What's happening
The bill requires businesses to notify affected New Yorkers and the attorney general within 48 and 24 hours, respectively, after discovering a data breach.
Why it matters
Accelerates consumer awareness. By requiring businesses to notify affected individuals within 48 hours of a data breach, the bill enables consumers to take quicker action to protect themselves from identity theft or fraud, such as changing passwords or monitoring accounts.
Strengthens government oversight. The requirement to notify the attorney general within 24 hours gives state authorities earlier knowledge of breaches, allowing for faster investigations and potential intervention to limit harm or enforce compliance.
Increases business accountability. Businesses must act rapidly after discovering a breach, reducing the risk that companies delay disclosure to protect their reputations at the expense of consumer safety.
Potential operational impact. The compressed notification timelines may require companies to update their internal breach response procedures, invest in better detection systems, and train staff to meet the tighter legal obligations.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Notify Residents of Data Breaches
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to rules
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
6889
2017-2018 Regular Sessions
IN SENATE
September 29, 2017
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to the timeliness of disclosure of a breach of the security of a system which contains private information
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. This act may be cited as the "identity theft prevention and breach notification act".
§ 2. Subdivision 2 of section 899-aa of the general business law, as added by chapter 442 of the laws of 2005, is amended to read as follows:
2. Any person or business which conducts business in New York state, and which owns or licenses computerized data which includes private information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, acquired by a person without valid authorization. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision four of this section, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system. Prior to such disclosure, a preliminary notification that such a breach has occurred or may have occurred shall be made to any resident of New York state whose private information was, or is, reasonably believed to have been acquired by a person without valid authorization within forty-eight hours of the time of discovery of such breach. Additionally, a preliminary notification that such a breach has occurred or may have occurred shall be made to the attorney general within twenty-four hours of the time of the discovery of such breach.
§ 3. This act shall take effect immediately.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD13552-01-7
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to the timeliness of disclosure of a breach of the security of a system which contains private information
Purpose
To require that persons or businesses possessing consumer's personal information must provide a preliminary notification that a breach has or may have occurred to the attorney general within twenty-four hours and to all persons potentially effected within forty-eight hours.
Summary of provisions
Section 1 - Requires that, in the event of a data breach, persons or businesses possessing consumer's personal information must provide a preliminary notification that a breach. This preliminary notification must be provided to the attorney general within twenty-four hours of the discovery of a breach. Preliminary notification must then be provided to all persons effected or potentially effected by the breach within forty-eight hours of its discovery.
Section 2 - Effective date.
Existing law
Currently, no preliminary notice of a breach need be provided to any parties. Notice that a breach has occurred must only be provided to effected parties within a reasonable amount of time.
Justification
Recent headlines have been dominated by a massive data breach that impacted the largest credit-reporting firm in the United States. This breach is estimated to have effected 143 million Americans, or 44% of the population. Millions suddenly found that their birthdates, home addresses, telephone numbers, and, in some cases, even their social security numbers and drivers license numbers had been leaked.
The implications of such a large scale and egregious breach of consumer data security are serious. Millions have been exposed to the possibility of becoming victims of identity theft. This can lead to ongoing credit problems and major costs to consumers to remedy the damage done. We must do more to make sure that data breaches are prevented. But just as important, is making sure consumers and law enforcement have the tools available to mitigate damage as soon as a breach occurs. This bill, part of a larger package that will target consumer data breaches at every stage, will provide one of those tools.
Under current law, companies that experience a data breach must notify any effected parties within a reasonable amount of time. This is not enough time to allow consumers to begin taking the necessary steps to protect themselves once their data has been compromised. This bill addresses this by requiring that companies that are compromised by a data breach provide a preliminary notification to any effected or poten- tially effected consumers within forty-eight hours of the discovery of a breach.
This expedited timeline is critical because it will provide consumers with the ability to take essential protective measures in a timely manner. For instance, consumers would now be able to quickly place a credit freeze on their information to prevent its further spread or subscribe to a credit-monitoring program.
Additionally, this bill would require that a company that has suffered a breach also send a preliminary notification to the attorney general within twenty-four hours of the discovery of a breach. This allows the attorney general to immediately begin getting the word out to the public and, just as importantly, to begin protecting consumers from further harm.
Legislative history
New bill.
Fiscal implications
None to the state.
Effective date
Immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.