Provides for notification of persons whose private information is subject to an unauthorized acquisition

- provide a definition of the term "encrypted"; - clarify the definition of the term "private information"; - clarify the definition of "breach of the security of the system" and the exception for "good faith acquisition" of private information; - revise the definition of "consumer reporting agency" and the provision relating to the compilation of a list of such agencies by the Attorney General; - impose a requirement that private information be protected with reasonable security procedures and practices; - revise the requirements applicable to a person or business maintaining computerized data which such person or business does not own; - provide for the filing of written evidence of determinations by law enforcement agencies in certain instances; - revise the requirements applicable to the provision of substitute notice of breaches; - revise the contents of the required breach notification; and - provide for additional notification relating to mitigation activities in response to breaches involving more than 500,000 persons.

Section 2 of the bill amends State Technology Law (STL) § 208 to effect corresponding changes in that statute.

Section 3 of the bill contains the effective date.

Existing law

The Information Security Breach and Notification Act (Chapters 442 and 491 of the Laws of 2005) was enacted to require businesses and State agencies to provide notification to New York residents whose private information has been compromised by a breach in the security of computerized data.

Legislative history

This bill was introduced in the Senate in 2008 (S.7355). The bill was reported out of the Consumer Protection Committee, advanced to the third reading, and committed to the Rules Committee.

Statement in support

The Information Security Breach and Notification Act, which was based on an earlier California statute, was enacted in 2005 to require businesses and State agencies to provide timely notification to persons whose private information has or is reasonably believed to have been acquired by an unauthorized person. The Act constituted an important first step in providing New York State residents with information necessary to mitigate the potential risks and damages that are associated with breaches in the security of computerized data. During the first ten months of 2008, 425 breach notifications were filed under the provisions of the Act indicating that more than 1.7 million records have been the subject of breaches.

Although the Act has clearly advanced the interests of New York State residents by providing warnings when private information may have been disclosed, it is also evident from an analysis of the legislative history of the Act and from the experience of the Office of Cyber Security and Critical Infrastructure Coordination (CSCIC), the Consumer Protection Board (CPB), and the Office of the Attorney General (GAG) in administering specific aspects of the Act, that certain terms used in the Act are not adequately defined, other terms are not used consistently, and some provisions of the Act are capable of a variety of interpretations. These issues have made it difficult for businesses and State agencies to implement the provisions of the Act consistently and effectively. In addition, the operation of the provisions of the Act over the past three years have also highlighted the potential for certain other changes in the Act that are likely to improve the process by which individuals are informed and the information that is provided to those individuals. As a whole, the proposed amendments to the Act will further reduce the risk of harm from security breaches, including identity theft.

Among the proposed amendments is the addition of a definition of the term "encrypted." Given that the Act provides an exemption from the breach notification requirements in those instances in which the private information subject to the breach has been encrypted and that not all encryption presents a significant barrier to unauthorized acquisition of the encrypted information, it is important to limit the exemption to those instances in which the encryption employed actually provides adequate protection. As amended, the Act would reference a generally accepted industry standard for encryption that would exempt the person or business from the breach notification requirements.

Further, the proposed amendments would refine the definition of "private information." Specifically, the definition would be amended to eliminate the requirement that account numbers and credit or debit card numbers be disclosed in combination with the codes or passwords necessary to permit access to an account. Apart from the difficulty in applying a standard that requires a determination of which data elements actually permit access, it is our view that risks presented in the disclosure of personal information, as defined in the Act, in combination with account or card numbers should be sufficient to necessitate notification under the Act.

The provisions of STL § 208 would be amended to clarify the applicability of the requirement that certain entities other than State entities adopt policies or local laws that are consistent with section 208. The use of the undefined term "local agencies" does not provide adequate guidance on the applicability of section 208 to entities such as school districts and boards of cooperative educational services. The bill incorporates language used in the recently enacted State Finance Law §.188 to specify which local governments are required to adopt policies or local laws. Based on the effective dale of the bill, any entity that falls within the amended definition and has not already adopted a policy or local law will have 180 days to do so. The bill would also require an entity other than a State entity to file a copy of its policy or local law with the Consumer Protection Board within 90 days of its adoption.

Under the existing Act, the required notifications may be delayed if a law enforcement agency determines that notification would impede a criminal investigation and the notification is to be made only after the law enforcement agency indicates that notification will not compromise the investigation. No provision is made for documenting the determinations by law enforcement that serve as the basis for delaying notification. This bill would amend the Act to require the person, business, or State entity that experienced the breach to submit written documentation of the determinations of the law enforcement agency with the notification filed with CSCIC, CPB, and OAG. The submission of this evidence will assist the agencies in evaluating the reasonableness of any delay in notification.

The bill also amends the provisions of the Act relating to the contents of the notification to affected persons. As amended, the Act would require that the notification include contact information for the person, business, or State entity that experienced the breach and information concerning steps to mitigate the risks associated with identity theft.

In addition, the notification would be required to include contact information for the CPB, a practice modeled on those implemented in other states. In our opinion, the revised notifications will be more useful to the affected persons and assist them in acting to reduce the likelihood that they will suffer monetary or other damages as a result of the disclosure of their private information.

In relation to mitigating the effects of breaches in the security of computerized data, the bill provides that persons, businesses, and State entities required to make notifications under the Act be required to include information on steps individuals c;;m take to protect against losses from identity theft. This additional information will help provide individuals with the direction and tools needed to manage the risks associated with breaches in the security of computerized data.

In addition, persons, businesses, and State entities that experience breaches in the security of computerized data affecting more than 500,000 persons would be required to provide a second notification describing the steps taken to mitigate the effects of the breach. The second notification would be required to be provided within 120 days of the initial notice and would be filed with CSCIC, CPB and OAG. In light of the potential impact of large scale breaches, the second notification would permit those agencies to evaluate that response and the effectiveness of the Act.

Budget implications

None.

Effective date

This bill will take effect 180 days after it shall have become law.