Senate Bill S2117

                            
                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  2117

                       2011-2012 Regular Sessions

                            I N  S E N A T E

                            January 18, 2011
                               ___________

Introduced  by  Sen.  KRUGER -- read twice and ordered printed, and when
  printed to be committed to the Committee on Consumer Protection

AN ACT to amend the general business law, in relation to identity  theft
  prevention

  THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. The general business law is amended by adding a new article
32-A to read as follows:
                              ARTICLE 32-A
                        IDENTITY THEFT PREVENTION
SECTION 676. DEFINITIONS.
        677. IDENTITY THEFT PREVENTION.
        678. APPLICATION OF ARTICLE.
        679. BANKING DEPARTMENT APPROVAL.
  S 676. DEFINITIONS. FOR THE PURPOSES OF THIS ARTICLE, THE TERM:
  1. "BUSINESS ORGANIZATION" SHALL MEAN ANY PERSON,  FIRM,  ASSOCIATION,
PARTNERSHIP OR CORPORATION ENGAGED IN BUSINESS IN NEW YORK STATE;
  2.  "INFORMATION  SECURITY  PLAN" SHALL MEAN A BUSINESS ORGANIZATION'S
RISK-BASED APPROACH TO SAFEGUARDING THE PERSONAL  INFORMATION  COLLECTED
AND RETAINED FOR THE PURPOSES OF EMPLOYMENT OR THE PROVISION OF GOODS OR
SERVICES DEVELOPED PURSUANT TO SECTION SIX HUNDRED SEVENTY-SEVEN OF THIS
ARTICLE.
  S  677.  IDENTITY THEFT PREVENTION. 1. ANY BUSINESS ORGANIZATION DOING
BUSINESS IN THIS STATE, EXCEPT AS  SET  FORTH  IN  SECTION  SIX  HUNDRED
SEVENTY-EIGHT  OF  THIS  ARTICLE,  SHALL DEVELOP AN INFORMATION SECURITY
PLAN SUBJECT TO THE APPROVAL OF THE NEW YORK STATE BANKING DEPARTMENT.
  2. SUCH INFORMATION SECURITY PLAN SHALL:
  A. IDENTIFY AND ASSESS THE RISKS TO CUSTOMER INFORMATION AND  EVALUATE
THE EFFECTIVENESS OF THE CURRENT SAFEGUARDS FOR CONTROLLING SUCH RISKS;

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD00005-01-1

S. 2117                             2
              

  B. SET FORTH, IMPLEMENT, REGULARLY MONITOR AND TEST A PROGRAM TO SAFE-
GUARD  ANY  PERSONAL INFORMATION COLLECTED AND RETAINED FOR THE PURPOSES
OF EMPLOYMENT OR THE PROVISION OF GOODS OR SERVICES;
  C. TAKE REASONABLE STEPS TO SELECT AND RETAIN INTERNET SERVICE PROVID-
ERS  THAT  ARE  CAPABLE  OF  MAINTAINING  APPROPRIATE SAFEGUARDS FOR THE
CUSTOMER INFORMATION THAT YOU MUST RETAIN IN ORDER TO DO BUSINESS;
  D. BE  EVALUATED  AND  ADJUSTED  TO  REFLECT  RELEVANT  CIRCUMSTANCES,
INCLUDING  CHANGES  IN BUSINESS OPERATIONS OR AS A RESULT OF TESTING AND
MONITORING;
  E. ENSURE THE SECURITY AND CONFIDENTIALITY  OF  PERSONAL  RECORDS  AND
INFORMATION;
  F.  PROTECT AGAINST ANY ANTICIPATED THREATS OR HAZARDS TO THE SECURITY
OR INTEGRITY OF SUCH PERSONAL RECORDS AND INFORMATION;
  G. PROTECT AGAINST UNAUTHORIZED ACCESS TO, OR USE OF, PERSONAL RECORDS
AND INFORMATION THAT COULD RESULT IN SUBSTANTIAL HARM  OR  INCONVENIENCE
TO ANY CUSTOMER OR EMPLOYEE; AND
  H.  BE  APPROPRIATE TO THE SIZE AND COMPLEXITY OF EACH BUSINESS ORGAN-
IZATION.
  S 678. APPLICATION OF ARTICLE. THE PROVISIONS OF  THIS  ARTICLE  SHALL
APPLY TO ANY BUSINESS ORGANIZATION DOING BUSINESS IN THIS STATE EXCEPT:
  1.  THOSE  SUBJECT TO REGULATION UNDER THE GRAMM-LEACH-BLILEY ACT, THE
FEDERAL TRADE COMMISSION (HEREAFTER "FTC") PRIVACY RULE  AND  THE  FTC'S
STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION, ALSO KNOWN AS THE FTC'S
SAFEGUARDS RULE, AS IMPLEMENTED BY 16 C.F.R. PART 314; AND
  2.  ANY  AGENCY  OR  UNIT  OF  THE STATE OF NEW YORK AND ANY POLITICAL
SUBDIVISION THEREOF INCLUDING MUNICIPALITIES AND ANY BUSINESS  ORGANIZA-
TIONS REGULATED BY THE UNITED STATES GOVERNMENT.
  S  679.  BANKING  DEPARTMENT  APPROVAL. EACH INFORMATION SECURITY PLAN
DEVELOPED PURSUANT TO SECTION SIX HUNDRED SEVENTY-SEVEN OF THIS  ARTICLE
IS SUBJECT TO APPROVAL IN ACCORDANCE TO REGULATIONS DEVELOPED BY THE NEW
YORK STATE BANKING DEPARTMENT.
  S  2.  This  act shall take effect on the ninetieth day after it shall
have become a law; provided, that, effective immediately, the  addition,
amendment  and/or  repeal  of  any  rule or regulation necessary for the
implementation of this act on its  effective  date  are  authorized  and
directed to be made and completed on or before such effective date.