S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   9780
 
                           I N  A S S E M B L Y
 
                             February 7, 2018
                                ___________
 
 Introduced by M. of A. PAULIN -- read once and referred to the Committee
   on Governmental Operations
 
 AN  ACT to amend the state law and the state technology law, in relation
   to enacting the "personal information protection act"
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section  1.  Short title.  This act shall be known and may be cited as
 the "personal information protection act".
   § 2. The state law is amended by adding a new article 3-A to  read  as
 follows:
                                ARTICLE 3-A
                    PERSONAL INFORMATION BILL OF RIGHTS
 SECTION 45. LEGISLATIVE FINDINGS AND DETERMINATIONS.
         46. PERSONAL INFORMATION BILL OF RIGHTS.
         47. PUBLICATION  AND POSTING OF THE PERSONAL INFORMATION BILL OF
               RIGHTS.
   § 45. LEGISLATIVE FINDINGS AND DETERMINATIONS.  THE LEGISLATURE  FINDS
 AND DETERMINES THAT THE UNAUTHORIZED ACCESS TO, AND THE THEFT AND MISAP-
 PROPRIATION  OF,  PERSONAL INFORMATION CAN CAUSE SERIOUS AND SIGNIFICANT
 HARM.  THE LEGISLATURE FURTHER FINDS AND DETERMINES THAT IN  AN  ATTEMPT
 TO  PROVIDE SOME LEVEL OF PROTECTION AGAINST THE UNAUTHORIZED ACCESS TO,
 AND THE THEFT AND MISAPPROPRIATION, OF SUCH  PERSONAL  INFORMATION,  ALL
 PERSONS  OR  ENTITIES WHO COLLECT AND MAINTAIN SUCH PERSONAL INFORMATION
 SHOULD BE REQUIRED TO  FOLLOW  CERTAIN  MINIMUM  SAFEGUARDS,  PROTOCOLS,
 STANDARDS  AND  BEST PRACTICES.   THE LEGISLATURE ADDITIONALLY FINDS AND
 DETERMINES THAT THE MINIMUM SAFEGUARDS, PROTOCOLS,  STANDARDS  AND  BEST
 PRACTICES  ESTABLISHED BY THIS ARTICLE SEEK TO PROMOTE THE PROTECTION OF
 PERSONAL INFORMATION CONTAINED IN BOTH PAPER AND ELECTRONIC RECORDS, AND
 THAT THE OBJECTIVES OF THIS ARTICLE ARE  TO  PROMOTE  THE  SECURITY  AND
 CONFIDENTIALITY  OF  PERSONAL  INFORMATION  IN A MANNER FULLY CONSISTENT
 WITH CUSTOMARILY ACCEPTED  SAFEGUARDS,  STANDARDS,  PROTOCOLS  AND  BEST
 PRACTICES;  PROTECT  AGAINST  UNAUTHORIZED ACCESS, THREATS OR HAZARDS TO
 THE SECURITY OR INTEGRITY OF SUCH INFORMATION AS BEST AS CAN  BE  ANTIC-
 IPATED;  AND PROTECT AGAINST UNAUTHORIZED ACCESS TO, OR THE UNAUTHORIZED
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
              

                       [ ] is old law to be omitted.
                                                            LBD14238-03-8

 A. 9780                             2
 
 USE OF, SUCH INFORMATION THAT MAY  RESULT  IN  SERIOUS,  SIGNIFICANT  OR
 SUBSTANTIAL  HARM  OR INCONVENIENCE.  THE LEGISLATURE ADDITIONALLY FINDS
 AND DETERMINES THAT TO PROMOTE IMPROVED PROTECTION OF PERSONAL  INFORMA-
 TION THE STATE TECHNOLOGY LAW SHOULD BE AMENDED TO ESTABLISH SAFEGUARDS,
 STANDARDS,  PROTOCOLS  AND BEST PRACTICES FOR THE PROTECTION OF PERSONAL
 INFORMATION BY PUBLIC AND PRIVATE ENTITIES, AND THIS CHAPTER  SHOULD  BE
 AMENDED  TO  ESTABLISH  A PERSONAL INFORMATION BILL OF RIGHTS, WITH SUCH
 BEING PUBLISHED AND POSTED BY THE OFFICE OF GENERAL SERVICES.
   § 46. PERSONAL INFORMATION BILL OF RIGHTS.   THE  STATE  OF  NEW  YORK
 HEREBY ESTABLISHES A PERSONAL INFORMATION BILL OF RIGHTS, TO DECLARE THE
 RIGHT  OF  ALL  NEW YORKERS TO HAVE THEIR PERSONAL INFORMATION, SUCH AS,
 BUT NOT LIMITED  TO,  PERSONAL  IDENTIFYING  INFORMATION,  PROTECTED  AS
 FOLLOWS:
   1.  THAT  ALL PERSONS OR ENTITIES THAT RECEIVE AND MAINTAIN CUSTODY OF
 PERSONAL INFORMATION SHALL HAVE A LEGAL DUTY TO PROTECT SUCH INFORMATION
 FROM UNAUTHORIZED ACCESS AND/OR UNAUTHORIZED USE.
   2. THAT ALL PERSONS OR ENTITIES THAT RECEIVE AND MAINTAIN  CUSTODY  OF
 PERSONAL  INFORMATION, IN ORDER TO PROTECT THE PERSONAL INFORMATION OVER
 WHICH THEY MAINTAIN CUSTODY, SHALL ESTABLISH  A  COMPREHENSIVE  SECURITY
 PROGRAM, WITH SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES.
   3.  THAT  THE  OFFICE  OF INFORMATION TECHNOLOGY SERVICES, IN ORDER TO
 FACILITATE THE ESTABLISHMENT OF QUALITY COMPREHENSIVE SECURITY PROGRAMS,
 SHALL DESIGN, PRODUCE AND PUBLISH MODEL COMPREHENSIVE SECURITY PROGRAMS,
 WITH SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES, TO PROVIDE FOR
 THE PROTECTION OF PERSONAL INFORMATION HELD  BY  PERSONS  AND  ENTITIES,
 WITH  SUCH  MODEL  PROGRAMS  TAILORED  TO THE SIZE AND SCOPE OF ALL SUCH
 PERSONS OR ENTITIES.
   4. THAT THE OFFICE OF INFORMATION TECHNOLOGY  SERVICES  SHALL  FURTHER
 APPROVE  THE  COMPREHENSIVE  SECURITY  PROGRAM  OF ALL AGENCIES OF STATE
 GOVERNMENT, AND  ALL  REGULATORY  AGENCIES  OF  STATE  GOVERNMENT  SHALL
 APPROVE  THE  COMPREHENSIVE SECURITY PROGRAM OF EACH OF THEIR RESPECTIVE
 REGULATED ENTITIES.
   5. THAT THE OFFICE OF  INFORMATION  TECHNOLOGY  SERVICES  SHALL  ADDI-
 TIONALLY  INCORPORATE  COMPUTER  SYSTEM SECURITY REQUIREMENTS WITHIN ITS
 MODEL COMPREHENSIVE SECURITY PROGRAMS,  AND  SHALL  REQUIRE  SUCH  SAFE-
 GUARDS,  STANDARDS,  PROTOCOLS  AND BEST PRACTICES TO BE INCLUDED WITHIN
 ALL APPROVED SECURITY PROGRAMS.
   6. THAT ALL PERSONS AND ENTITIES THAT RECEIVE AND MAINTAIN CUSTODY  OF
 PERSONAL  INFORMATION  SHALL HAVE A LEGAL DUTY TO NOTIFY THE DIVISION OF
 STATE POLICE WITHIN TEN DAYS OF THEIR DISCOVERY OF ANY BREACH OF SECURI-
 TY OF THE PERSONAL INFORMATION UNDER THEIR CUSTODY, AND ALL PERSONS  AND
 ENTITIES  THAT ARE REQUIRED TO HAVE THEIR COMPREHENSIVE SECURITY PROGRAM
 APPROVED, SHALL HAVE A LEGAL DUTY TO ALSO NOTIFY  THE  APPROVING  ENTITY
 WITHIN  FIVE  DAYS  OF  THEIR DISCOVERY OF ANY BREACH OF SECURITY OF THE
 PERSONAL INFORMATION UNDER THEIR CUSTODY.
   7. THAT IN THE EVENT A SECURITY  BREACH  OF  PERSONAL  INFORMATION  IS
 DISCOVERED  THAT  WILL  ADVERSELY IMPACT A PERSONAL INFORMATION SUBJECT,
 THE PERSON OR ENTITY THAT MAINTAINED CUSTODY OF SUCH  PERSONAL  INFORMA-
 TION  SHALL  FURTHER BE REQUIRED TO NOTIFY ALL SUCH PERSONAL INFORMATION
 SUBJECTS OF THE FACT THAT THERE HAS BEEN A BREACH OF SECURITY  INVOLVING
 THEIR PERSONAL INFORMATION.
   8.  THAT  IN  THE  EVENT  A SECURITY BREACH OF PERSONAL INFORMATION IS
 DISCOVERED THAT WILL ADVERSELY IMPACT A  PERSONAL  INFORMATION  SUBJECT,
 AND THE PERSON OR ENTITY THAT MAINTAINED CUSTODY OF SUCH PERSONAL INFOR-
 MATION  DID  NOT ESTABLISH OR MAINTAIN A COMPREHENSIVE SECURITY PROGRAM,
 OR DID NOT SUBSTANTIALLY FOLLOW  THE  SAFEGUARDS,  STANDARDS,  PROTOCOLS

