Bill Text: NY A01670 | 2023-2024 | General Assembly | Introduced

---

Bill Title: Relates to imposing a five-day time limit during which to disclose a breach in the security of a system.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-01-03 - referred to consumer affairs and protection [A01670 Detail]

Download: New_York-2023-A01670-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                          1670

                               2023-2024 Regular Sessions

                   IN ASSEMBLY

                                    January 17, 2023
                                       ___________

        Introduced  by  M.  of  A. SANTABARBARA -- read once and referred to the
          Committee on Consumer Affairs and Protection

        AN ACT to amend the general business law, in relation to  disclosure  of
          breaches of the security of the system

          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:

     1    Section 1. Subdivision 2 of section 899-aa  of  the  general  business
     2  law,  as  amended by chapter 117 of the laws of 2019, is amended to read
     3  as follows:
     4    2. Any person or business which owns  or  licenses  computerized  data
     5  which  includes  private  information  shall  disclose any breach of the
     6  security of the system [following] within five days of the discovery  or
     7  notification of the breach in the security of the system to any resident
     8  of  New  York  state  whose  private  information  was, or is reasonably
     9  believed to have been, accessed or acquired by a  person  without  valid
    10  authorization.  [The disclosure shall be made in the most expedient time
    11  possible and without unreasonable delay, consistent with the  legitimate
    12  needs  of  law  enforcement,  as  provided  in  subdivision four of this
    13  section, or any measures necessary to determine the scope of the  breach
    14  and restore the integrity of the system.]
    15    § 2. This act shall take effect immediately.




         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD03110-01-3