Senate Bill S6890

                                
 
BILL NUMBER: S6890

SPONSOR: CARLUCCI
 
TITLE OF BILL:

An act to amend the general business law, in relation to private infor-
mation

 
PURPOSE:

Expands the definition of private information the disclosure of which
will trigger a statutory data breach.

 
SUMMARY OF PROVISIONS:

Section 1 - Expands the definition of "personal information" to include
birthdates, home addresses, and phone numbers. Removes the requirement
that a password be disclosed to be considered a breach when debit card,
credit card, or bank account numbers are involved.

Section 2 - Effective date.
              

 
EXISTING LAW:

Currently, the definition of private information that when leaked would
constitute a data breach under state law includes social security
numbers, driver's license numbers, and debit card, credit card, and bank
account numbers(but for the last three, only when disclosed along with a
password or security code).

 
JUSTIFICATION:

Recent headlines have been dominated by a massive data breach that
impacted the largest credit-reporting firm in the United States. This
breach is estimated to have effected 143 million Americans, or 44% of
the population. Millions suddenly found that their birthdates, home
addresses, telephone numbers, and, in some cases, even their social
security numbers and drivers license numbers had been leaked.

The implications of such a large scale and egregious breach of consumer
data security are serious. Millions have been exposed to the possibility
of becoming victims of identity theft. This can lead to ongoing credit
problems and major costs to consumers to remedy the damage done. We must
do more to make sure that data breaches are prevented. But just as
important, is making sure consumers and law enforcement have the tools
available to mitigate damage as soon as a breach occurs. This bill, part
of a larger package that will target consumer data breaches at every
stage, will provide one of those tools.

This bill will help to ensure breach protocols apply to leaks of birth-
dates, home addresses, and telephone numbers (all of which were
disclosed without authorization in the recent major breach described
above). Additionally, it will ensure that disclosures of debit card,
credit card, and bank account numbers alone are sufficient to trigger
breach protocols. All of this information is enough for hackers and
other criminals to do harm given modern technology. Therefore, every-
thing possible should be done to mitigate the harmful effects of the
disclosure of these types of data.

The reality is that consumers do not seek out credit reporting firms
looking to provide them with their confidential personal information.
These companies are given that information by other firms looking to run
credit reports. This is not right. It should be the consumer who has the
final say over whether or not their data is available and who may
possess it. Furthermore, this should be a right the consumer has, and
not a privilege for which they must pay. This bill puts that power back
in the hands of the consumer.

 
LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

None to the state.

 
EFFECTIVE DATE:
Immediately.