Relates to notification of security breach

Subdivision 1 is amended to include biometric information, email addresses with their corresponding passwords or security questions and answers, and protected health information as defined under HIPAA as "private information." Paragraph (c) of subdivision 1 is amended to reflect the updated definition of "private information". Paragraph (d) of subdivision 1 is amended to require the New York Attorney General to publically post a list of consumer reporting agencies on its website. Paragraphs (e) and (f) of subdivision 1 are added to provide definitions for "credit card" and "debit card."

Subdivision 2 of Section 899-aa of the General Business law is amended to further define the situation when a business would need to disclose a breach of their security system.

Subdivision 5 of Section 899-aa of the General Business law is amended to update how a business complies with the notice requirements as a result of a data breach, with specific provisions regarding when an e-mail account with corresponding login information is breached and provisions regarding when a breach affects a credit or debit card issuer.

Subdivision 6 of Section 899-aa of the General Business law is amended to increase the civil penalty that may be imposed on a business that knowingly or recklessly violated the data notification section of law. Subdivision 6 is also amended to clarify the attorney general's statute of limitations to bring an action for a violation of the notification law.

Subdivision 7 of Section 899-aa of the General Business law is amended to require notification will include contact information for relevant government authorities that provide information regarding security breach response and identity theft prevention.

Subdivision 8 of Section 899-aa of the General Business law is amended to require that, when New York residents are to be notified under this act, businesses also notify to the New York Attorney General, the Department of State, and the Office of Information Technology Services with information concerning their notification of New York residents.

Subdivision 9 of Section 899-aa of the General Business law is amended to require the New York Department of State to receive and respond to inquiries relating to any breach of information security, work in cooperation with the New York Attorney General and the Office of Information Technology Services to develop, update, and make publically available information and best practices regarding the response to and prevention of security breaches.

Section Two of this bill amends paragraph (d) of subdivision 1, and subdivisions 2, 6, 7, and 8 of Section 208 of the State Technology law.

Subdivision 1 is amended to include biometric information, email addresses with their corresponding passwords or security questions and answers, and protected health information as defined under HIPAA as "private information." Paragraph (d) of subdivision 1 is amended to require that the New York Attorney General publically post a list of consumer reporting agencies to its website.

Subdivision 2 of Section 208 of the State Technology law is amended such that, when a state entity suffers a breach, the Office of Information Technology Services shall deliver a report on the scope of the breach and recommendations to restore and improve that state entity's information security system.

Subdivision 6 of Section 208 of the State Technology law is amended to require that notice of a breach include contact information for relevant state and federal agencies that provide information regarding security breach response and identity theft prevention.

Subdivision 7 of Section 208 of the State Technology law is amended to require, when New York residents are to be notified of a breach, that the state entity responsible for the breach notify the New York Attorney General, the Department of State, and the Office of Information Technology Services and include a copy of the template of the notice sent to the affected residents.

Subdivision 8 of Section 208 of the State Technology law is amended to require the Office of Information Technology Services to develop, update, and provide training to all state entities regarding best practices for preventing security breaches.

Section Three of this bill provides that this act will take effect January 1, 2017.

Justification

New York's current data breach notification law needs to be updated to keep pace with individuals' use and dissemination of private information. This bill recognizes the breadth of private information, so it expands the scope of information included under the current law to include biometric information, email addresses and their corresponding passwords or security questions and answers, and protected health information as defined under HIPAA. It also updates the notification procedures companies and state entities must follow when there has been a breach of private information.

Prior legislative history

New bill.

Existing law

The NYS Information Security Breach and Notification Act (General Business Law § 899-aa) provides that in the event of unauthorized access to "private information," defined as personal information in combination with a Social Security Number, driver's license or an account or credit card number, the New York Notification Act requires the business or state entity to notify affected customers and inform appropriate authorities. Notification must be made "in the most expedient time possible and without reasonable delay but subject and consistent with legitimate needs of law enforcement." The New York Attorney General is authorized to bring an action against businesses that violate the New York Notification Act. Covered state entities are also required to have a notification policy. The NYS Internet Security and Privacy Act (State Technology Law Article 2) mirrors many of the statutory provisions provided under the General Business Law § 899-aa above, and imposes the same notification requirements on State agencies that handle "private information" under State Technology Law § 208, paragraph 5.

Fiscal impact

None.

Effective date

This act shall take effect January 1, 2017.