Bill Text: NY A03913 | 2023-2024 | General Assembly | Introduced

New York Assembly Bill 3913

Introduced

Bill Title: Provides that if the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-01-03 - referred to consumer affairs and protection [A03913 Detail]

Download: New_York-2023-A03913-Introduced.html




                STATE OF NEW YORK
        ________________________________________________________________________

                                          3913

                               2023-2024 Regular Sessions

                   IN ASSEMBLY

                                    February 8, 2023
                                       ___________

        Introduced  by  M. of A. FAHY -- read once and referred to the Committee
          on Consumer Affairs and Protection

        AN ACT to amend the general business law, in relation to credit monitor-
          ing services

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section  1.  Subdivision  7  of section 899-aa of the general business
     2  law, as amended by chapter 117 of the laws of 2019, is amended  to  read
     3  as follows:
     4    7.  Regardless  of the method by which notice is provided, such notice
     5  shall include contact information for the person or business making  the
     6  notification,  the  telephone numbers and websites of the relevant state
     7  and federal agencies that provide information regarding security  breach
     8  response and identity theft prevention and protection information, and a
     9  description  of  the categories of information that were, or are reason-
    10  ably believed to have been, accessed or acquired  by  a  person  without
    11  valid authorization, including specification of which of the elements of
    12  personal  information  and  private  information were, or are reasonably
    13  believed to have been, so accessed or acquired. If the person  or  busi-
    14  ness  providing  the notification was the source of the breach, an offer
    15  to  provide  appropriate  identity  theft  prevention   and   mitigation
    16  services,  shall  be  provided at no cost to the affected person for not
    17  less than twelve months, along with all information  necessary  to  take
    18  advantage  of  the offer to any person whose information was or may have
    19  been breached if the breach exposed or may have exposed personal  infor-
    20  mation as defined in subdivision one of this section.
    21    § 2. This act shall take effect immediately.


         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD03540-01-3