before release.
Government already knows how to share sensitive data without stripping its protections. The City keeps the income and expense filings of commercial and rental property owners confidential by law, and the state shields even the identity documents people show the DMV. DOF collects the same kinds of records from homeowners with no comparable protection.
Why was this necessary?
DOF already had the protected State-tax channel described above. Writing in Vital City, Stark argued that DOF should have checked the information the City and state already held before asking anyone to prove where they live.
In late August, DOF did just that: Using preliminary state income-tax data, it reversed 1,251 determinations. By then, owners had made 5,874 submissions and DOF had approved 3,655 — without rechecking them against the state data, so we do not know how many homeowners could have been spared. For owners who hold title in their own names, state tax data could have answered the question first.
DOF says current state tax data was not available at launch, though the court found DOF had 2024 returns in hand and chose not to rely on them. Either way, timing does not explain the design: DOF’s rule needs one fact from a return, yet DOF asked for the entire return, uploaded to a system where tax secrecy does not apply. Each of these choices may have had its reasons. Together, they moved sensitive records out of the systems built to protect them.
The City also published more than it needed to
And it’s not just how data are being sought; it’s what information the City is choosing to publish.
The surcharge law required a public list of properties that may be subject to the surcharge, with the market values DOF will use to calculate it.
The City instead released a downloadable database of nearly a million property records — even though DOF had already determined that less than 2% of them could be subject to the surcharge — and listed each owner by name alongside the property’s market value. The administration has emphasized that much of this information was already public. But existing public exposure does not justify adding unnecessary identifying information to a new, purpose-specific dataset. Layering more personal data onto an already extensive public record worsens an existing vulnerability. Each additional structured dataset makes personal information easier to verify, combine and repurpose — particularly as tools for analyzing government data at scale grow more powerful.
That makes the data useful for solicitation, fundraising, wealth targeting, scams and profiling. The concern should be familiar because it has been highlighted by former Federal Trade Commission Chair Lina Khan, who helped shape the Mamdani administration’s economic-justice and consumer-protection agenda, and who now chairs the New York City Economic Development Corporation Board. As FTC chair, Khan challenged the aggregation and commercialization of personal information for targeting. The same principle should apply when government is the aggregator.
The judge ordered the overbroad roll removed, permitting it to be replaced with a list limited to properties actually subject to the surcharge. He found it overbroad because it covered far more properties than the surcharge reaches; he did not address the names or other information it contained.
Whatever happens on appeal, taking down or narrowing the roll cannot take back the copies that were already downloaded or stop the information from being used for purposes that have nothing to do with administering the tax.
What City Hall and Albany can do
The City and state can begin closing these gaps now, while the City appeals.
- Stop collecting information the City does not need. Use protected state data and other authoritative government information first. Where records do not resolve the issue, tell owners specifically why and let them certify relevant facts subject to audit. DOF can audit for six years, subpoena records and impose penalties for materially inaccurate or misleading information. For trusts and entities, ask for the ownership fact — not the entire document that contains it. Expressly permit redactions of unrelated information in any document that is submitted.
- Protect sensitive information already in the City’s hands. Delete supporting documents once they are no longer needed, or segregate and restrict them if retention is required. Extend statutory tax secrecy to surcharge submissions, including those already submitted. While legislation catches up, the mayor can establish uniform policies restricting internal access and use and giving homeowners notice before disclosure.
- Reduce publication and downstream use. Remove the current roll, publish only what the law requires and omit unnecessary identifiers. If, as the administration says, this information is already public, Albany should restrict downstream use of the surcharge roll and other property records, as it already does for statewide voter-list information.
None of these fixes is complicated. They are design choices — which channel the City uses, what it asks for, what it keeps and what it publishes — and they can be made now. The City already holds sensitive records from homeowners who had no realistic choice but to submit them, and those records sit outside the protections the law ordinarily provides.
New Yorkers should be able to trust that their sensitive personal data will be safeguarded and used responsibly by any government agency or employee authorized to collect, hold or access it. New York is fighting the federal government for those very principles; it should apply them just as firmly closer to home. Closing this gap would be a good place to start.
Neither author is involved in the current lawsuits challenging the city's pied-à-terre surcharge.
