What's happening
This bill requires credit reporting agencies to provide free identity theft prevention and mitigation services for up to five years after certain data breaches involving social security numbers.
Why it matters
Empowers consumers after data breaches. By mandating credit bureaus to provide free identity theft protection and mitigation for up to five years, the bill aims to reduce financial and emotional harm for people whose social security numbers are compromised.
Covers recent past breaches. The protections are retroactive, applying to breaches that happened up to three years before the law takes effect, meaning some consumers affected by older incidents could still benefit.
Limits on agency obligation and scope. Credit reporting agencies are not required to provide these services if, after investigation, they determine the breach is unlikely to harm consumers, which could impact who qualifies for help.
Improves consumer awareness and action. The bill also ensures that affected individuals receive clear instructions on enrolling in protection services and requesting a security freeze, making it easier for them to take preventive steps.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Free ID Theft Protection
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 14
2 Co-sponsors
History
- Substituted by A2374
- Advanced to third reading
- 2nd report cal.
- 1st report cal.870
- Referred to consumer protection
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Free ID Theft Protection
Signed by Governor · Sponsor Jeffrey Dinowitz
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
3582
2019-2020 Regular Sessions
IN SENATE
February 11, 2019
Introduced by Sen. COMRIE -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to requiring a consumer credit reporting agency to offer identity theft prevention and mitigation services in the case of a breach of the security of such agency's system
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Subdivision (n) of section 380-t of the general business law is amended by adding a new paragraph 3 to read as follows:
(3)(i) Upon a breach of the security of the system of a consumer credit reporting agency which includes any social security number, such agency shall offer to each consumer, whose information, including social security number, was breached or is reasonably believed to have been breached, reasonable identity theft prevention services and, if applicable, identify theft mitigation services for a period not to exceed five years at no cost to such consumers. Such agency shall provide all information necessary for such consumers to enroll in such services and shall include information on how such consumers can request a security freeze. A consumer credit reporting agency shall not be required to offer such services if, after an appropriate investigation, the agency reasonably determines that the breach of security is unlikely to result in harm to the consumers whose information has been breached.
(ii) "Breach of the security of the system" as used in this paragraph shall have the same definition as in paragraph (c) of subdivision one of section eight hundred ninety-nine-aa of this chapter.
§ 2. This act shall take effect on the sixtieth day after it shall have become a law and shall apply to any breach of the security of the system of a consumer credit reporting agency that occurred no more than three years prior to the effective date of this act.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01262-01-9
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to requiring a consumer credit reporting agency to offer identity theft prevention and mitigation services in the case of a breach of the security of such agency's system
Purpose or general idea of bill
This bill would provide reasonable consumer protections following a breach of consumer credit data at a credit reporting agency (CRA), when such a breach involves social security numbers.
Summary of specific provisions
Section 1 amends subdivision n of section 380-t of the general business law by adding a new paragraph 3 that would require that when a credit reporting agency suffers a breach of information containing consumer social security numbers, the CRA must provide lifetime identity theft prevention services, and if applicable, identity theft mitigation services to affected customers. Additionally, this new paragraph would prohibit fees relating to the implementation and lifting of security freezes on consumer credit reports, if those reports were part of a breach of information containing social security numbers.
Section 2 amends subdivision q of section 380-t of the general business law by including new language to be included in a consumers summary of rights CRAs must provide consumers on credit freezes to inform them that in the instance of a breach of date involving a social security number, that a consumer has the right to freeze their credit at no cost.
Section 3 sets the effective date.
Justification
In late July 2017, one of the three main CRAs, Equifax Inc., experienced a major data breach involving personal information that included theft of social security numbers. At the time it was widely reported to impact over 140 million accounts, but the full extent of the breach is still uncertain. CRAs have been the subject of public scrutiny in years past for their inaccurate files kept on unknowing consumers and the cumber- some process they subject average people to in order to rectify such errors. The magnitude of this breach won't be known for years, but the status quo where consumers must bear the burden to protect their own identities is unacceptable. To date, Equifax has offered to waive fees for security freezes for a short time period, and offered 12 months of identity theft prevention services at no charge. This response is simply insufficient given that innocent people's information was stolen through no fault of their own. This legislation aims to establish the minimal amount of long term protection consumers could ask for, and even still it is just that, the bare minimum.
Prior legislative history
2017-18- A.8695A - Passed Assembly/S.6923A - Referred to Consumer Protection
Fiscal implications to the state
None to the state.
Effective date
This act shall take effect on the sixtieth day after it shall have become a law and shall apply to any breach of the security of a consumer credit reporting agency that occurred no more than three years prior to the effective date of this act.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.