BILL NUMBER: S6879

SPONSOR: COMRIE
 
TITLE OF BILL:

An act to amend the general business law, in relation to automatic secu-
rity freezes on consumer credit reports

 
PURPOSE:

To protect the public from the dire and damaging consequences of data
and security breaches that are visited upon, or caused by, consumer
reporting agencies.

 
SUMMARY OF PROVISIONS:

This bill amends existing Section 380-t of the general business law to
add a new subdivision c-1 to require credit reporting agencies that have
experienced a breach to place an automatic 90 day security freeze on all
consumer's credit reports that were affected; this must happen with 7
days of original notification, the consumer must be notified of the
              

freeze within 7 days and the consumer can lift the freeze at their
option, at no cost to them.

 
JUSTIFICATION:

On September 7th, 2017, one of three major consumer credit reporting
agencies in the United States-Equifax-reported that hackers gained
access to company data that potentially compromised sensitive informa-
tion for 143 million American consumers - nearly 44% of the U.S. popu-
lation. The breach included: social security numbers, driver's license
numbers, names, addresses and birth dates. Keys that unlock consumers'
medical histories, bank accounts, and employee accounts have also been
compromised. Credit card numbers for 209,000 consumers were stolen, and
documents with personal information used in disputes for 182,000 people
were also stolen.

The attack on Equifax represents one of the largest risks to personally
sensitive information in recent years. This incident is the third major
cybersecurity threat for the agency since 2015. Just last year, identify
thieves successfully hacked critical W-2 tax and salary data from an
Equifax website. Earlier this year, thieves again stole W-2 tax data
from an Equifax subsidiary, TALX, which provides online payroll, tax and
human resources services to some of the nation's largest corporations.
According to investigations, criminals gained access to certain files in
the company's system from mid-May to July, 2017 by exploiting a weak
point in website software.

Identity thieves can impersonate people with lenders, creditors, and
service providers who rely on personal identity information. Thieves can
also use stored information from Equifax and use it to open accounts
with creditors that use Experian or TransUnion.  Cybersecurity profes-
sionals criticized Equifax for not improving its security practices
after previous thefts. Critics also argue that Equifax should have
multiple layers of controls. Consumers complained of a 6-week lag
between the discovery of the attack and Equifax's public disclosure.
Equifax discovered the intrusion on July 29th but it first disclosed the
attack publicly on September 7th.

There seems to be a broad sense of uncertainty by experts and lawmakers
as to which federal regulator, if any, is charged with the responsibil-
ity to monitor and do regular supervision on cybersecurity. The Consumer
Financial Protection Bureau has authority to police violations of
consumer protection laws by consumer credit bureaus, but the agency
generally leaves data privacy enforcement to the Federal Trade Commis-
sion. However, the Trade Commission lacks the authority to impose big
fines or authorize fines for first time violations of certain rules.
Neither have commented on applicable law or jurisdiction. Although
federal lawmakers have promised legislation and public hearings, no
clear authority is forthcoming in short order. Thus, it is time for New
York State to lead on this issue, given the fact that millions of our
residents were exposed in this episode.  
TO THIS END, THIS LEGISLATION
PROVIDES A CLEAR CONSUMER PROTECTION MANDATE THAT WILL AGGRESSIVELY
PROTECT THE CREDIT DATA, HISTORY AND REPORTS OF AFFECTED CONSUMERS,
POTENTIALLY SAVING THEM FROM ADVERSE ACTIONS AND DECISIONS.

 
LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS:

None noted for the state; the design of the legislation could signif-
icant save money for consumers.

 
EFFECTIVE DATE:
This act shall take effect immediately.