 A. 9780                             3
 
 AND/OR  BEST  PRACTICES CONTAINED WITHIN SUCH PROGRAM, THEN THE PERSONAL
 INFORMATION SUBJECT SHALL BE ENTITLED TO BRING AN  ACTION  AGAINST,  AND
 MAINTAIN  A  RECOVERY FROM, THE PERSON OR ENTITY THAT MAINTAINED CUSTODY
 OF  SUCH  PERSONAL  INFORMATION,  TOGETHER WITH COSTS, DISBURSEMENTS AND
 ATTORNEY FEES.
   9. THAT IN THE EVENT A SECURITY  BREACH  OF  PERSONAL  INFORMATION  IS
 DISCOVERED  THAT  WILL  ADVERSELY IMPACT A PERSONAL INFORMATION SUBJECT,
 AND THE PERSON OR ENTITY THAT MAINTAINED CUSTODY OF SUCH PERSONAL INFOR-
 MATION DID ESTABLISH AND SUBSTANTIALLY MAINTAIN A COMPREHENSIVE SECURITY
 PROGRAM, AND DID SUBSTANTIALLY FOLLOW THE SAFEGUARDS, STANDARDS,  PROTO-
 COLS  AND  BEST PRACTICES CONTAINED WITHIN SUCH PROGRAM, THEN THE PERSON
 OR ENTITY THAT MAINTAINED CUSTODY OF SUCH PERSONAL INFORMATION SHALL  BE
 ENTITLED  TO A DEFENSE AGAINST ANY ACTION BROUGHT BY A PERSONAL INFORMA-
 TION SUBJECT.
   10. THAT TO FURTHER PROTECT THE SECURITY OF PERSONAL INFORMATION,  THE
 OFFICE  OF  INFORMATION  TECHNOLOGY SERVICES SHALL FURTHER ESTABLISH AND
 MAINTAIN AN INFORMATION SHARING AND ANALYSIS PROGRAM,  TO  INCREASE  THE
 VOLUME,  TIMELINESS, AND QUALITY OF CYBER THREAT INFORMATION SHARED WITH
 STATE PUBLIC AND PRIVATE SECTOR ENTITIES  SO  THAT  THESE  ENTITIES  MAY
 BETTER  PROTECT  AND  DEFEND  THEMSELVES  AGAINST  CYBER  THREATS AND TO
 PROMOTE THE DEVELOPMENT OF EFFECTIVE DEFENSES AND STRATEGIES TO  COMBAT,
 AND  PROTECT  AGAINST,  CYBER  THREATS  AND  ATTACKS, AND THEREBY BETTER
 PROTECT PERSONAL INFORMATION  STORED  AND/OR  MAINTAINED  IN  ELECTRONIC
 FORMAT.
   §  47.  PUBLICATION  AND  POSTING  OF THE PERSONAL INFORMATION BILL OF
 RIGHTS.  THE OFFICE OF GENERAL SERVICES SHALL  PUBLISH  AND  PROMINENTLY
 POST  IN  ALL  STATE OFFICES, A COPY OF THE PERSONAL INFORMATION BILL OF
 RIGHTS ESTABLISHED IN THIS ARTICLE. IT SHALL FURTHER PRINT AND PRODUCE A
 PAMPHLET ON SUCH PERSONAL INFORMATION BILL OF  RIGHTS  FOR  DISTRIBUTION
 ACROSS THE STATE. THE OFFICE OF GENERAL SERVICES MAY SELL ADVERTISING TO
 BE  INCLUDED  ON  SUCH PAMPHLET TO REDUCE THE COST OF THE PRODUCTION AND
 DISTRIBUTION OF THE SAME.
   § 3. The state technology law is amended by adding a new article 4  to
 read as follows:
                                ARTICLE IV
            SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES
                FOR THE PROTECTION OF PERSONAL INFORMATION
 SECTION 401. DEFINITION OF TERMS.
         402. DUTY TO PROTECT PERSONAL INFORMATION.
         403. COMPREHENSIVE   SECURITY   PROGRAM  SAFEGUARDS,  STANDARDS,
                PROTOCOLS AND BEST PRACTICES.
         404. DEVELOPMENT  OF  SECURITY  PROGRAM  SAFEGUARDS,  STANDARDS,
                PROTOCOLS AND BEST PRACTICES.
         405. APPROVAL OF COMPREHENSIVE SECURITY PROGRAMS.
         406. COMPUTER SYSTEM SECURITY REQUIREMENTS.
         407. BREACH OF SECURITY.
         408. CAUSES OF ACTION.
         409. LIABILITY PROTECTION.
         410. INFORMATION SHARING AND ANALYSIS PROGRAM.
   §  401. DEFINITIONS OF TERMS. THE FOLLOWING DEFINITIONS ARE APPLICABLE
 TO THIS ARTICLE, EXCEPT WHERE DIFFERENT MEANINGS  ARE  EXPRESSLY  SPECI-
 FIED:
   1. "PERSONAL INFORMATION SUBJECT" MEANS ANY NATURAL PERSON WHO HAS HIS
 OR HER PERSONAL INFORMATION COLLECTED OR MAINTAINED BY A PERSONAL INFOR-
 MATION RECIPIENT.

 A. 9780                             4

   2.  "PERSONAL  INFORMATION RECIPIENT" MEANS ANY NATURAL PERSON, CORPO-
 RATION, PARTNERSHIP, LIMITED LIABILITY COMPANY,  UNINCORPORATED  ASSOCI-
 ATION,  GOVERNMENT,  OR  OTHER  ENTITY,  THAT,  IN  THE  COURSE OF THEIR
 PERSONAL, BUSINESS, COMMERCIAL, CORPORATE, ASSOCIATION  OR  GOVERNMENTAL
 OPERATIONS,  COLLECTS, RECEIVES, STORES, MAINTAINS, PROCESSES, OR OTHER-
 WISE HAS ACCESS TO, PERSONAL INFORMATION.
   3. "PERSONAL INFORMATION COLLECTOR"  MEANS  ANY  PERSONAL  INFORMATION
 RECIPIENT, THAT DOES NOT MAINTAIN OR STORE SUCH PERSONAL INFORMATION, OR
 MAINTAIN  ACCESS  TO  SUCH  PERSONAL  INFORMATION,  FOR  MORE  THAN FIVE
 MINUTES, AND WAS PROVIDED WITH THE PERSONAL INFORMATION BY THE  PERSONAL
 INFORMATION SUBJECT.
   4. "PERSONAL INFORMATION HOLDER" MEANS ANY PERSONAL INFORMATION RECIP-
 IENT,  THAT  MAINTAINS OR STORES SUCH PERSONAL INFORMATION, OR MAINTAINS
 ACCESS TO SUCH PERSONAL INFORMATION, FOR MORE THAN FIVE MINUTES, AND WAS
 PROVIDED WITH THE  PERSONAL  INFORMATION  BY  THE  PERSONAL  INFORMATION
 SUBJECT.
   5. "THIRD PARTY PERSONAL INFORMATION HOLDER" MEANS ANY PERSONAL INFOR-
 MATION  RECIPIENT,  THAT  AGREES  TO  COLLECT, RECEIVE, STORE, MAINTAIN,
 PROCESS, OR OTHERWISE HAVE ACCESS  TO,  PERSONAL  INFORMATION,  AND  WAS
 PROVIDED  WITH  SUCH  PERSONAL  INFORMATION  FROM A PERSONAL INFORMATION
 COLLECTOR,  A  PERSONAL  INFORMATION  HOLDER,  OR  ANOTHER  THIRD  PARTY
 PERSONAL INFORMATION HOLDER.
   6.  "PERSONAL INFORMATION" (A) MEANS ANY INFORMATION, INCLUDING PAPER-
 BASED INFORMATION OR ELECTRONIC INFORMATION, THAT CONTAINS  A  NEW  YORK
 STATE  RESIDENT'S  FIRST  NAME  AND LAST NAME, OR A NEW YORK STATE RESI-
 DENT'S FIRST INITIAL AND LAST NAME, IN COMBINATION WITH ANY ONE OR  MORE
 OF  THE FOLLOWING OTHER INFORMATIONAL ELEMENTS THAT RELATE TO SUCH RESI-
 DENT:
   (1) A GOVERNMENTALLY ISSUED IDENTIFICATION NUMBER, INCLUDING:
   (I) SOCIAL SECURITY NUMBER;
   (II) DRIVER'S LICENSE NUMBER;
   (III) STATE ISSUED IDENTIFICATION CARD NUMBER;
   (IV) MILITARY IDENTIFICATION CARD NUMBER;
   (V) STUDENT IDENTIFICATION NUMBER; OR
   (VI) A UNITED STATES PASSPORT NUMBER;
   (2) PERSONAL FINANCIAL INFORMATION, INCLUDING:
   (I) FINANCIAL ACCOUNT INFORMATION, INCLUDING:
   (A) BANK ACCOUNT INFORMATION;
   (B) INVESTMENT ACCOUNT INFORMATION;
   (C) RETIREMENT ACCOUNT INFORMATION;
   (D) DEFERRED COMPENSATION ACCOUNT INFORMATION;
   (E) MORTGAGE ACCOUNT INFORMATION;
   (F) CAR LOAN ACCOUNT INFORMATION;
   (G) CREDIT LINE ACCOUNT INFORMATION;
   (H) PERSONAL LOAN ACCOUNT INFORMATION; OR
   (I) ANY OTHER MONETARY FUND OR LOAN ACCOUNT INFORMATION; INCLUDING:
   (I) THE NUMBER OF SUCH FINANCIAL ACCOUNT;
   (II) ANY RECORD OF SUCH FINANCIAL ACCOUNT;
   (III) A TRANSACTION HISTORY OF SUCH ACCOUNT;
   (IV) A BALANCE OF SUCH ACCOUNT; AND/OR
   (V) ANY SECURITY CODE, ACCESS CODE, PERSONAL IDENTIFICATION NUMBER  OR
 PASSWORD,  THAT  WOULD  PERMIT  ACCESS  TO,  OR  USE  OF, SUCH FINANCIAL
 ACCOUNT;
   (II) CREDIT OR DEBIT CARD INFORMATION, INCLUDING:
   (A) THE NUMBER OF SUCH CREDIT CARD OR DEBIT CARD;
   (B) THE EXPIRATION DATE OF SUCH CREDIT OR DEBIT CARD;

