Relates to the data security act

Summary of provisions

Section 1 Provides that the act shall be known and may be cited as the data security act.

Section 2. Amends the definition of "private information" in the General Business Law § 899-aa to include biometric information (i.e., data generated by automatic measurements of an individual's physical characteristics, which are used by the owner or licensee to authenticate the individual's identity), online credentials (i.e., a user name or email address in combination with a password or security question and answer that would permit access), and any unsecured protected health information as defined in The Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. pts. 160, 162, 164), as amended.

Section 3. Amends § 899-aa(4) of the General Business Law to provide that forensic reports that are produced to local and state law enforcement agencies, for the purposes of investigating and identifying those responsible for a data breach, shall not constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection. This section also states that forensic reports produced are not subject to New York's Freedom of Information Law

Amends § 899-aa(5) and adds a notice provision that, in the case of a breach of a user name and password, allows for email notice, and in the case of an email account, allows for other electronic notice delivered to the resident online when the resident is connected to the online account from an Internet Protocol address or online location from which the person or business knows the resident customarily accesses the account.

Section 4. Amends the penalties provided for in § 899-aa(6)(a) for "knowingly" or "recklessly" violating General Business Law § 899-aa, by increasing the maximum penalty from $150,000 to one million dollars.

Section 5. Amends the definition of "private information" in the New York state technology law § 208 to include online credentials (i.e., a user name or email address in combination with a password or security question and answer that would permit access) and any unsecured

protected health information as defined in The Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. pts. 160, 162, 164), as amended.

Section 6. Adds a new § 899-bb to the General Business Law to:

Part 1 - Reasonable Data Security Requirements. Requires that any person or business that conducts business in the state of New York that owns or licenses private information must develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information, including disposal of data.

Part 2 - Rebuttable Presumption. Persons or businesses that conduct business in New York and are certified through independent, third-party audits annually by licensed insurers under this section shall have a rebuttable presumption. This rebuttable presumption states that the business or person maintained reasonable data security safeguards to protect the security, confidentiality and integrity of the private information.

Part 3 - Certification. Authorizes and requires the Department of Financial Services ("DFS") to issue regulations allowing certain independent, third party, licensed insurers to conduct audits and certify that an entity has met the reasonable safeguard standards under § 899-bb(1)(b)(vii).

Part 4 Safe Harbor. If a covered person or business complies with NIST (an agency of the United States Department of Commerce) Special Publication 800-53, the covered person or business shall not be liable to the New York Attorney General's office or any affected New York consumer as a result of unauthorized access to private information by a third party. To be eligible for this safe harbor, entities must be annually assessed as compliant with this heightened standard. This assessment must be done by an independent, third-party licensed assessment organization, accredited by FedRAMP and the General Services Administration. Currently, there are 31 accredited third party assessment organizations and they are listed online.

Part 5-Enforcement- Provides the attorney general may seek an injunction and damages for actual costs or losses incurred by a person as a result of failure to adopt the protections provided in this section, including consequential financial losses, as well as penalties of up to $250 per person, up to $10 million. Evidence of financial loss is not required for the court to impose a penalty under this section. Whenever the court shall determine that a person or business violated this section knowingly or recklessly, the court may impose a civil penalty of up to one thousand dollars per person; provided however, that the aggregate amount of any civil penalties so imposed shall not exceed the greater of fifty million dollars or three times the aggregate amount of any actual costs and losses as determined by the court. Also provides for a statute of limitations of three years immediately after the date of the act complained of or the date of discovery of such act.

Section 7. Adds a new § 208(9) to the New York State Technology law that minors the new § 899-bb(2) of the General Business Law.

Section 8. Bill has an effect date of January 1, 2016.

Justification

It will take a `cyber-Pearl Harbor' to wake up the nation to the vulnerabilities in its computer systems. When Secretary of Defense Leon E. Panetta uttered the words `cyber-Pearl Harbor,' it was not intended to be hyperbolic. Rather, Panetta was describing a collective cyberattack; one that would cause "physical destruction and the loss of life," that "would paralyze and shock the nation, [creating] a new, profound sense of vulnerability." While cyber-attacks to date have not yet resulted in whole scale catastrophe, they are exponentially increasing in breadth and magnitude, threatening the security of businesses and customers alike.

New York's data security law is outdated, toothless and fails to address some of the fundamental issues concerning data security breaches. For example, there is no black-letter law requiring a company to maintain "reasonable data security," except if they collect Social Security Numbers. The law only requires that a company provide notice to consumers and the New York Attorney General's office if there is a breach of "private information," which is generally defined as a name in combination with a Social Security Number, driver's license or an account or credit card number.

This legal framework is weak and reactive. It does not address the current crisis in data security, and has done little to prevent data breaches such as the recent breaches of Home Depot, and Target. Moreover, our present law fails to acknowledge a basic fact about data breaches: it can happen to anyone, even those businesses that employ the strictest data security measures available. For those who are meeting top standards for security, law enforcement should be treating them like a victim of a crime, not a perpetrator.

This bill addresses the deficiencies in our legal framework. Specifically, this bill expands and strengthens protection for sensitive information and rewards those who adopt model data security practices.

Prior legislative history

None

Existing law

The NYS Information Security Breach and Notification Act (General Business Law § 899-aa) provides that in the event of unauthorized access to "private information," defined as personal information in combination with a Social Security Number, driver's license or an account or credit card number, the New York Notification Act requires the business or state entity to notify affected customers and inform appropriate authorities. Notification must be made "in the most expedient time possible and without reasonable delay but subject and consistent with legitimate needs of law enforcement." Covered state entities are also required to have a notification policy. The New York Attorney General is granted standing to bring an action against businesses that violate the New York Notification Act.

The New York State Social Security Number Protection Law (General Business Law § 399-dd) protects the use and disclosure of social security numbers. The law provides that any covered individual or entity that possesses Social Security numbers must adopt reasonable measures to limit access to the Social Security numbers. Any person or

employee who has access to Social Security numbers must have a legitimate reason for the access. Moreover each covered individual or entity must provide safeguards "necessary" or "appropriate" to include unauthorized access and to protect confidentiality of the numbers. (The law does not define specific measures that are deemed "necessary" or "appropriate"). The first violation of the law may result in a civil penalty of no more than $1,000 for a single violation and $100,000 for multiple violations. Any subsequent violation may result in a civil penalty of no more than $5,000 for a single violation and $250,000 for multiple violations. There is no private cause of action under this law, and only the Attorney General can enforce its provisions.

Fiscal implications for state and local governments

None

Effective date

January 1, 2016.