Protect Personal Data

Section 1. Short title. This act shall be known and may be cited as the "personal information protection act".

§ 2. The state law is amended by adding a new article 3-A to read as follows:

ARTICLE 3-A

PERSONAL INFORMATION BILL OF RIGHTS Section 45. Legislative findings and determinations.

46. Personal information bill of rights.

47. Publication and posting of the personal information bill of

rights.

§ 45. Legislative findings and determinations. The legislature finds and determines that the unauthorized access to, and the theft and misappropriation of, personal information can cause serious and significant harm. The legislature further finds and determines that in an attempt to provide some level of protection against the unauthorized access to, and the theft and misappropriation, of such personal information, all persons or entities who collect and maintain such personal information should be required to follow certain minimum safeguards, protocols, standards and best practices. The legislature additionally finds and determines that the minimum safeguards, protocols, standards and best practices established by this article seek to promote the protection of personal information contained in both paper and electronic records, and that the objectives of this article are to promote the security and confidentiality of personal information in a manner fully consistent with customarily accepted safeguards, standards, protocols and best practices; protect against unauthorized access, threats or hazards to the security or integrity of such information as best as can be antic-

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD14238-03-8

S. 7555 2

ipated; and protect against unauthorized access to, or the unauthorized use of, such information that may result in serious, significant or substantial harm or inconvenience. The legislature additionally finds and determines that to promote improved protection of personal information the state technology law should be amended to establish safeguards, standards, protocols and best practices for the protection of personal information by public and private entities, and this chapter should be amended to establish a personal information bill of rights, with such being published and posted by the office of general services.

§ 46. Personal information bill of rights. The state of New York hereby establishes a personal information bill of rights, to declare the right of all New Yorkers to have their personal information, such as, but not limited to, personal identifying information, protected as follows:

1. That all persons or entities that receive and maintain custody of personal information shall have a legal duty to protect such information from unauthorized access and/or unauthorized use.

2. That all persons or entities that receive and maintain custody of personal information, in order to protect the personal information over which they maintain custody, shall establish a comprehensive security program, with safeguards, standards, protocols and best practices.

3. That the office of information technology services, in order to facilitate the establishment of quality comprehensive security programs, shall design, produce and publish model comprehensive security programs, with safeguards, standards, protocols and best practices, to provide for the protection of personal information held by persons and entities, with such model programs tailored to the size and scope of all such persons or entities.

4. That the office of information technology services shall further approve the comprehensive security program of all agencies of state government, and all regulatory agencies of state government shall approve the comprehensive security program of each of their respective regulated entities.

5. That the office of information technology services shall additionally incorporate computer system security requirements within its model comprehensive security programs, and shall require such safeguards, standards, protocols and best practices to be included within all approved security programs.

6. That all persons and entities that receive and maintain custody of personal information shall have a legal duty to notify the division of state police within ten days of their discovery of any breach of security of the personal information under their custody, and all persons and entities that are required to have their comprehensive security program approved, shall have a legal duty to also notify the approving entity within five days of their discovery of any breach of security of the personal information under their custody.

7. That in the event a security breach of personal information is discovered that will adversely impact a personal information subject, the person or entity that maintained custody of such personal information shall further be required to notify all such personal information subjects of the fact that there has been a breach of security involving their personal information.

8. That in the event a security breach of personal information is discovered that will adversely impact a personal information subject, and the person or entity that maintained custody of such personal information did not establish or maintain a comprehensive security program,

S. 7555 3

or did not substantially follow the safeguards, standards, protocols and/or best practices contained within such program, then the personal information subject shall be entitled to bring an action against, and maintain a recovery from, the person or entity that maintained custody of such personal information, together with costs, disbursements and attorney fees.

9. That in the event a security breach of personal information is discovered that will adversely impact a personal information subject, and the person or entity that maintained custody of such personal information did establish and substantially maintain a comprehensive security program, and did substantially follow the safeguards, standards, protocols and best practices contained within such program, then the person or entity that maintained custody of such personal information shall be entitled to a defense against any action brought by a personal information subject.

10. That to further protect the security of personal information, the office of information technology services shall further establish and maintain an information sharing and analysis program, to increase the volume, timeliness, and quality of cyber threat information shared with state public and private sector entities so that these entities may better protect and defend themselves against cyber threats and to promote the development of effective defenses and strategies to combat, and protect against, cyber threats and attacks, and thereby better protect personal information stored and/or maintained in electronic format.