 A. 9780                             5
 
   (C) THE CARD VERIFICATION VALUE CODE NUMBER OF SUCH  CREDIT  OR  DEBIT
 CARD;
   (D) ANY RECORD OF SUCH CREDIT OR DEBIT CARD ACCOUNT;
   (E) ANY TRANSACTION HISTORY OF SUCH CREDIT OR DEBIT CARD;
   (F) ANY BALANCE OF SUCH CREDIT OR DEBIT CARD; AND/OR
   (G)  ANY  REQUIRED SECURITY CODE, ACCESS CODE, PERSONAL IDENTIFICATION
 NUMBER OR PASSWORD, THAT WOULD PERMIT ACCESS TO, OR USE OF, SUCH  CREDIT
 OR DEBIT CARD; OR
   (III) CREDIT STATUS INFORMATION, INCLUDING:
   (A) CREDIT SCORE;
   (B) CREDIT HISTORY; OR
   (C)  ANY  INFORMATION  DESCRIBING  CREDIT TRANSACTIONS OF THE PERSONAL
 INFORMATION SUBJECT;
   (3) PHYSICAL CHARACTERISTIC INFORMATION, INCLUDING:
   (I) THE HEIGHT OF THE PERSONAL INFORMATION SUBJECT;
   (II) THE WEIGHT OF THE PERSONAL INFORMATION SUBJECT;
   (III) THE HAIR COLOR OF THE PERSONAL INFORMATION SUBJECT;
   (IV) THE EYE COLOR OF THE PERSONAL INFORMATION SUBJECT; AND/OR
   (V) ANY OTHER DISTINGUISHING CHARACTERISTICS OF THE PERSONAL  INFORMA-
 TION SUBJECT;
   (4) BIOMETRIC INFORMATION, INCLUDING:
   (I) FINGERPRINTS OF THE PERSONAL INFORMATION SUBJECT;
   (II) VOICE-PRINTS OF THE PERSONAL INFORMATION SUBJECT;
   (III) EYE SCANS OF THE PERSONAL INFORMATION SUBJECT;
   (IV) BLOOD SAMPLES OF THE PERSONAL INFORMATION SUBJECT;
   (V) DEOXYRIBONUCLEIC ACID (DNA) BASED SAMPLES OF THE PERSONAL INFORMA-
 TION SUBJECT;
   (VI) SKIN SAMPLES OF THE PERSONAL INFORMATION SUBJECT;
   (VII) HAIR SAMPLES OF THE PERSONAL INFORMATION SUBJECT; AND/OR
   (VIII)  ANY OTHER BIOMETRIC INFORMATION WHICH IS INTENDED OR COLLECTED
 FOR THE PURPOSE OF IDENTIFICATION OF THE PERSONAL  INFORMATION  SUBJECT;
 OR
   (5) MEDICAL INFORMATION, INCLUDING BUT NOT LIMITED TO, ANY INFORMATION
 COLLECTED OR MAINTAINED ABOUT A PERSONAL INFORMATION SUBJECT PURSUANT TO
 EXAMINATION,  TESTING  OR  TREATMENT  FOR  PHYSICAL OR MENTAL ILLNESS OR
 WELLNESS, OR ANY OTHER INFORMATION COLLECTED OR MAINTAINED ON A PERSONAL
 INFORMATION SUBJECT BY A HEALTH CARE PROVIDER OR HEALTH CARE INSURER;
   (B) SHALL NOT INCLUDE:
   (1) PERSONAL INFORMATION  THAT  IS  LAWFULLY  OBTAINED  FROM  PUBLICLY
 AVAILABLE  INFORMATION,  OR  FROM  FEDERAL,  STATE  OR  LOCAL GOVERNMENT
 RECORDS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC; OR
   (2) PAPER-BASED INFORMATION THAT HAS BEEN INTENTIONALLY  DISCARDED  OR
 ABANDONED BY THE PERSONAL INFORMATION SUBJECT.
   7. "BREACH OF SECURITY" MEANS THE UNAUTHORIZED ACCESS, VIEWING, ACQUI-
 SITION,  COPYING,  DUPLICATION,  REMOVAL  OR  ANY  OTHER USE OF PERSONAL
 INFORMATION, EITHER IN UNENCRYPTED FORM OR IN  ENCRYPTED  FORM  TOGETHER
 WITH THE CONFIDENTIAL PROCESS OR KEY THAT IS CAPABLE OF COMPROMISING THE
 SECURITY,  CONFIDENTIALITY, OR INTEGRITY OF PERSONAL INFORMATION. A GOOD
 FAITH UNAUTHORIZED ACCESS, VIEWING OR ACQUISITION OF  PERSONAL  INFORMA-
 TION, FOR THE LAWFUL PURPOSES OF A PERSONAL INFORMATION COLLECTOR, SHALL
 NOT BE DEEMED TO BE A BREACH OF SECURITY UNLESS THE PERSONAL INFORMATION
 IS  THEREAFTER  USED  IN AN UNAUTHORIZED MANNER OR IS SUBJECT TO FURTHER
 UNAUTHORIZED DISCLOSURE, AS A RESULT OF  SUCH  GOOD  FAITH  UNAUTHORIZED
 ACCESS OR ACQUISITION.

 A. 9780                             6

   8.  "RECORD"  MEANS ANY INFORMATION UPON WHICH WRITTEN, DRAWN, SPOKEN,
 VISUAL, OR ELECTROMAGNETIC DATA OR IMAGES  ARE  RECORDED  OR  PRESERVED,
 EITHER AS PAPER-BASED INFORMATION OR ELECTRONIC INFORMATION.
   9.  "PAPER-BASED  INFORMATION" MEANS PERSONAL INFORMATION COLLECTED OR
 MAINTAINED VIA PAPER, WRITING OR OTHER  DRAWING  MEDIUM,  OR  ANY  OTHER
 PHYSICAL BASED, TANGIBLE, RECORDING MEDIUM.
   10.  "ELECTRONIC  INFORMATION" MEANS PERSONAL INFORMATION COLLECTED OR
 MAINTAINED VIA COMPUTER, TELEPHONE, INTERNET, COMPUTER NETWORK OR  OTHER
 ELECTRICAL,  DIGITAL,  MAGNETIC,  WIRELESS,  OPTICAL, ELECTROMAGNETIC OR
 SIMILAR DEVICE.
   11. "ENCRYPTION" MEANS THE TRANSFORMATION OF DATA INTO A FORM IN WHICH
 THE MEANING OF SUCH DATA CANNOT BE ACCESSED WITHOUT THE USE OF A  CONFI-
 DENTIAL PROCESS OR KEY.
   12. "OFFICE" MEANS THE OFFICE OF INFORMATION TECHNOLOGY SERVICES.
   §  402.  DUTY TO PROTECT PERSONAL INFORMATION. EVERY PERSONAL INFORMA-
 TION RECIPIENT SHALL HAVE A LEGAL  DUTY  TO  PROTECT  THE  SECURITY  AND
 INTEGRITY OF ALL PERSONAL INFORMATION IN THEIR CUSTODY FROM UNAUTHORIZED
 ACCESS OR UNAUTHORIZED USE.
   § 403. COMPREHENSIVE SECURITY PROGRAM SAFEGUARDS, STANDARDS, PROTOCOLS
 AND  BEST  PRACTICES.  1.  COMPREHENSIVE  SECURITY PROGRAMS FOR PERSONAL
 INFORMATION  RECIPIENTS.  EVERY  PERSONAL  INFORMATION  RECIPIENT  SHALL
 DEVELOP,  IMPLEMENT,  AND  MAINTAIN A COMPREHENSIVE PERSONAL INFORMATION
 SECURITY PROGRAM THAT IS WRITTEN  IN  ONE  OR  MORE  READILY  ACCESSIBLE
 PARTS,  AND CONTAINS ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS,
 STANDARDS, PROTOCOLS AND BEST PRACTICES DETAILING THE MEANS, METHODS AND
 PRACTICES TO BE USED  REGARDING  THE  PERSONAL  INFORMATION  RECIPIENT'S
 OBLIGATIONS  TO  SAFEGUARD,  PROTECT AND SECURE THE PERSONAL INFORMATION
 UNDER SUCH COMPREHENSIVE INFORMATION SECURITY PROGRAM, APPROPRIATE TO:
   (A) THE SIZE, SCOPE AND TYPE OF THE  PERSONAL,  BUSINESS,  COMMERCIAL,
 CORPORATE,  ASSOCIATION OR GOVERNMENTAL OPERATION OF THE PERSONAL INFOR-
 MATION RECIPIENT;
   (B) THE AMOUNT OF VOLUNTEERS,  EMPLOYEES  AND/OR  FINANCIAL  RESOURCES
 AVAILABLE TO SUCH PERSONAL INFORMATION RECIPIENT;
   (C)  THE AMOUNT OF PERSONAL INFORMATION IN THE CUSTODY OF THE PERSONAL
 INFORMATION RECIPIENT; AND
   (D) THE NEED FOR SECURITY AND CONFIDENTIALITY OF THE PERSONAL INFORMA-
 TION.
   2. SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES FOR  PROTECTION
 OF  PERSONAL  INFORMATION. THE SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST
 PRACTICES CONTAINED IN THE COMPREHENSIVE PERSONAL  INFORMATION  SECURITY
 PROGRAM  REQUIRED  BY  THIS  SECTION  SHALL BE CONSISTENT WITH THE SAFE-
 GUARDS, STANDARDS,  PROTOCOLS  AND  BEST  PRACTICES  FOR  PROTECTION  OF
 PERSONAL  INFORMATION, CONTAINED WITHIN THE MODEL COMPREHENSIVE SECURITY
 PROGRAMS PUBLISHED BY THE OFFICE IN ACCORDANCE WITH SECTION FOUR HUNDRED
 FOUR OF THIS ARTICLE, OR AS SET FORTH IN  ANY  STATE  OR  FEDERAL  REGU-
 LATIONS  PRODUCED  BY  AN  EXECUTIVE  AGENCY  UNDER  WHICH THE HOLDER OF
 PERSONAL INFORMATION MAY BE REGULATED.
   3. COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAMS MAY  BE  INDI-
 VIDUALLY TAILORED.  THE REQUIREMENT SET FORTH IN SUBDIVISION TWO OF THIS
 SECTION,  THAT  THE  SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES
 CONTAINED IN THE COMPREHENSIVE  PERSONAL  INFORMATION  SECURITY  PROGRAM
 SHALL  BE  CONSISTENT WITH THE SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST
 PRACTICES FOR PROTECTION OF PERSONAL INFORMATION  CONTAINED  WITHIN  THE
 MODEL COMPREHENSIVE SECURITY PROGRAMS PUBLISHED BY THE OFFICE IN ACCORD-
 ANCE  WITH  SECTION FOUR HUNDRED FOUR OF THIS ARTICLE, SHALL NOT REQUIRE
 THAT THE PERSONAL INFORMATION RECIPIENT MUST ADOPT A MODEL COMPREHENSIVE

