What's happening
This bill requires businesses that are the source of a data breach to provide free identity theft protection for at least 12 months to affected individuals.
Why it matters
Shifts the financial burden of identity theft protection to businesses. responsible for a data breach, rather than leaving affected individuals to pay for their own monitoring and recovery services.
Creates a direct incentive for companies to strengthen their data security practices,. since a breach will now have a clearly defined financial consequence in the form of mandatory free identity theft services for at least one year.
Ensures a standardized and immediate response. for New Yorkers whose personal information is compromised, potentially reducing the long-term harm caused by data breaches and improving consumer trust.
Clarifies and expands the notification requirements. by mandating that businesses provide clear instructions on how victims can access these free identity theft protection services, which may lead to higher utilization and better outcomes for those affected.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Free Credit Monitoring After Breach
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 38
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to rules
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Free Credit Monitoring After Breach
In Assembly Committee · Consumer Affairs And Protection · Sponsor Patricia Fahy
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
6701
2019-2020 Regular Sessions
IN SENATE
September 11, 2019
Introduced by Sen. CARLUCCI -- read twice and ordered printed, and when printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to credit monitoring services
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Subdivision 7 of section 899-aa of the general business law, as added by chapter 442 of the laws of 2005, is amended to read as follows:
7. Regardless of the method by which notice is provided, such notice shall include contact information for the person or business making the notification and a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired. If the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, shall be provided at no cost to the affected person for not less than twelve months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information as defined in subdivision one of this section.
§ 2. This act shall take effect immediately.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD02293-01-9
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law, in relation to credit monitoring services
Purpose
To require that companies that suffer a data breach provide free credit monitoring services to effected persons for up to one year following the breach.
Summary of provisions
Section 1 - Requires that companies that suffer a data breach provide free credit monitoring services to effected persons for up to one year following the breach.
Section 2 - Effective date.
Justification
Recent headlines have been dominated by a massive data breach that impacted the largest credit-reporting firm in the United States. This breach is estimated to have effected 143 million Americans, or 44t of the population. Millions suddenly found that their birthdates, home addresses, telephone numbers, and, in some cases, even their social security numbers and drivers license numbers had been leaked.
The implications of such a large scale and egregious breach of consumer data security are serious. Millions have been exposed to the possibility of becoming victims identity theft. This can lead to ongoing credit problems and major costs to consumers to remedy the damage done. We must do more to make sure that data breaches are prevented. But just as important, is making sure consumers and law enforcement have the tools available to mitigate damage as soon as a breach occurs. This bill, part of a larger package that will target consumer data breaches at every stage, will provide one of those tools.
This bill will require that companies that suffer a breach provide free credit monitoring services to victims for up to one year following the discovery of the breach. Credit monitoring is key to identifying the occurrence of identity theft. This bill is a significant step toward putting power back in the hands of the consumer.
Legislative history
2017-18: SC912/A2732 - CONSUMER PROTECTION/consumer affairs & protection
Fiscal implications
None to the state.
Effective date
Immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.