What's happening
This bill creates a tax credit for small businesses in New York that purchase qualified data breach insurance and follow certain cybersecurity standards.
Why it matters
Encourages small businesses to adopt recognized cybersecurity standards. (such as the NIST Cybersecurity Framework), linking tax benefits to actual improvements in cyber protection, not just insurance purchases.
Limits the credit to businesses with 100 or fewer employees. , targeting relief specifically to small businesses that may be most vulnerable to cyber threats and least able to absorb the financial impact of a data breach.
Imposes controls to prevent abuse. , such as requiring insurance charges to be clearly separated and not "unreasonably large," ensuring that only legitimate, properly priced data breach coverage is subsidized.
Sunsets after five years. , making it a temporary incentive, which allows lawmakers to review its effectiveness and impact on small business security and insurance markets before deciding on renewal or modification.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Businesses with 100 or fewer employees and their owners
They could claim a tax credit equal to 25% of qualified data breach insurance premiums if they comply with an eligible cybersecurity standard.
Data breach insurers
For policies covering other risks as well, the data breach premium would need to be separately stated in the contract or a separate insurer statement to qualify for the credit.
State comptroller and Office of Information Technology Services
The comptroller could specify qualifying cybersecurity standards similar to the federal framework after consulting with the office’s director.
Headline styles
Tax Credit for Cyber Insurance
Plain English, a few words. Used as the page title.
Sponsors
2 Co-sponsors
History
- Referred to budget and revenue
- Referred to budget and revenue
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
2821
2019-2020 Regular Sessions
IN SENATE
January 29, 2019
Introduced by Sen. JORDAN -- read twice and ordered printed, and when printed to be committed to the Committee on Budget and Revenue
AN ACT to amend the tax law, in relation to a business tax credit for purchase of data breach insurance; and providing for the repeal of such provisions upon expiration thereof
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Section 210-B of the tax law is amended by adding a new subdivision 53 to read as follows:
53. Data breach insurance credit. (a) A taxpayer that is a business or owner of a business shall be allowed a credit against the tax imposed by this article equal to twenty-five percent of the premium paid during the taxable year for qualified data breach insurance. For purposes of this section, the term "qualified data breach insurance" means coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation, of data.
(b) In order to qualify for such credit, taxpayers shall adopt and be in compliance with one of the following:
(1) Version 1.0 of the framework for improving critical infrastructure cybersecurity published by the national institute of standards and technology as in effect on February twelfth, two thousand fourteen or subsequent versions or iterations; or
(2) Any similar standard specified by the state comptroller, after consultation with the director of the office of information technology services.
(c) In the case of insurance coverage under which amounts are payable for other than expenses or losses described in paragraph (a) of this subdivision:
(1) No amount shall be treated as premiums for qualified data breach insurance unless the charge for such insurance is either separately
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD08957-01-9
S. 2821 2
stated in the contract, or furnished to the policyholder by the insurance company in a separate statement;
(2) The amount taken into account as the premium paid or incurred for such insurance shall not exceed such charge; and
(3) No amount shall be treated as paid or incurred for such insurance if the amount specified in the contract, or furnished to the policyholder by the insurance company in a separate statement, as the charge for such insurance is unreasonably large in relation to the total charges under the contract.
(d) Premiums shall be taken into account under paragraph (a) of this subdivision only if such premiums are paid or incurred in the ordinary course of the taxpayer's trade or business.
(e) This subdivision shall not apply to a business which employs one hundred and one or more employees.
§ 2. Section 606 of the tax law is amended by adding a new subsection (jjj) to read as follows:
(jjj) Data breach insurance credit. (1) A taxpayer that is a business or owner of a business shall be allowed a credit against the tax imposed by this article equal to twenty-five percent of the premium paid during the taxable year for qualified data breach insurance. For purposes of this section, the term "qualified data breach insurance" means coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation, of data.
(2) In order to qualify for such credit, taxpayers shall adopt and be in compliance with one of the following:
(A) Version 1.0 of the framework for improving critical infrastructure cybersecurity published by the national institute of standards and technology as in effect on February twelfth, two thousand fourteen or subsequent versions or iterations; or
(B) Any similar standard specified by the state comptroller, after consultation with the director of the office of information technology services.
(3) In the case of insurance coverage under which amounts are payable for other than expenses or losses described in paragraph one of this subsection:
(A) No amount shall be treated as premiums for qualified data breach insurance unless the charge for such insurance is either separately stated in the contract, or furnished to the policyholder by the insurance company in a separate statement;
(B) The amount taken into account as the premium paid or incurred for such insurance shall not exceed such charge; and
(C) No amount shall be treated as paid or incurred for such insurance if the amount specified in the contract, or furnished to the policyholder by the insurance company in a separate statement, as the charge for such insurance is unreasonably large in relation to the total charges under the contract.
(4) Premiums shall be taken into account under paragraph one of this subsection only if such premiums are paid or incurred in the ordinary course of the taxpayer's trade or business.
(5) This subsection shall not apply to a business which employs one hundred and one or more employees.
§ 3. Subparagraph (B) of paragraph 1 of subsection (i) of section 606 of the tax law is amended by adding a new clause (xliv) to read as follows:
(xliv) Data breach insurance Amount of credit under subdivision
S. 2821 3
credit under subsection (jjj) fifty-three of section two hundred
ten-B
§ 4. This act shall take effect immediately and shall apply to taxable years beginning on and after the first of January next succeeding the date on which it shall have become a law and shall remain in effect for five years after it shall have become a law, when upon such date the provisions of this act shall expire and be deemed repealed.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the tax law, in relation to a business tax credit for purchase of data breach insurance; and providing for the repeal of such provisions upon expiration thereof
Purpose
This bill would create a data breach insurance tax credit for small businesses.
Summary of provisions
Sections 1, 2 and 3 establish the Data Breach Insurance tax credit with- in three parts of the tax law, laying out the requirements for quali- fication and the technical compliances required.
Section 4 establishes the effective date.
Justification
As commerce becomes increasingly modernized, an increasing amount of credit and debit card information are held by businesses - both large and small - as a result of sales over the internet, which have dramat- ically increased in the last twenty years. Many risks unimaginable then have resulted to both consumers and to businesses, and state law should be upgraded to reflect the realities of e-commerce, particularly in relation to ensuring small businesses can remain competitive online.
Data breach insurance is a relatively new form of insurance that covers losses that occur as a result of hackers, which not only could lead to loss of consumer confidence but also significant investments of time and money to recover any lost information. In addition, there are also several potential local, state, and federal in relation to fraud that businesses must comply with. This type of insurance helps cover it and some firms even provide compliance assistance.
This bill would provide a tax credit equal to one-quarter (25%) of the costs incurred by premiums for data breach insurance for small busi- nesses. By doing so, this bill would allow small businesses to take advantage of this new type of insurance, providing not only peace of mind but also a strong sense of confidence in expanding a small business to the rapidly expanding world of e-commerce.
Legislative history
S4615 of 2017-18
Fiscal implications
To be determined.
Effective date
Immediately, applying to taxable years beginning on and after January 1st after which it had become law, remaining in effect for five years.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.