 A. 9780                             7
 
 PERSONAL INFORMATION SECURITY PROGRAM PUBLISHED BY THE OFFICE  IN  ORDER
 TO  DEVELOP, IMPLEMENT AND MAINTAIN A COMPREHENSIVE PERSONAL INFORMATION
 SECURITY PROGRAM THAT IS IN COMPLIANCE WITH THIS ARTICLE.  ANY  INDIVID-
 UALLY  TAILORED COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM THAT
 PROVIDES BETTER OR EQUAL SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRAC-
 TICES FOR PROTECTION OF PERSONAL INFORMATION THAN A MODEL  COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM PUBLISHED BY THE OFFICE IN ACCORD-
 ANCE  WITH  SECTION  FOUR  HUNDRED FOUR OF THIS ARTICLE, FOR A PERSON OR
 ENTITY OF EQUIVALENT SIZE AND SCOPE AS THE PERSON OR ENTITY  SEEKING  TO
 DEVELOP,  IMPLEMENT  OR  MAINTAIN AN INDIVIDUALLY TAILORED COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM, SHALL  BE  DEEMED  IN  COMPLIANCE
 WITH THIS ARTICLE.
   4.  INDIVIDUALLY  TAILORED COMPREHENSIVE PERSONAL INFORMATION SECURITY
 PROGRAMS.  ANY PERSONAL INFORMATION RECIPIENT THAT  WISHES  TO  DEVELOP,
 IMPLEMENT  AND  MAINTAIN AN INDIVIDUALLY TAILORED COMPREHENSIVE PERSONAL
 INFORMATION SECURITY PROGRAM THAT IS NOT A MODEL COMPREHENSIVE  PERSONAL
 INFORMATION  SECURITY  PROGRAM PUBLISHED BY THE OFFICE, MAY SUBMIT THEIR
 INDIVIDUALLY TAILORED PROGRAM TO THE OFFICE FOR  A  SECURITY  REVIEW  TO
 DETERMINE,  AND  OBTAIN APPROVAL FROM THE OFFICE, THAT SUCH INDIVIDUALLY
 TAILORED PROGRAM PROVIDES BETTER OR EQUAL SAFEGUARDS, STANDARDS,  PROTO-
 COLS  AND  BEST PRACTICES FOR PROTECTION OF PERSONAL INFORMATION, THAN A
 MODEL COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM  PUBLISHED  BY
 THE  OFFICE  FOR  A PERSON OR ENTITY OF EQUIVALENT SIZE AND SCOPE OF THE
 PERSON OR ENTITY SEEKING TO DEVELOP, IMPLEMENT OR MAINTAIN THE  INDIVID-
 UALLY  TAILORED  COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM. IF
 THE OFFICE DETERMINES THAT SUCH INDIVIDUALLY TAILORED PROGRAM  SUBMITTED
 FOR  SECURITY  REVIEW AND APPROVAL DOES NOT PROVIDE SUCH BETTER OR EQUAL
 SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES  FOR  PROTECTION  OF
 PERSONAL  INFORMATION,  THE  OFFICE  SHALL  SPECIFY,  WITH DETAIL, THEIR
 REASONS FOR DENIAL OF APPROVAL OF SUCH PLAN, TOGETHER  WITH  RECOMMENDA-
 TIONS  ON  HOW  SUCH  PLAN  CAN BE AMENDED TO BE IN COMPLIANCE WITH THIS
 ARTICLE AND PROVIDE SUCH BETTER OR EQUAL SAFEGUARDS,  STANDARDS,  PROTO-
 COLS  AND  BEST PRACTICES FOR PROTECTION OF PERSONAL INFORMATION. IF THE
 OFFICE DOES NOT PROVIDE THE PERSON OR ENTITY THAT  HAS  SUBMITTED  THEIR
 INDIVIDUALLY  TAILORED PLAN FOR REVIEW AND APPROVAL, WITH AN APPROVAL OR
 SUCH DETAILED DENIAL OF APPROVAL  OF  THE  INDIVIDUALLY  TAILORED  PLAN,
 WITHIN  90  DAYS OF THE SUBMISSION, THEN SUCH INDIVIDUALLY TAILORED PLAN
 SHALL BE DEEMED APPROVED.
   5. FAILURE TO SUBMIT AN INDIVIDUALLY TAILORED  PROGRAM  FOR  APPROVAL.
 THE  FAILURE  OF  A  PERSON OR ENTITY TO SUBMIT AN INDIVIDUALLY TAILORED
 COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM TO THE OFFICE FOR  A
 SECURITY  REVIEW  AND  APPROVAL, AS PROVIDED BY SUBDIVISION FOUR OF THIS
 SECTION, SHALL NOT REQUIRE A  COURT  IN  ACCORDANCE  WITH  SECTION  FOUR
 HUNDRED  EIGHT  OR FOUR HUNDRED NINE OF THIS ARTICLE, TO DEEM SUCH INDI-
 VIDUALLY TAILORED PLAN AS NOT IN  COMPLIANCE  WITH  THIS  ARTICLE.  SUCH
 FAILURE,  SHALL  HOWEVER,  REQUIRE  THE  COURT TO DETERMINE WHETHER SUCH
 INDIVIDUALLY TAILORED PLAN IN QUESTION WAS ACTUALLY DESIGNED TO  PROVIDE
 BETTER  OR EQUAL SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRACTICES FOR
 PROTECTION OF PERSONAL INFORMATION THAN A MODEL  COMPREHENSIVE  PERSONAL
 INFORMATION  SECURITY  PROGRAM  PUBLISHED  BY THE OFFICE FOR A PERSON OR
 ENTITY OF EQUIVALENT SIZE AND SCOPE AS THE DEFENDANT, BEFORE SUCH  COURT
 WILL  GRANT  SUCH  DEFENDANT  THE LIABILITY PROTECTIONS CONTAINED WITHIN
 SECTION FOUR HUNDRED NINE OF THIS ARTICLE.
   § 404. DEVELOPMENT OF SECURITY PROGRAM SAFEGUARDS,  STANDARDS,  PROTO-
 COLS  AND  BEST PRACTICES.  1. THE OFFICE SHALL PUBLISH MODEL COMPREHEN-
 SIVE SECURITY PROGRAMS  CONTAINING  RECOMMENDED  STANDARDS,  SAFEGUARDS,

 A. 9780                             8
 
 PROTOCOLS  AND  BEST PRACTICES FOR PERSONAL INFORMATION RECIPIENTS. SUCH
 MODEL PLANS SHALL BE TAILORED IN CONSIDERATION OF THE FOLLOWING  FACTORS
 OF THE PERSONAL INFORMATION RECIPIENT:
   (A)  THE  SIZE,  SCOPE AND TYPE OF THE PERSONAL, BUSINESS, COMMERCIAL,
 CORPORATE, ASSOCIATION OR GOVERNMENTAL OPERATION OF THE PERSONAL  INFOR-
 MATION RECIPIENT;
   (B)  THE  AMOUNT  OF  VOLUNTEERS, EMPLOYEES AND/OR FINANCIAL RESOURCES
 AVAILABLE TO SUCH PERSONAL INFORMATION RECIPIENT;
   (C) THE AMOUNT OF PERSONAL INFORMATION IN THE CUSTODY OF THE  PERSONAL
 INFORMATION RECIPIENT; AND
   (D) THE NEED FOR SECURITY AND CONFIDENTIALITY OF THE PERSONAL INFORMA-
 TION.
   2. REQUIREMENTS FOR MODEL COMPREHENSIVE SECURITY PROGRAMS. EVERY MODEL
 COMPREHENSIVE  INFORMATION SECURITY PROGRAM SHALL INCLUDE, BUT SHALL NOT
 BE LIMITED TO:
   (A) DESIGNATING ONE OR MORE PERSONS, OR IN THE CASE OF A BUSINESS WITH
 ONE OR MORE EMPLOYEES, TO MAINTAIN THE COMPREHENSIVE INFORMATION SECURI-
 TY PROGRAM;
   (B) CLEARLY IDENTIFYING AND ASSESSING REASONABLY FORESEEABLE  INTERNAL
 AND EXTERNAL RISKS TO THE SECURITY, CONFIDENTIALITY, AND/OR INTEGRITY OF
 ANY  ELECTRONIC  INFORMATION,  PAPER-BASED  INFORMATION OR OTHER RECORDS
 CONTAINING PERSONAL INFORMATION, IN THE CUSTODY OF THE PERSONAL INFORMA-
 TION RECIPIENT, AND  EVALUATING  AND  IMPROVING,  WHERE  NECESSARY,  THE
 EFFECTIVENESS  OF  THE CURRENT SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST
 PRACTICES CONTAINED WITHIN THE COMPREHENSIVE PERSONAL INFORMATION  SECU-
 RITY PROGRAM FOR LIMITING SUCH RISKS, INCLUDING BUT NOT LIMITED TO:
   (1) ONGOING PERSONAL, VOLUNTEER, AND/OR EMPLOYEE TRAINING;
   (2)  PERSONAL, VOLUNTEER, AND/OR EMPLOYEE COMPLIANCE WITH POLICIES AND
 PROCEDURES;
   (3) THE MEANS FOR DETECTING  AND  PREVENTING  SECURITY  SYSTEM  RISKS;
 AND/OR
   (4) THE MEANS FOR DETECTING AND PREVENTING SECURITY SYSTEM FAILURES;
   (C)  DEVELOPING  SAFEGUARDS,  STANDARDS, PROTOCOLS, BEST PRACTICES AND
 SECURITY POLICIES FOR PERSONS, VOLUNTEERS AND/OR EMPLOYEES  RELATING  TO
 THE  STORAGE,  ACCESS  AND TRANSPORTATION OF RECORDS CONTAINING PERSONAL
 INFORMATION ON THE PREMISES AND IN THE SYSTEMS AND RECORD STORAGE OF THE
 PERSONAL INFORMATION RECIPIENT;
   (D) DEVELOPING SAFEGUARDS, STANDARDS, PROTOCOLS,  BEST  PRACTICES  AND
 SECURITY  POLICIES  FOR PERSONS, VOLUNTEERS AND/OR EMPLOYEES RELATING TO
 THE STORAGE, ACCESS AND TRANSPORTATION OF  RECORDS  CONTAINING  PERSONAL
 INFORMATION  OUTSIDE  THE  PREMISES,  SYSTEMS  OR  RECORD STORAGE OF THE
 PERSONAL INFORMATION RECIPIENT;
   (E) IMPOSING DISCIPLINARY MEASURES FOR VIOLATIONS OF THE COMPREHENSIVE
 INFORMATION SECURITY PROGRAM RULES;
   (F) PREVENTING DISASSOCIATED PERSONS OR VOLUNTEERS, AND/OR  FORMER  OR
 TERMINATED EMPLOYEES FROM ACCESSING RECORDS CONTAINING PERSONAL INFORMA-
 TION;
   (G) OVERSIGHT OF THIRD PARTY PERSONAL INFORMATION RECIPIENTS, BY:
   (1)  TAKING REASONABLE STEPS TO SELECT AND RETAIN THIRD PARTY PERSONAL
 INFORMATION RECIPIENTS THAT ARE CAPABLE OF MAINTAINING APPROPRIATE SECU-
 RITY MEASURES, SAFEGUARDS, STANDARDS, PROTOCOLS AND  BEST  PRACTICES  TO
 PROTECT  SUCH PERSONAL INFORMATION, CONSISTENT WITH THIS ARTICLE AND ANY
 OTHER APPLICABLE FEDERAL OR STATE STATUTES OR REGULATIONS; AND
   (2) REQUIRING SUCH THIRD PARTY INFORMATION RECIPIENTS BY  CONTRACT  TO
 IMPLEMENT  AND  MAINTAIN SUCH APPROPRIATE SECURITY MEASURES FOR PERSONAL
 INFORMATION;