§ 47. Publication and posting of the personal information bill of rights. The office of general services shall publish and prominently post in all state offices, a copy of the personal information bill of rights established in this article. It shall further print and produce a pamphlet on such personal information bill of rights for distribution across the state. The office of general services may sell advertising to be included on such pamphlet to reduce the cost of the production and distribution of the same.

§ 3. The state technology law is amended by adding a new article 4 to read as follows:

ARTICLE IV

SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES

FOR THE PROTECTION OF PERSONAL INFORMATION Section 401. Definition of terms.

402. Duty to protect personal information.

403. Comprehensive security program safeguards, standards,

protocols and best practices.

404. Development of security program safeguards, standards,

protocols and best practices.

405. Approval of comprehensive security programs.

406. Computer system security requirements.

407. Breach of security.

408. Causes of action.

409. Liability protection.

410. Information sharing and analysis program.

§ 401. Definitions of terms. The following definitions are applicable to this article, except where different meanings are expressly specified:

1. "Personal information subject" means any natural person who has his or her personal information collected or maintained by a personal information recipient.

S. 7555 4

2. "Personal information recipient" means any natural person, corporation, partnership, limited liability company, unincorporated association, government, or other entity, that, in the course of their personal, business, commercial, corporate, association or governmental operations, collects, receives, stores, maintains, processes, or otherwise has access to, personal information.

3. "Personal information collector" means any personal information recipient, that does not maintain or store such personal information, or maintain access to such personal information, for more than five minutes, and was provided with the personal information by the personal information subject.

4. "Personal information holder" means any personal information recipient, that maintains or stores such personal information, or maintains access to such personal information, for more than five minutes, and was provided with the personal information by the personal information subject.

5. "Third party personal information holder" means any personal information recipient, that agrees to collect, receive, store, maintain, process, or otherwise have access to, personal information, and was provided with such personal information from a personal information collector, a personal information holder, or another third party personal information holder.

6. "Personal information" (a) means any information, including paperbased information or electronic information, that contains a New York state resident's first name and last name, or a New York state resident's first initial and last name, in combination with any one or more of the following other informational elements that relate to such resident:

(1) A governmentally issued identification number, including:

(i) social security number;

(ii) driver's license number;

(iii) state issued identification card number;

(iv) military identification card number;

(v) student identification number; or

(vi) a United States passport number;

(2) Personal financial information, including:

(i) financial account information, including:

(A) bank account information;

(B) investment account information;

(C) retirement account information;

(D) deferred compensation account information;

(E) mortgage account information;

(F) car loan account information;

(G) credit line account information;

(H) personal loan account information; or

(I) any other monetary fund or loan account information; including:

(I) the number of such financial account;

(II) any record of such financial account;

(III) a transaction history of such account;

(IV) a balance of such account; and/or

(V) any security code, access code, personal identification number or password, that would permit access to, or use of, such financial account;

(ii) credit or debit card information, including:

(A) the number of such credit card or debit card;

(B) the expiration date of such credit or debit card;

S. 7555 5

(C) the card verification value code number of such credit or debit card;

(D) any record of such credit or debit card account;

(E) any transaction history of such credit or debit card;

(F) any balance of such credit or debit card; and/or

(G) any required security code, access code, personal identification number or password, that would permit access to, or use of, such credit or debit card; or

(iii) credit status information, including:

(A) credit score;

(B) credit history; or

(C) any information describing credit transactions of the personal information subject;

(3) Physical characteristic information, including:

(i) the height of the personal information subject;

(ii) the weight of the personal information subject;

(iii) the hair color of the personal information subject;

(iv) the eye color of the personal information subject; and/or

(v) any other distinguishing characteristics of the personal information subject;

(4) Biometric information, including:

(i) fingerprints of the personal information subject;

(ii) voice-prints of the personal information subject;

(iii) eye scans of the personal information subject;

(iv) blood samples of the personal information subject;

(v) deoxyribonucleic acid (DNA) based samples of the personal information subject;

(vi) skin samples of the personal information subject;

(vii) hair samples of the personal information subject; and/or