What's happening
This bill requires credit agencies to automatically place a 90-day security freeze on credit reports after a data breach, at no cost to affected consumers.
Why it matters
Automatically placing a security freeze on credit reports after a data breach means consumers are protected without needing to take action themselves, reducing the risk of identity theft following a breach.
The mandated notification from credit agencies ensures that consumers are kept informed about the freeze and the potential risk to their personal information, strengthening transparency and trust.
Allowing consumers to lift the freeze temporarily or for specific parties, at no cost, provides flexibility for legitimate credit activities (like applying for loans or renting apartments) without financial barriers.
Credit agencies are held to strict timelines for both freezing credit and notifying consumers (seven days for each), which incentivizes agencies to respond quickly to breaches and prioritize consumer protection.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Automatic Credit Freezes After Breach
Plain English, a few words. Used as the page title.
Sponsors
History
- Referred to consumer protection
- Referred to rules
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
6879
2017-2018 Regular Sessions
IN SENATE
September 20, 2017
Introduced by Sen. COMRIE -- read twice and ordered printed, and when printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to automatic security freezes on consumer credit reports
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Section 380-t of the general business law is amended by adding a new subdivision (c-1) to read as follows:
(c-1)(1) Any consumer credit reporting agency which receives notification that it has experienced a breach of data shall, within seven days of discovery of the data breach, automatically place a security freeze on each consumer's credit report who was affected by the breach of data for no longer than ninety days. Such consumer credit reporting agency shall further notify a consumer of such security freeze placed on his or her credit report within seven days of the placement of the freeze.
(2) If, after an automatic security freeze has been placed on a consumer's credit report in accordance with this subdivision, a consumer wishes to allow his or her consumer credit report to be accessed for a specific party or a specific period of time while a freeze is in place, the consumer shall unfreeze his or her consumer credit report in accordance with subdivision (d) of this section, at no cost to the consumer.
§ 2. This act shall take effect immediately.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD13522-01-7
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to automatic secu- rity freezes on consumer credit reports
Purpose
To protect the public from the dire and damaging consequences of data and security breaches that are visited upon, or caused by, consumer reporting agencies.
Summary of provisions
This bill amends existing Section 380-t of the general business law to add a new subdivision c-1 to require credit reporting agencies that have experienced a breach to place an automatic 90 day security freeze on all consumer's credit reports that were affected; this must happen with 7 days of original notification, the consumer must be notified of the freeze within 7 days and the consumer can lift the freeze at their option, at no cost to them.
Read the full memo (631 words)
Justification
On September 7th, 2017, one of three major consumer credit reporting agencies in the United States-Equifax-reported that hackers gained access to company data that potentially compromised sensitive informa- tion for 143 million American consumers - nearly 44% of the U.S. popu- lation. The breach included: social security numbers, driver's license numbers, names, addresses and birth dates. Keys that unlock consumers' medical histories, bank accounts, and employee accounts have also been compromised. Credit card numbers for 209,000 consumers were stolen, and documents with personal information used in disputes for 182,000 people were also stolen.
The attack on Equifax represents one of the largest risks to personally sensitive information in recent years. This incident is the third major cybersecurity threat for the agency since 2015. Just last year, identify thieves successfully hacked critical W-2 tax and salary data from an Equifax website. Earlier this year, thieves again stole W-2 tax data from an Equifax subsidiary, TALX, which provides online payroll, tax and human resources services to some of the nation's largest corporations. According to investigations, criminals gained access to certain files in the company's system from mid-May to July, 2017 by exploiting a weak point in website software.
Identity thieves can impersonate people with lenders, creditors, and service providers who rely on personal identity information. Thieves can also use stored information from Equifax and use it to open accounts with creditors that use Experian or TransUnion. Cybersecurity profes- sionals criticized Equifax for not improving its security practices after previous thefts. Critics also argue that Equifax should have multiple layers of controls. Consumers complained of a 6-week lag between the discovery of the attack and Equifax's public disclosure. Equifax discovered the intrusion on July 29th but it first disclosed the attack publicly on September 7th.
There seems to be a broad sense of uncertainty by experts and lawmakers as to which federal regulator, if any, is charged with the responsibil- ity to monitor and do regular supervision on cybersecurity. The Consumer Financial Protection Bureau has authority to police violations of consumer protection laws by consumer credit bureaus, but the agency generally leaves data privacy enforcement to the Federal Trade Commis- sion. However, the Trade Commission lacks the authority to impose big fines or authorize fines for first time violations of certain rules. Neither have commented on applicable law or jurisdiction. Although federal lawmakers have promised legislation and public hearings, no clear authority is forthcoming in short order. Thus, it is time for New York State to lead on this issue, given the fact that millions of our residents were exposed in this episode. TO THIS END, THIS LEGISLATION PROVIDES A CLEAR CONSUMER PROTECTION MANDATE THAT WILL AGGRESSIVELY PROTECT THE CREDIT DATA, HISTORY AND REPORTS OF AFFECTED CONSUMERS, POTENTIALLY SAVING THEM FROM ADVERSE ACTIONS AND DECISIONS.
Legislative history
This is a new bill.
Fiscal implications
None noted for the state; the design of the legislation could signif- icant save money for consumers.
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.