 A. 9780                             9
 
   (H) REASONABLE RESTRICTIONS UPON PHYSICAL  ACCESS  TO  ANY  ELECTRONIC
 INFORMATION,   PAPER-BASED   INFORMATION  OR  OTHER  RECORDS  CONTAINING
 PERSONAL INFORMATION, AND STORAGE OF SUCH INFORMATION AND/OR RECORDS AND
 DATA IN LOCKED, SECURE, AND/OR PROTECTED FACILITIES,  STORAGE  AREAS  OR
 CONTAINERS;
   (I)  REGULAR  MONITORING  TO ENSURE THAT THE COMPREHENSIVE INFORMATION
 SECURITY PROGRAM IS OPERATING  IN  A  MANNER  REASONABLY  CALCULATED  TO
 PREVENT  UNAUTHORIZED ACCESS TO, OR UNAUTHORIZED USE OF, PERSONAL INFOR-
 MATION; AND UPGRADING INFORMATION SAFEGUARDS, STANDARDS,  PROTOCOLS  AND
 BEST PRACTICES AS NECESSARY TO LIMIT AND MINIMIZE SUCH RISKS;
   (J)  REVIEWING THE SCOPE OF THE SAFEGUARDS, STANDARDS, PROTOCOLS, BEST
 PRACTICES AND SECURITY MEASURES, NOT LESS THAN  QUARTERLY,  OR  WHENEVER
 THERE IS A MATERIAL CHANGE IN THE PERSONAL, BUSINESS, COMMERCIAL, CORPO-
 RATE,  ASSOCIATION  OR  GOVERNMENTAL OPERATION PRACTICES OF THE PERSONAL
 INFORMATION RECIPIENT THAT MAY REASONABLY EFFECT THE SECURITY OR  INTEG-
 RITY OF RECORDS CONTAINING PERSONAL INFORMATION;
   (K)  DOCUMENTING RESPONSIVE ACTIONS TO BE TAKEN IN CONNECTION WITH ANY
 INCIDENT INVOLVING A BREACH OF  SECURITY,  AND  MANDATORY  POST-INCIDENT
 REVIEW  OF  EVENTS  AND  ACTIONS  TAKEN,  IF ANY, TO MAKE CHANGES IN THE
 PERSONAL, BUSINESS, COMMERCIAL, CORPORATE, ASSOCIATION  OR  GOVERNMENTAL
 OPERATION  PRACTICES  OF THE PERSONAL INFORMATION RECIPIENT, RELATING TO
 PROTECTION OF PERSONAL INFORMATION; AND
   (L) DETAILING ALL PHYSICAL SECURITY, SAFEGUARDS, STANDARDS, PROTOCOLS,
 AND BEST PRACTICES, AS WELL AS ALL ENCRYPTION METHODS THAT WILL BE  USED
 BY THE PERSONAL INFORMATION RECIPIENT TO SAFEGUARD THE PERSONAL INFORMA-
 TION.
   §  405. APPROVAL OF COMPREHENSIVE SECURITY PROGRAMS.  ON OR BEFORE THE
 FIRST DAY OF APRIL, EVERY PERSONAL INFORMATION HOLDER  AND  EVERY  THIRD
 PARTY PERSONAL INFORMATION HOLDER, THAT IS A STATE GOVERNMENT AGENCY, OR
 A CONTRACTOR PAID BY STATE GOVERNMENT, SHALL ANNUALLY SUBMIT ITS COMPRE-
 HENSIVE  PERSONAL  INFORMATION  SECURITY  PROGRAM,  FOR  APPROVAL TO THE
 OFFICE.
   § 406. COMPUTER SYSTEM SECURITY  REQUIREMENTS.    1.  COMPUTER  SYSTEM
 SECURITY  PROGRAM.  EVERY  PERSONAL  INFORMATION  HOLDER  OR THIRD PARTY
 PERSONAL INFORMATION  HOLDER  WHO  ELECTRONICALLY  STORES  OR  TRANSMITS
 PERSONAL  INFORMATION SHALL INCLUDE IN ITS WRITTEN, COMPREHENSIVE INFOR-
 MATION SECURITY PROGRAM THE ESTABLISHMENT AND MAINTENANCE OF A  COMPUTER
 SECURITY  SYSTEM  PROGRAM  COVERING  ALL  OF  ITS  COMPUTERS, ELECTRONIC
 SYSTEMS AND/OR NETWORKS, INCLUDING ANY WIRELESS SYSTEM.
   2. MINIMUM STANDARDS  FOR  COMPUTER  SYSTEM  SECURITY  PROGRAM.  EVERY
 PERSONAL INFORMATION HOLDER WITH MORE THAN FIFTY EMPLOYEES, OR WITH MORE
 THAN  ONE  HUNDRED VOLUNTEERS, AND/OR WITH MORE THAN ONE MILLION DOLLARS
 IN ANNUAL REVENUE, SHALL ADDITIONALLY, ESTABLISH A COMPUTER SYSTEM SECU-
 RITY PROGRAM, THAT, AT A MINIMUM, AND TO THE EXTENT  TECHNICALLY  FEASI-
 BLE, HAS THE FOLLOWING ELEMENTS:
   (A) SECURE USER AUTHENTICATION PROTOCOLS INCLUDING:
   (1)  CONTROL OF USER IDS, USER NAMES, PASSWORDS AND OTHER UNIQUE IDEN-
 TIFIERS;
   (2) A REASONABLY SECURE METHOD OF ASSIGNING AND  SELECTING  PASSWORDS,
 OR  USE  OF  UNIQUE IDENTIFIER TECHNOLOGIES, SUCH AS BIOMETRICS OR TOKEN
 DEVICES;
   (3) CONTROL OF DATA SECURITY PASSWORDS TO ENSURE THAT  SUCH  PASSWORDS
 ARE  KEPT IN A LOCATION AND/OR FORMAT THAT DOES NOT COMPROMISE THE SECU-
 RITY OF THE DATA THEY PROTECT;
   (4) A PROGRAM OF RESTRICTING ACCESS TO ACTIVE USERS  AND  ACTIVE  USER
 ACCOUNTS ONLY; AND

 A. 9780                            10
 
   (5)  A REQUIREMENT TO BLOCK ACCESS TO USER IDENTIFICATION AFTER MULTI-
 PLE UNSUCCESSFUL ATTEMPTS TO GAIN ACCESS OR  THE  LIMITATION  PLACED  ON
 ACCESS FOR THE PARTICULAR SYSTEM;
   (B) SECURE ACCESS CONTROL MEASURES THAT:
   (1)  RESTRICT ACCESS TO RECORDS AND FILES CONTAINING PERSONAL INFORMA-
 TION TO THOSE WHO NEED SUCH INFORMATION TO PERFORM THEIR JOB DUTIES; AND
   (2) ASSIGN UNIQUE IDENTIFICATIONS PLUS PASSWORDS, WHICH ARE NOT VENDOR
 SUPPLIED DEFAULT PASSWORDS, TO EACH PERSON WITH  COMPUTER  ACCESS,  THAT
 ARE REASONABLY DESIGNED TO MAINTAIN THE INTEGRITY OF THE SECURITY OF THE
 ACCESS CONTROLS;
   (C)  ENCRYPTION  OF  ALL  TRANSMITTED  RECORDS  AND  FILES  CONTAINING
 PERSONAL INFORMATION THAT WILL TRAVEL  ACROSS  PUBLIC  NETWORKS,  OR  AN
 ALTERNATIVE  SYSTEM  OF  DATA  PROTECTION  AND  SECURITY  THAT  HAS BEEN
 ACCEPTED BY COMPUTER INDUSTRY STANDARDS AS EQUIVALENT OR SUPERIOR;
   (D) ENCRYPTION OF ALL DATA CONTAINING PERSONAL INFORMATION TO BE TRAN-
 SMITTED WIRELESSLY, OR AN ALTERNATIVE  SYSTEM  OF  DATA  PROTECTION  AND
 SECURITY THAT HAS BEEN ACCEPTED BY COMPUTER INDUSTRY STANDARDS AS EQUIV-
 ALENT OR SUPERIOR;
   (E)  REASONABLE  MONITORING  OF  SYSTEMS,  FOR  UNAUTHORIZED USE OF OR
 ACCESS TO PERSONAL INFORMATION;
   (F) ENCRYPTION OF ALL PERSONAL INFORMATION STORED ON LAPTOPS OR  OTHER
 PORTABLE  DEVICES, OR AN ALTERNATIVE SYSTEM OF DATA PROTECTION AND SECU-
 RITY THAT HAS BEEN ACCEPTED BY COMPUTER INDUSTRY STANDARDS AS EQUIVALENT
 OR SUPERIOR;
   (G) PROTOCOLS FOR ESTABLISHING STATE OF THE  ART,  AIR-GAPPED  SYSTEMS
 FOR  THE STORAGE AND MAINTENANCE OF PERSONAL INFORMATION, OR AN ALTERNA-
 TIVE SYSTEM OF DATA PROTECTION AND SECURITY THAT HAS  BEEN  ACCEPTED  BY
 COMPUTER INDUSTRY STANDARDS AS EQUIVALENT OR SUPERIOR;
   (H)  FOR  FILES  CONTAINING  PERSONAL  INFORMATION ON A SYSTEM THAT IS
 CONNECTED TO THE INTERNET, REASONABLY UP-TO-DATE FIREWALL PROTECTION AND
 OPERATING SYSTEM SECURITY PATCHES, REASONABLY DESIGNED TO  MAINTAIN  THE
 INTEGRITY  OF THE PERSONAL INFORMATION, OR AN ALTERNATIVE SYSTEM OF DATA
 PROTECTION AND SECURITY THAT HAS  BEEN  ACCEPTED  BY  COMPUTER  INDUSTRY
 STANDARDS AS EQUIVALENT OR SUPERIOR;
   (I)  REASONABLY  UP-TO-DATE VERSIONS OF SYSTEM SECURITY AGENT SOFTWARE
 WHICH INCLUDE MALWARE PROTECTION AND REASONABLY UP-TO-DATE  PATCHES  AND
 VIRUS  DEFINITIONS,  OR  A  VERSION  OF  SUCH SOFTWARE THAT CAN STILL BE
 SUPPORTED WITH UP-TO-DATE PATCHES AND VIRUS DEFINITIONS, SET TO  RECEIVE
 THE  MOST CURRENT SECURITY UPDATES ON A REGULAR BASIS, OR AN ALTERNATIVE
 SYSTEM OF DATA PROTECTION AND SECURITY THAT HAS BEEN ACCEPTED BY COMPUT-
 ER INDUSTRY STANDARDS AS EQUIVALENT OR SUPERIOR; AND
   (J) EDUCATION AND TRAINING OF PERSONS, VOLUNTEERS AND/OR EMPLOYEES  ON
 THE  PROPER  USE  OF  THE COMPUTER SECURITY SYSTEM AND THE IMPORTANCE OF
 PERSONAL INFORMATION SECURITY.
   3. REVIEW OF COMPUTER SYSTEM SECURITY PROGRAMS. EVERY PERSONAL  INFOR-
 MATION  HOLDER  OR THIRD PARTY PERSONAL INFORMATION HOLDER WHO ELECTRON-
 ICALLY STORES OR TRANSMITS PERSONAL INFORMATION SHALL FURTHER REVIEW AND
 UPDATE ITS WRITTEN, APPROVED, COMPREHENSIVE PERSONAL INFORMATION SECURI-
 TY PROGRAM NOT LESS THAN ANNUALLY,  TO  INCLUDE  ALL  FEASIBLE  RECENTLY
 DEVELOPED  TECHNOLOGICAL SAFEGUARDS, STANDARDS, PROTOCOLS AND BEST PRAC-
 TICES THAT COULD ENHANCE THE PROTECTION OF THE COLLECTION,  STORAGE  AND
 MAINTENANCE OF SUCH PERSONAL INFORMATION.
   §  407.  BREACH OF SECURITY.  1. NOTIFICATION TO THE DIVISION OF STATE
 POLICE. IN ADDITION TO ANY OTHER REQUIREMENTS CONTAINED WITHIN ANY OTHER
 PROVISION OF LAW, NOT LATER THAN TEN DAYS AFTER DISCOVERING  A  SECURITY
 BREACH  INVOLVING PERSONAL INFORMATION, ANY PERSONAL INFORMATION RECIPI-

