Relates to the timeliness of disclosure of a breach of the security of a system which contains private information

Title of bill

An act to amend the general business law, in relation to the timeliness of disclosure of a breach of the security of a system which contains private information

Purpose

To update New York's data breach law to include a definitive timetable for notification to consumers of a security breach.

Summary of provisions

Section 1: Amends subdivision 2 of section 899-aa of the general business law by adding a definitive timetable for notification to consumers' that a breach of their personal information has occurred. Under the current law, consumers must be notified in the most expedient time possible and without unreasonable day. This bill maintains that consumers must be notified in the most expedient time possible but adds a requirement that notification must occur within 45 days. Additionally, this bill defines reasonable delay includes determining the scope of the breach, preventing further disclosures, conducting a risk assessment, and restoring the integrity of the security system. If the Attorney General determines that additional time is necessary, notification may be delayed for another period of 45 days.

Section 2: Establishes the effective date.

Justification

New York's current data breach notification law must be updated to keep pace with the changing landscape of technology and data storage. The consequences of a breach can include identity theft, financial exploitation and other acts which jeopardize consumers. By adding a 45 day notification period New York joins Connecticut, Florida, Maine, Ohio, Rhode Island, Vermont, Washington, and Wisconsin in establishing a timetable for notification. Adding a timetable for notification will help consumers protect themselves/

Legislative history

New Bill.

Fiscal implications

None.

Effective date

This act shall take effect immediately.