Bill Text: NY A08872 | 2023-2024 | General Assembly | Introduced

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Provides that a business must provide notification of a data breach within 30 days of such breach; includes the department of financial services to the list of entities that must be notified of a data breach that affects any New York resident.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-06-03 - substituted by s2659b [A08872 Detail]

Download: New_York-2023-A08872-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                          8872

                   IN ASSEMBLY

                                    January 25, 2024
                                       ___________

        Introduced by M. of A. SAYEGH -- read once and referred to the Committee
          on Consumer Affairs and Protection

        AN ACT to amend the general business law, in relation to notification of
          a data breach

          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:

     1    Section 1. The opening paragraph of subdivision 2 and subdivision 3 of
     2  section 899-aa of the general business law, as amended by chapter 117 of
     3  the laws of 2019, are amended to read as follows:
     4    Any person or business which owns or licenses computerized data  which
     5  includes  private  information shall disclose any breach of the security
     6  of the system following discovery or notification of the breach  in  the
     7  security  of  the system to any resident of New York state whose private
     8  information was, or is reasonably believed to  have  been,  accessed  or
     9  acquired  by  a person without valid authorization. The disclosure shall
    10  be made in the most expedient time  possible  and  without  unreasonable
    11  delay, [consistent with] and shall be made within fifteen days after the
    12  breach  has  been  discovered,  except  for  the legitimate needs of law
    13  enforcement, as provided in subdivision four of this  section[,  or  any
    14  measures  necessary to determine the scope of the breach and restore the
    15  integrity of the system].
    16    3. Any person or business  which  maintains  computerized  data  which
    17  includes  private information which such person or business does not own
    18  shall notify the owner or licensee of the information of any  breach  of
    19  the  security  of the system [immediately] within fifteen days following
    20  discovery, if the private information was, or is reasonably believed  to
    21  have been, accessed or acquired by a person without valid authorization.
    22    §  2.  Paragraph (a) of subdivision 8 of section 899-aa of the general
    23  business law, as amended by chapter 117 of the laws of 2019, is  amended
    24  to read as follows:
    25    (a)  In  the event that any New York residents are to be notified, the
    26  person or business shall notify the state attorney general, the  depart-
    27  ment  of  state  and  the division of state police and the department of
    28  financial services as to the timing, content  and  distribution  of  the

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD04602-03-4
        A. 8872                             2

     1  notices  and  approximate number of affected persons and shall provide a
     2  copy of the template of the notice sent to affected persons. Such notice
     3  shall be made without delaying notice to affected New York residents.
     4    § 3. This act shall take effect immediately.