 A. 9780                            11
 
 ENT THAT HAS EXPERIENCED A BREACH OF SECURITY INVOLVING PERSONAL  INFOR-
 MATION,  SHALL  MAKE  A  COMPREHENSIVE  REPORT  TO THE DIVISION OF STATE
 POLICE, IN THE FORM AND MANNER REQUIRED BY SUCH DIVISION, NOTIFYING  THE
 DIVISION OF STATE POLICE OF SUCH SECURITY BREACH.
   2. NOTIFICATION OF COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM
 APPROVAL  ENTITY.  IF SUCH PERSONAL INFORMATION RECIPIENT OR THIRD PARTY
 PERSONAL INFORMATION RECIPIENT IS REQUIRED IN  ACCORDANCE  WITH  SECTION
 FOUR  HUNDRED  FIVE OF THIS ARTICLE TO OBTAIN APPROVAL OF ITS COMPREHEN-
 SIVE PERSONAL INFORMATION SECURITY PROGRAM, THEN SUCH PERSONAL  INFORMA-
 TION  RECIPIENT OR THIRD PARTY PERSONAL INFORMATION RECIPIENT SHALL ALSO
 MAKE A COMPREHENSIVE REPORT TO THE ENTITY FROM WHICH THE PERSONAL INFOR-
 MATION RECIPIENT OR THIRD PARTY INFORMATION  RECIPIENT  IS  REQUIRED  TO
 OBTAIN  APPROVAL  FOR  ITS  COMPREHENSIVE  PERSONAL INFORMATION SECURITY
 PROGRAM, IN THE FORM AND MANNER REQUIRED BY SUCH APPROVAL ENTITY,  NOTI-
 FYING SUCH APPROVAL ENTITY OF THE SECURITY BREACH.
   3.  NOTIFICATION  OF THE CHIEF INFORMATION OFFICER. NOT MORE THAN FIVE
 DAYS AFTER RECEIVING THE NOTIFICATION REQUIRED PURSUANT  TO  SUBDIVISION
 ONE  OR  TWO  OF  THIS SECTION, THE DIVISION OF STATE POLICE, AND/OR THE
 ENTITY REQUIRED TO APPROVE THE COMPREHENSIVE PERSONAL INFORMATION  SECU-
 RITY  PROGRAM  PURSUANT  TO  SECTION  FOUR HUNDRED FIVE OF THIS ARTICLE,
 SHALL PROVIDE THE COMPREHENSIVE REPORT PROVIDED TO SUCH DIVISION  AND/OR
 APPROVAL  ENTITY  TO  THE  CHIEF INFORMATION OFFICER OF THE OFFICE. UPON
 SUCH NOTIFICATION, THE CHIEF INFORMATION OFFICER SHALL ADD THE PERTINENT
 INFORMATION CONCERNING SUCH BREACH TO THE INFORMATION SHARING AND ANALY-
 SIS PROGRAM ESTABLISHED IN ACCORDANCE WITH SECTION FOUR HUNDRED  TEN  OF
 THIS ARTICLE.
   4.  NOTIFICATION  OF PERSONAL INFORMATION SUBJECTS. IN ADDITION TO ANY
 OTHER REQUIREMENTS PURSUANT TO ANY OTHER  PROVISION  OF  LAW,  UPON  THE
 RECEIPT  OF  THE  COMPREHENSIVE  REPORT REQUIRED BY SUBDIVISION THREE OF
 THIS SECTION, THE CHIEF INFORMATION OFFICER OF THE OFFICE  MAY  REQUIRE,
 IN  A  SPECIFIED TIMEFRAME, AND IN A SPECIFIED FORM AND MANNER, THAT THE
 PERSONAL INFORMATION RECIPIENT,  OR  THIRD  PARTY  PERSONAL  INFORMATION
 RECIPIENT, WHICH SUSTAINED THE BREACH OF SECURITY OF THE PERSONAL INFOR-
 MATION, NOTIFY ALL PERSONAL INFORMATION SUBJECTS IMPACTED BY THE SECURI-
 TY  BREACH, OF THE FACT THAT THERE HAS BEEN A BREACH OF SECURITY INVOLV-
 ING THEIR PERSONAL  INFORMATION.    IF  THE  CHIEF  INFORMATION  OFFICER
 REASONABLY  BELIEVES  THAT  THE  PERSONAL  INFORMATION  SUBJECT  WILL BE
 ADVERSELY IMPACTED IN ANY MANNER BY THE DISCOVERED BREACH  OF  SECURITY,
 THEN  THE  CHIEF  INFORMATION  OFFICER  SHALL  REQUIRE THAT THE PERSONAL
 INFORMATION RECIPIENT, OR THIRD PARTY  PERSONAL  INFORMATION  RECIPIENT,
 NOTIFY  ALL  SUCH  PERSONAL INFORMATION SUBJECTS, OF THE FACT THAT THERE
 HAS BEEN A BREACH OF SECURITY INVOLVING THEIR PERSONAL INFORMATION.
   § 408. CAUSES OF ACTION.  1. LIMITATION ON CIVIL ACTIONS. ANY PERSONAL
 INFORMATION SUBJECT MAY BRING A CIVIL ACTION, AGAINST A PERSONAL  INFOR-
 MATION  HOLDER  IN THE SUPREME COURT OF ANY COUNTY IN WHICH THE PERSONAL
 INFORMATION RECIPIENT  RESIDES  OR  CONDUCTS  BUSINESS  OPERATIONS,  FOR
 DAMAGES  OR  EQUITABLE RELIEF, ARISING FROM A BREACH OF SECURITY, AND IN
 ACCORDANCE WITH THE PROVISIONS OF  THIS  SECTION.  A  CIVIL  ACTION  FOR
 DAMAGES  OR  EQUITABLE  RELIEF,  SHALL  NOT,  HOWEVER,  BE  BROUGHT BY A
 PERSONAL INFORMATION SUBJECT, IN ANY  OTHER  STATE  COURT  OF  COMPETENT
 JURISDICTION,  OTHER  THAN  IN  ACCORDANCE  WITH  THE PROVISIONS OF THIS
 SECTION, IF SUCH CIVIL ACTION ARISES OUT OF A BREACH OF  SECURITY  BY  A
 PERSONAL  INFORMATION  HOLDER.    NO  ACTION SHALL BE BROUGHT UNDER THIS
 SECTION AGAINST A  PERSONAL  INFORMATION  COLLECTOR  OR  A  THIRD  PARTY
 PERSONAL  INFORMATION  COLLECTOR  UNLESS  BROUGHT IN ACCORDANCE WITH THE

 A. 9780                            12
 
 PROVISIONS OF SUBPARAGRAPH FOUR OF PARAGRAPH (C) OF SUBDIVISION  TWO  OF
 THIS SECTION.
   2. CIVIL ACTIONS THAT MAY BE BROUGHT BY A PERSONAL INFORMATION SUBJECT
 AGAINST A PERSONAL INFORMATION RECIPIENT.
   (A) TIMELINESS OF ACTIONS. A CIVIL ACTION MAY BE BROUGHT IN ACCORDANCE
 WITH  THIS  SECTION  IF SUCH CIVIL ACTION IS BROUGHT WITHIN SIX YEARS OF
 THE DATE OF THE REPORTING OF THE  BREACH  OF  SECURITY  AS  REQUIRED  BY
 SECTION  FOUR  HUNDRED  SEVEN  OF  THIS ARTICLE, OR IN THE EVENT NO SUCH
 REPORT WAS EVER MADE, WITHIN ANY TIME AFTER THE DATE OF THE DISCOVERY OF
 THE BREACH OF SECURITY BY THE PERSONAL INFORMATION SUBJECT.
   (B) EQUITABLE ACTION. ANY  ACTION  BROUGHT  IN  ACCORDANCE  WITH  THIS
 SECTION,  MAY  SEEK  EITHER  DAMAGES  OR EQUITABLE RELIEF. IF A PERSONAL
 INFORMATION SUBJECT SEEKS EQUITABLE RELIEF  FOR  A  BREACH  OF  SECURITY
 INVOLVING  A  SECURITY  BREACH  OF  PERSONAL INFORMATION FROM A PERSONAL
 INFORMATION RECIPIENT, AND THE  COURT  DETERMINES  THAT  SUCH  EQUITABLE
 RELIEF  IS  JUST  AND  PROPER AND SHOULD BE AWARDED, THEN IN ADDITION TO
 SUCH EQUITABLE RELIEF, THE COURT MAY ALSO AWARD THE PERSONAL INFORMATION
 SUBJECT COSTS, DISBURSEMENTS AND ATTORNEYS FEES OF THE ACTION. NO ACTION
 BROUGHT UNDER  THIS  SECTION  FOR  EQUITABLE  RELIEF  SHALL  PROHIBIT  A
 PERSONAL  INFORMATION SUBJECT FROM ALSO BRINGING ANY ADDITIONAL CAUSE OF
 ACTION FOR DAMAGES, WHEN SUCH ADDITIONAL  CAUSE  OF  ACTION  IS  ALLOWED
 UNDER THIS ARTICLE.
   (C)  ACTIONS  INVOLVING DAMAGES. ANY ACTION BROUGHT IN ACCORDANCE WITH
 THIS SECTION, SEEKING DAMAGES FOR A BREACH OF SECURITY INVOLVING A SECU-
 RITY BREACH OF PERSONAL INFORMATION FROM A PERSONAL INFORMATION  RECIPI-
 ENT, SHALL BE BROUGHT AS FOLLOWS:
   (1)  PERSONAL  INFORMATION HOLDERS OR THIRD PARTY PERSONAL INFORMATION
 HOLDERS WITH ANNUAL  REVENUES  OF  TEN  MILLION  DOLLARS  OR  MORE.  ANY
 PERSONAL INFORMATION HOLDER, OR THIRD PARTY PERSONAL INFORMATION HOLDER,
 THAT  HAS  ANNUAL REVENUES OF TEN MILLION DOLLARS OR MORE, THAT FAILS TO
 MAINTAIN THE SAFEGUARDS, STANDARDS, PROTOCOLS OR BEST PRACTICES FOR  THE
 PROTECTION  OF  PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPREHENSIVE
 INFORMATION SECURITY PROGRAM, OR THAT FAILS TO ESTABLISH A COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM AS REQUIRED BY THIS  ARTICLE,  AND
 THAT  EXPERIENCES  A BREACH OF SECURITY INVOLVING SUCH PERSONAL INFORMA-
 TION, SHALL BE LIABLE IN A CIVIL ACTION BROUGHT IN ACCORDANCE WITH  THIS
 SECTION,  FOR  DAMAGES,  IF THE PERSONAL INFORMATION SUBJECT INVOLVED IN
 THE BREACH OF SECURITY SUSTAINS ANY DAMAGES AS A RESULT OF SUCH  BREACH.
 SUCH  LIABILITY SHALL EXTEND TO DAMAGES IN THE AMOUNT OF THREE TIMES THE
 AMOUNT OF SUCH DAMAGES SUSTAINED BY THE PERSONAL INFORMATION SUBJECT, OR
 AN AMOUNT OF UP TO TEN THOUSAND DOLLARS,  WHICHEVER  IS  LESS,  TOGETHER
 WITH  COSTS,  DISBURSEMENTS  AND ATTORNEYS FEES OF THE ACTION. WHERE THE
 COURT FINDS THAT THE  PERSONAL  INFORMATION  HOLDER  OR  A  THIRD  PARTY
 PERSONAL INFORMATION HOLDER, INTENTIONALLY FAILED TO ESTABLISH A COMPRE-
 HENSIVE  PERSONAL  INFORMATION SECURITY PROGRAM, OR INTENTIONALLY FAILED
 TO SEEK AND OBTAIN APPROVAL FOR  A  COMPREHENSIVE  PERSONAL  INFORMATION
 SECURITY  PROGRAM,  WHERE  REQUIRED, OR INTENTIONALLY FAILED TO MAINTAIN
 THE  SAFEGUARDS,  STANDARDS,  PROTOCOLS  OR  BEST  PRACTICES   FOR   THE
 PROTECTION  OF  PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM, THEN THE  COURT  MAY  ALSO  AWARD
 PUNITIVE DAMAGES TO THE PLAINTIFF OF AN ACTION BROUGHT UNDER THIS SUBDI-
 VISION.
   (2)  PERSONAL  INFORMATION HOLDERS OR THIRD PARTY PERSONAL INFORMATION
 HOLDERS WITH ANNUAL REVENUES OF BETWEEN  ONE  MILLION  DOLLARS  AND  TEN
 MILLION  DOLLARS.  ANY  PERSONAL  INFORMATION  HOLDER,  OR  THIRD  PARTY
 PERSONAL INFORMATION HOLDER, THAT HAS ANNUAL  REVENUES  OF  BETWEEN  ONE

