What's happening
This bill requires businesses to notify New York residents and state authorities of data breaches within fifteen days of discovery.
Why it matters
The bill strengthens consumer protection by setting a firm 15-day deadline. for businesses to notify New Yorkers and relevant state agencies after discovering a data breach, ensuring residents are quickly informed and can take steps to protect themselves.
It eliminates previous loopholes that allowed businesses to delay notification. for system restoration or breach investigation (except for law enforcement needs), reducing the risk that consumers remain unaware of threats to their personal information.
The legislation expands the list of state authorities that must be notified. to include the Department of Financial Services, potentially improving state-level coordination and oversight in response to breaches—especially those affecting financial data.
By requiring prompt notification from both data owners and third-party data handlers,. the bill acknowledges the modern reality of outsourced data processing and ensures that all parties involved in handling sensitive information are held to the same timely standards.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Businesses that own or license private information
The bill would require notice to affected New York residents within fifteen days of discovering a breach, subject to legitimate law enforcement needs, and remove the allowance for delays to assess the breach or restore system integrity.
Data service providers maintaining others’ private information
The bill would require them to notify the information’s owner or licensee immediately and within fifteen days after discovering a breach.
New York residents affected by data breaches
The bill would set a fifteen-day deadline for notifying residents whose private information was, or is reasonably believed to have been, acquired without authorization, subject to legitimate law enforcement needs.
New York State Department of Financial Services
The bill would add the department to the agencies receiving information about breach notices’ timing, content, distribution and approximate number of affected people.
Headline styles
Notify Breaches in 15 Days
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 14
History
- Referred to internet and technology
- Committed to rules
- Advanced to third reading
- 2nd report cal.
- 1st report cal.556
- Referred to internet and technology
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
2540
2019-2020 Regular Sessions
IN SENATE
January 28, 2019
Introduced by Sens. COMRIE, ADDABBO, BAILEY, BROOKS, FELDER, KENNEDY, KRUEGER -- read twice and ordered printed, and when printed to be committed to the Committee on Internet and Technology
AN ACT to amend the general business law, in relation to notification of a data breach
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Subdivisions 2 and 3 of section 899-aa of the general business law, as added by chapter 442 of the laws of 2005, are amended to read as follows:
2. Any person or business which conducts business in New York state, and which owns or licenses computerized data which includes private information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, acquired by a person without valid authorization. The disclosure shall be made in the most expedient time possible and without unreasonable delay, [consistent with] and shall be made within fifteen days after the breach has been discovered, except for the legitimate needs of law enforcement, as provided in subdivision four of this section[, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system].
3. Any person or business which maintains computerized data which includes private information which such person or business does not own shall notify the owner or licensee of the information of any breach of the security of the system immediately and within fifteen days following discovery, if the private information was, or is reasonably believed to have been, acquired by a person without valid authorization.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD08659-01-9
S. 2540 2
§ 2. Paragraph (a) of subdivision 8 of section 899-aa of the general business law, as amended by section 6 of part N of chapter 55 of the laws of 2013, is amended to read as follows:
(a) In the event that any New York residents are to be notified, the person or business shall notify the state attorney general, the department of state [and], the division of state police and the state department of financial services as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents.
§ 3. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to notification of a data breach
Summary of provisions
This bill amends existing subdivisions 2 and 3 of section 899-aa of the general business law to provide that consumer reporting agencies that experience a data breach must disclose such breach within 15 days.
Justification
On September 7th, 2017, one of three major consumer credit reporting agencies in the United States-Equifax-reported that hackers gained access to company data that potentially compromised sensitive informa- tion for 143 million American consumers - nearly 44% of the U.S. popu- lation. The breach included: social security numbers, driver's license numbers, names, addresses and birth dates. Keys that unlock consumers' medical histories, bank accounts, and employee accounts have also been compromised. Credit card numbers for 209,000 consumers were stolen, and documents with personal information used in disputes for 182,000 people were also stolen.
The attack on Equifax represents one of the largest risks to personally sensitive information in recent years. This incident is the third major cybersecurity threat for the agency since 2015. Just last year, identify thieves successfully hacked critical W-2 tax and salary data from an Equifax website. Earlier this year, thieves again stole W-2 tax data from an Equifax subsidiary, TAM which provides online payroll, tax and human resources services to some of the nation's largest corporations. According to investigations, criminals gained access to certain files in the company's system from mid-May to July, 2017 by exploiting a weak point in website software.
Identity thieves can impersonate people with lenders, creditors, and service providers who rely on personal identity information. Thieves can also use stored information from Equifax and use it to open accounts with creditors that use Experian or TransUnion. Cybersecurity profes- sionals criticized Equifax for not improving its security practices after previous thefts. Critics also argue that Equifax should have multiple layers of controls. Consumers complained of a 6-week lag between the discovery of the attack and Equifax's public disclosure. Equifax discovered the intrusion on July 29th but it first disclosed the attack publicly on September 7th.
There seems to be a broad sense of uncertainty by experts and lawmakers as to which federal regulator, if any, is charged with the responsibil- ity to monitor and do regular supervision on cybersecurity. The Consumer Financial Protection Bureau has authority to police violations of consumer protection laws by consumer credit bureaus, but the agency generally leaves data privacy enforcement to the FederAl Trade Commis- sion. However, the Trade Commission lacks the authority to impose big fines or authorize fines for first time violations of certain rules. Neither have commented on applicable law or jurisdiction. Although federal lawmakers have promised legislation and public hearings, no clear authority is forthcoming in short order. Thus, it is time for New York State to lead on this issue, given the fact that millions of our residents were exposed in this episode.
TO THIS END, THIS LEGISLATION PROVIDES A CLEAR CONSUMER PROTECTION MANDATE THAT WILL AGGRESSIVELY PROTECT CONSUMERS BY MANDATING TIMELY DISCLOSURE OF DATA BEACHES BY CREDIT REPORTING AGENCIES.
Legislative history
S6880 COMRIE No Same as ON FILE: 01/03/18 General Business Law
TITLE:....Relates to notification of a data breach
09/20/17 REFERRED TO RULES
01/03/18 REFERRED TO CONSUMER PROTECTION
Fiscal implications
None noted for the state; the design of the legislation could signif- icant save money for consumers.
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.