What's happening
This bill requires businesses to notify New Yorkers of data breaches within five days of discovery or notification.
Why it matters
Accelerates consumer notification. By requiring notification within five days, the bill greatly reduces the window in which New Yorkers might be unaware that their personal data has been compromised, potentially helping them take protective actions (like monitoring accounts or changing passwords) sooner.
Removes discretionary delays. The bill eliminates previous language that allowed businesses to delay notification for investigative or system integrity reasons, which means consumers will be informed regardless of ongoing investigations or company needs.
Increases business accountability. The strict, five-day timeline creates stronger pressure on companies to have robust breach detection and response protocols, as failure to notify in time could result in legal or reputational consequences.
Potential strain on smaller businesses. The accelerated timeline may be particularly challenging for small or less-resourced businesses, which could struggle to investigate and notify affected individuals within the new, much shorter deadline.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Five-Day Data Breach Notice
Plain English, a few words. Used as the page title.
Sponsors
Assembly Member · Assembly District 111
No co-sponsors yet.
History
- Referred to consumer affairs and protection
- Referred to consumer affairs and protection
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1387
2019-2020 Regular Sessions
IN ASSEMBLY
January 15, 2019
Introduced by M. of A. SANTABARBARA -- read once and referred to the Committee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to disclosure of breaches of the security of the system
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Subdivision 2 of section 899-aa of the general business law, as added by chapter 442 of the laws of 2005, is amended to read as follows:
2. Any person or business which conducts business in New York state, and which owns or licenses computerized data which includes private information shall disclose any breach of the security of the system [following] within five days of the discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, acquired by a person without valid authorization. [The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision four of this section, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.]
§ 2. This act shall take effect immediately.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD06226-01-9
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.