 A. 9780                            13
 
 MILLION  DOLLARS AND TEN MILLION DOLLARS, AND THAT FAILS TO MAINTAIN THE
 SAFEGUARDS, STANDARDS, PROTOCOLS OR BEST PRACTICES FOR THE PROTECTION OF
 PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPREHENSIVE PERSONAL INFOR-
 MATION  SECURITY  PROGRAM,  OR  THAT  FAILS TO ESTABLISH A COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM AS REQUIRED BY THIS  ARTICLE,  AND
 THAT  EXPERIENCES  A BREACH OF SECURITY INVOLVING SUCH PERSONAL INFORMA-
 TION, SHALL BE LIABLE IN A CIVIL ACTION BROUGHT IN ACCORDANCE WITH  THIS
 SECTION,  FOR  DAMAGES,  IF THE PERSONAL INFORMATION SUBJECT INVOLVED IN
 THE BREACH OF SECURITY SUSTAINS ANY DAMAGES AS A RESULT OF SUCH  BREACH.
 SUCH  LIABILITY SHALL EXTEND TO DAMAGES IN THE AMOUNT OF THREE TIMES THE
 AMOUNT OF SUCH DAMAGES SUSTAINED BY THE PERSONAL INFORMATION SUBJECT, OR
 AN AMOUNT OF UP TO FIVE THOUSAND DOLLARS, WHICHEVER  IS  LESS,  TOGETHER
 WITH  COSTS,  DISBURSEMENTS  AND ATTORNEYS FEES OF THE ACTION. WHERE THE
 COURT FINDS THAT THE  PERSONAL  INFORMATION  HOLDER  OR  A  THIRD  PARTY
 PERSONAL INFORMATION HOLDER, INTENTIONALLY FAILED TO ESTABLISH A COMPRE-
 HENSIVE  PERSONAL  INFORMATION SECURITY PROGRAM, OR INTENTIONALLY FAILED
 TO SEEK AND OBTAIN APPROVAL FOR  A  COMPREHENSIVE  PERSONAL  INFORMATION
 SECURITY  PROGRAM,  WHERE  REQUIRED, OR INTENTIONALLY FAILED TO MAINTAIN
 THE  SAFEGUARDS,  STANDARDS,  PROTOCOLS  OR  BEST  PRACTICES   FOR   THE
 PROTECTION  OF  PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPREHENSIVE
 PERSONAL INFORMATION SECURITY PROGRAM, THEN THE  COURT  MAY  ALSO  AWARD
 PUNITIVE DAMAGES TO THE PLAINTIFF OF AN ACTION BROUGHT UNDER THIS SUBDI-
 VISION.
   (3)  PERSONAL  INFORMATION HOLDERS OR THIRD PARTY PERSONAL INFORMATION
 HOLDERS WITH ANNUAL REVENUES OF  LESS  THAN  ONE  MILLION  DOLLARS.  ANY
 PERSONAL INFORMATION HOLDER, OR THIRD PARTY PERSONAL INFORMATION HOLDER,
 THAT  HAS  ANNUAL  REVENUES  OF  LESS THAN ONE MILLION DOLLARS, AND THAT
 FAILS TO MAINTAIN THE SAFEGUARDS, STANDARDS, PROTOCOLS OR BEST PRACTICES
 FOR THE PROTECTION OF PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPRE-
 HENSIVE PERSONAL INFORMATION SECURITY PROGRAM, OR THAT FAILS  TO  ESTAB-
 LISH  A  COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM AS REQUIRED
 BY THIS ARTICLE, AND THAT EXPERIENCES A  BREACH  OF  SECURITY  INVOLVING
 SUCH  PERSONAL INFORMATION, SHALL BE LIABLE IN A CIVIL ACTION BROUGHT IN
 ACCORDANCE WITH THIS SECTION, FOR DAMAGES, IF THE  PERSONAL  INFORMATION
 SUBJECT  INVOLVED  IN  THE  BREACH OF SECURITY SUSTAINS ANY DAMAGES AS A
 RESULT OF SUCH BREACH.  SUCH LIABILITY SHALL EXTEND TO  DAMAGES  IN  THE
 AMOUNT  OF  THREE  TIMES  THE  AMOUNT  OF  SUCH DAMAGES SUSTAINED BY THE
 PERSONAL INFORMATION SUBJECT,  OR  AN  AMOUNT  OF  UP  TO  ONE  THOUSAND
 DOLLARS,  WHICHEVER  IS  LESS,  TOGETHER  WITH  COSTS, DISBURSEMENTS AND
 ATTORNEYS FEES OF THE ACTION. WHERE THE COURT FINDS  THAT  THE  PERSONAL
 INFORMATION  HOLDER OR A THIRD PARTY PERSONAL INFORMATION HOLDER, INTEN-
 TIONALLY FAILED TO ESTABLISH A COMPREHENSIVE PERSONAL INFORMATION  SECU-
 RITY  PROGRAM, OR INTENTIONALLY FAILED TO SEEK AND OBTAIN APPROVAL FOR A
 COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM, WHERE REQUIRED,  OR
 INTENTIONALLY FAILED TO MAINTAIN THE SAFEGUARDS, STANDARDS, PROTOCOLS OR
 BEST PRACTICES FOR THE PROTECTION OF PERSONAL INFORMATION AS ESTABLISHED
 IN  ITS  COMPREHENSIVE  PERSONAL  INFORMATION SECURITY PROGRAM, THEN THE
 COURT MAY ALSO AWARD PUNITIVE DAMAGES TO  THE  PLAINTIFF  OF  AN  ACTION
 BROUGHT UNDER THIS SUBDIVISION.
   (4)  PERSONAL INFORMATION COLLECTORS. ANY PERSONAL INFORMATION COLLEC-
 TOR THAT FAILS TO MAINTAIN THE SAFEGUARDS, STANDARDS, PROTOCOLS OR  BEST
 PRACTICES  FOR  THE PROTECTION OF PERSONAL INFORMATION AS ESTABLISHED IN
 ITS COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM, OR  THAT  FAILS
 TO  ESTABLISH  A  COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM AS
 REQUIRED BY THIS ARTICLE, AND THAT  EXPERIENCES  A  BREACH  OF  SECURITY
 INVOLVING  SUCH  PERSONAL INFORMATION, SHALL BE LIABLE IN A CIVIL ACTION

