Bill Text: NY S02117 | 2011-2012 | General Assembly | Introduced

New York Senate Bill 2117 (Prior Session Legislation)

Introduced

Bill Title: Relates to identity theft prevention; requires business organizations to develop and implement information security plans to safeguard personal information collected and retained for the purposes of employment or the provision of goods or services.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced - Dead) 2011-01-18 - REFERRED TO CONSUMER PROTECTION [S02117 Detail]

Download: New_York-2011-S02117-Introduced.html

                           S T A T E   O F   N E W   Y O R K
       ________________________________________________________________________
                                         2117
                              2011-2012 Regular Sessions
                                   I N  S E N A T E
                                   January 18, 2011
                                      ___________
       Introduced  by  Sen.  KRUGER -- read twice and ordered printed, and when
         printed to be committed to the Committee on Consumer Protection
       AN ACT to amend the general business law, in relation to identity  theft
         prevention
         THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
       BLY, DO ENACT AS FOLLOWS:
    1    Section 1. The general business law is amended by adding a new article
    2  32-A to read as follows:
    3                                ARTICLE 32-A
    4                          IDENTITY THEFT PREVENTION
    5  SECTION 676. DEFINITIONS.
    6          677. IDENTITY THEFT PREVENTION.
    7          678. APPLICATION OF ARTICLE.
    8          679. BANKING DEPARTMENT APPROVAL.
    9    S 676. DEFINITIONS. FOR THE PURPOSES OF THIS ARTICLE, THE TERM:
   10    1. "BUSINESS ORGANIZATION" SHALL MEAN ANY PERSON,  FIRM,  ASSOCIATION,
   11  PARTNERSHIP OR CORPORATION ENGAGED IN BUSINESS IN NEW YORK STATE;
   12    2.  "INFORMATION  SECURITY  PLAN" SHALL MEAN A BUSINESS ORGANIZATION'S
   13  RISK-BASED APPROACH TO SAFEGUARDING THE PERSONAL  INFORMATION  COLLECTED
   14  AND RETAINED FOR THE PURPOSES OF EMPLOYMENT OR THE PROVISION OF GOODS OR
   15  SERVICES DEVELOPED PURSUANT TO SECTION SIX HUNDRED SEVENTY-SEVEN OF THIS
   16  ARTICLE.
   17    S  677.  IDENTITY THEFT PREVENTION. 1. ANY BUSINESS ORGANIZATION DOING
   18  BUSINESS IN THIS STATE, EXCEPT AS  SET  FORTH  IN  SECTION  SIX  HUNDRED
   19  SEVENTY-EIGHT  OF  THIS  ARTICLE,  SHALL DEVELOP AN INFORMATION SECURITY
   20  PLAN SUBJECT TO THE APPROVAL OF THE NEW YORK STATE BANKING DEPARTMENT.
   21    2. SUCH INFORMATION SECURITY PLAN SHALL:
   22    A. IDENTIFY AND ASSESS THE RISKS TO CUSTOMER INFORMATION AND  EVALUATE
   23  THE EFFECTIVENESS OF THE CURRENT SAFEGUARDS FOR CONTROLLING SUCH RISKS;
        EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                             [ ] is old law to be omitted.
                                                                  LBD00005-01-1
       S. 2117                             2
    1    B. SET FORTH, IMPLEMENT, REGULARLY MONITOR AND TEST A PROGRAM TO SAFE-
    2  GUARD  ANY  PERSONAL INFORMATION COLLECTED AND RETAINED FOR THE PURPOSES
    3  OF EMPLOYMENT OR THE PROVISION OF GOODS OR SERVICES;
    4    C. TAKE REASONABLE STEPS TO SELECT AND RETAIN INTERNET SERVICE PROVID-
    5  ERS  THAT  ARE  CAPABLE  OF  MAINTAINING  APPROPRIATE SAFEGUARDS FOR THE
    6  CUSTOMER INFORMATION THAT YOU MUST RETAIN IN ORDER TO DO BUSINESS;
    7    D. BE  EVALUATED  AND  ADJUSTED  TO  REFLECT  RELEVANT  CIRCUMSTANCES,
    8  INCLUDING  CHANGES  IN BUSINESS OPERATIONS OR AS A RESULT OF TESTING AND
    9  MONITORING;
   10    E. ENSURE THE SECURITY AND CONFIDENTIALITY  OF  PERSONAL  RECORDS  AND
   11  INFORMATION;
   12    F.  PROTECT AGAINST ANY ANTICIPATED THREATS OR HAZARDS TO THE SECURITY
   13  OR INTEGRITY OF SUCH PERSONAL RECORDS AND INFORMATION;
   14    G. PROTECT AGAINST UNAUTHORIZED ACCESS TO, OR USE OF, PERSONAL RECORDS
   15  AND INFORMATION THAT COULD RESULT IN SUBSTANTIAL HARM  OR  INCONVENIENCE
   16  TO ANY CUSTOMER OR EMPLOYEE; AND
   17    H.  BE  APPROPRIATE TO THE SIZE AND COMPLEXITY OF EACH BUSINESS ORGAN-
   18  IZATION.
   19    S 678. APPLICATION OF ARTICLE. THE PROVISIONS OF  THIS  ARTICLE  SHALL
   20  APPLY TO ANY BUSINESS ORGANIZATION DOING BUSINESS IN THIS STATE EXCEPT:
   21    1.  THOSE  SUBJECT TO REGULATION UNDER THE GRAMM-LEACH-BLILEY ACT, THE
   22  FEDERAL TRADE COMMISSION (HEREAFTER "FTC") PRIVACY RULE  AND  THE  FTC'S
   23  STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION, ALSO KNOWN AS THE FTC'S
   24  SAFEGUARDS RULE, AS IMPLEMENTED BY 16 C.F.R. PART 314; AND
   25    2.  ANY  AGENCY  OR  UNIT  OF  THE STATE OF NEW YORK AND ANY POLITICAL
   26  SUBDIVISION THEREOF INCLUDING MUNICIPALITIES AND ANY BUSINESS  ORGANIZA-
   27  TIONS REGULATED BY THE UNITED STATES GOVERNMENT.
   28    S  679.  BANKING  DEPARTMENT  APPROVAL. EACH INFORMATION SECURITY PLAN
   29  DEVELOPED PURSUANT TO SECTION SIX HUNDRED SEVENTY-SEVEN OF THIS  ARTICLE
   30  IS SUBJECT TO APPROVAL IN ACCORDANCE TO REGULATIONS DEVELOPED BY THE NEW
   31  YORK STATE BANKING DEPARTMENT.
   32    S  2.  This  act shall take effect on the ninetieth day after it shall
   33  have become a law; provided, that, effective immediately, the  addition,
   34  amendment  and/or  repeal  of  any  rule or regulation necessary for the
   35  implementation of this act on its  effective  date  are  authorized  and
   36  directed to be made and completed on or before such effective date.