 A. 9780                            14
 
 FOR DAMAGES BROUGHT IN ACCORDANCE WITH THIS SECTION, IN  THE  AMOUNT  OF
 SUCH  DAMAGES  SO  SUSTAINED.  WHERE  THE  COURT FINDS THAT THE PERSONAL
 INFORMATION COLLECTOR INTENTIONALLY FAILED TO ESTABLISH A  COMPREHENSIVE
 PERSONAL  INFORMATION  SECURITY PROGRAM, OR INTENTIONALLY FAILED TO SEEK
 AND OBTAIN APPROVAL FOR A COMPREHENSIVE  PERSONAL  INFORMATION  SECURITY
 PROGRAM,  WHERE  REQUIRED, OR INTENTIONALLY FAILED TO MAINTAIN THE SAFE-
 GUARDS, STANDARDS, PROTOCOLS OR BEST PRACTICES  FOR  THE  PROTECTION  OF
 PERSONAL INFORMATION AS ESTABLISHED IN ITS COMPREHENSIVE PERSONAL INFOR-
 MATION  SECURITY PROGRAM, THEN THE COURT MAY ALSO AWARD PUNITIVE DAMAGES
 TO THE PLAINTIFF OF AN ACTION BROUGHT UNDER THIS SUBDIVISION.
   (5) NO ACTION BROUGHT UNDER THIS SECTION FOR DAMAGES SHALL PROHIBIT  A
 PERSONAL  INFORMATION SUBJECT FROM ALSO BRINGING ANY ADDITIONAL CAUSE OF
 ACTION FOR EQUITABLE RELIEF, WHEN SUCH ADDITIONAL  CAUSE  OF  ACTION  IS
 ALSO ALLOWED UNDER THIS ARTICLE.
   § 409. LIABILITY PROTECTION.  1. IT SHALL BE A COMPLETE DEFENSE TO ANY
 CIVIL  ACTION  BROUGHT  IN ACCORDANCE WITH SECTION FOUR HUNDRED EIGHT OF
 THIS ARTICLE, FOR THE PERSONAL INFORMATION RECIPIENT THAT IS THE DEFEND-
 ANT IN SUCH ACTION, THAT SUCH PERSONAL INFORMATION RECIPIENT ESTABLISHED
 AND MAINTAINED A COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM, AS
 REQUIRED BY THIS ARTICLE, AND SUBSTANTIALLY FOLLOWED AND  COMPLIED  WITH
 ALL  PROVISIONS  OF  SUCH  COMPREHENSIVE  PERSONAL  INFORMATION SECURITY
 PROGRAM, AND SUBSTANTIALLY MAINTAINED, IF REQUIRED, ALL COMPUTER  SYSTEM
 SECURITY  REQUIREMENTS,  IN  ACCORDANCE WITH SECTION FOUR HUNDRED SIX OF
 THIS ARTICLE, AND SUBSTANTIALLY  MAINTAINED,  IF  REQUIRED,  THE  PROPER
 APPROVAL  FOR  SUCH COMPREHENSIVE PERSONAL INFORMATION SECURITY PROGRAM,
 IN ACCORDANCE WITH SECTION FOUR HUNDRED FIVE OF  THIS  ARTICLE,  AT  THE
 TIME OF THE BREACH OF SUCH SECURITY.
   2.  ANY CIVIL ACTION BROUGHT BY A PERSONAL INFORMATION SUBJECT, IN ANY
 COURT OF COMPETENT JURISDICTION, INVOLVING DAMAGES ARISING FROM A BREACH
 OF SECURITY THAT IS NOT BROUGHT IN ACCORDANCE  WITH  THE  PROVISIONS  OF
 SECTION  FOUR  HUNDRED EIGHT OF THIS ARTICLE, SHALL BE DISMISSED WITHOUT
 PREJUDICE, AGAINST SUCH PERSONAL INFORMATION RECIPIENT  OR  THIRD  PARTY
 PERSONAL  INFORMATION  RECIPIENT,  BUT  THAT  SUCH  PERSONAL INFORMATION
 SUBJECT MAY BRING A NEW, SUBSEQUENT ACTION,  IF  TIMELY,  IN  ACCORDANCE
 WITH THE PROVISIONS OF SECTION FOUR HUNDRED EIGHT OF THIS ARTICLE.
   §  410. INFORMATION SHARING AND ANALYSIS PROGRAM.  1. THE OFFICE SHALL
 ESTABLISH AND MAINTAIN A VOLUNTARY NEW YORK STATE CYBER SECURITY  INFOR-
 MATION SHARING AND ANALYSIS PROGRAM.
   2. IT SHALL BE THE PURPOSE OF THE NEW YORK STATE CYBER SECURITY INFOR-
 MATION  SHARING AND ANALYSIS PROGRAM TO INCREASE THE VOLUME, TIMELINESS,
 AND QUALITY OF CYBER THREAT INFORMATION SHARED  WITH  STATE  PUBLIC  AND
 PRIVATE  SECTOR  ENTITIES  SO THAT THESE ENTITIES MAY BETTER PROTECT AND
 DEFEND THEMSELVES AGAINST CYBER THREATS AND TO PROMOTE  THE  DEVELOPMENT
 OF  EFFECTIVE  DEFENSES  AND  STRATEGIES TO COMBAT, AND PROTECT AGAINST,
 CYBER THREATS AND ATTACKS.
   3. TO FACILITATE THE PURPOSES OF THE NEW  YORK  STATE  CYBER  SECURITY
 INFORMATION  SHARING  AND  ANALYSIS PROGRAM, THE OFFICE SHALL PROMULGATE
 REGULATIONS, IN ACCORDANCE WITH THE PROVISIONS OF THIS SECTION.
   4. THE REGULATIONS PROMULGATED PURSUANT TO SUBDIVISION THREE  OF  THIS
 SECTION SHALL:
   (A) PROVIDE FOR THE TIMELY PRODUCTION OF UNCLASSIFIED REPORTS OF CYBER
 THREATS TO THE STATE AND ITS PUBLIC AND PRIVATE SECTOR ENTITIES, INCLUD-
 ING, BUT NOT LIMITED TO, ALL PARTICIPANTS IN THE INFORMATION SHARING AND
 ANALYSIS  PROGRAM,  WITH  EXPRESS  DETAILS  ON  THREATS  THAT IDENTIFY A
 SPECIFIC TARGETED ENTITY OR SPECIFIC THREAT TYPE OR ACTIVITY;

 A. 9780                            15
 
   (B) ADDRESS THE NEED  TO  PROTECT  INTELLIGENCE  AND  LAW  ENFORCEMENT
 SOURCES, METHODS, OPERATIONS, AND INVESTIGATIONS;
   (C) ESTABLISH A PROCESS THAT RAPIDLY DISSEMINATES THE REPORTS PRODUCED
 PURSUANT  TO  PARAGRAPH (A) OF THIS SUBDIVISION, TO ANY TARGETED ENTITY,
 ANY PROGRAM PARTICIPANT, AND SUCH OTHER AND FURTHER PUBLIC  AND  PRIVATE
 ENTITIES  AS  THE OFFICE SHALL DEEM NECESSARY TO ADVANCE THE PURPOSES OF
 THIS SUBDIVISION;
   (D) PROVIDE FOR PROTECTIONS FROM LIABILITY FOR  ENTITIES  SHARING  AND
 RECEIVING INFORMATION WITH THE NEW YORK STATE CYBER SECURITY INFORMATION
 AND ANALYSIS PROGRAM, SO LONG AS THE ENTITY ACTED IN GOOD FAITH;
   (E) ESTABLISH A SYSTEM FOR TRACKING THE PRODUCTION, DISSEMINATION, AND
 DISPOSITION OF THE REPORTS PRODUCED IN ACCORDANCE WITH THE PROVISIONS OF
 THIS SUBDIVISION;
   (F)  ESTABLISH AN ENHANCED CYBER SECURITY SERVICES PROGRAM, WITHIN THE
 STATE, TO PROVIDE FOR PROCEDURES, METHODS AND DIRECTIVES, FOR  A  VOLUN-
 TARY  INFORMATION  SHARING  PROGRAM,  THAT WILL PROVIDE CYBER THREAT AND
 TECHNICAL INFORMATION COLLECTED FROM  BOTH  PUBLIC  AND  PRIVATE  SECTOR
 ENTITIES,  TO  ALL  PARTICIPANTS IN THE INFORMATION SHARING AND ANALYSIS
 PROGRAM AND ALL SUCH PRIVATE AND PUBLIC SECTOR ENTITIES  AS  THE  OFFICE
 DEEMS  PRUDENT, AND TO ALSO ADVISE ALL CRITICAL INFRASTRUCTURE COMPANIES
 OR COMMERCIAL SERVICE PROVIDERS THAT OFFER SECURITY SERVICES TO CRITICAL
 INFRASTRUCTURE ON CYBER SECURITY THREATS AND DEFENSE MEASURES;
   (G) SEEK TO DEVELOP STRATEGIES TO MAXIMIZE THE UTILITY OF CYBER THREAT
 INFORMATION SHARING BETWEEN AND ACROSS THE PRIVATE AND PUBLIC SECTORS;
   (H) PROMOTE THE USE  OF  PRIVATE  AND  PUBLIC  SECTOR  SUBJECT  MATTER
 EXPERTS TO ADDRESS CYBER SECURITY NEEDS IN THE STATE, WITH THESE SUBJECT
 MATTER  EXPERTS  PROVIDING  ADVICE REGARDING THE CONTENT, STRUCTURE, AND
 TYPES OF INFORMATION MOST USEFUL TO CRITICAL INFRASTRUCTURE  OWNERS  AND
 OPERATORS IN REDUCING AND MITIGATING CYBER RISKS;
   (I) ESTABLISH A CONSULTATIVE PROCESS TO COORDINATE IMPROVEMENTS TO THE
 CYBER  SECURITY OF CRITICAL INFRASTRUCTURE, WHERE AS PART OF THE CONSUL-
 TATIVE PROCESS, THE PUBLIC AND  PRIVATE  ENTITIES  OF  THE  STATE  SHALL
 ENGAGE;
   (J)  PROVIDE THAT THE OFFICE SHALL SEEK AND CONSIDER THE ADVICE OF THE
 DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,  THE  DIVISION  OF
 STATE  POLICE,  THE  CENTER  FOR  INTERNET  SECURITY, AND SUCH OTHER AND
 FURTHER PRIVATE AND PUBLIC  SECTOR  ENTITIES,  UNIVERSITIES,  AND  CYBER
 SECURITY EXPERTS AS THE OFFICE MAY DEEM PRUDENT; AND
   (K)  ESTABLISH  A  BASELINE FRAMEWORK TO REDUCE CYBER RISK TO CRITICAL
 INFRASTRUCTURE AND PUBLIC AND PRIVATE  COMPUTER  SYSTEMS,  NETWORKS  AND
 OPERATIONS.
   5.  THE  OFFICE SHALL USE THE INFORMATION SHARING AND ANALYSIS PROGRAM
 DEVELOPED UNDER THIS SECTION TO LEAD IN THE DEVELOPMENT OF  A  VOLUNTARY
 FRAMEWORK  TO  REDUCE  CYBER RISKS TO CRITICAL INFRASTRUCTURE AND PUBLIC
 AND PRIVATE COMPUTER SYSTEMS, NETWORKS AND OPERATIONS, TO  BE  KNOWN  AS
 THE CYBER SECURITY FRAMEWORK.
   6. THE DEVELOPMENT OF THE CYBER SECURITY FRAMEWORK SHALL:
   (A)  INCLUDE  A SET OF STANDARDS, METHODOLOGIES, PROCEDURES, AND PROC-
 ESSES THAT ALIGN  POLICY,  BUSINESS,  AND  TECHNOLOGICAL  APPROACHES  TO
 ADDRESS CYBER RISKS;
   (B)  INCORPORATE  VOLUNTARY CONSENSUS STANDARDS, SAFEGUARDS, PROTOCOLS
 AND BEST PRACTICES TO THE FULLEST EXTENT POSSIBLE;
   (C) PROVIDE A PRIORITIZED,  FLEXIBLE,  REPEATABLE,  PERFORMANCE-BASED,
 AND COST-EFFECTIVE APPROACH, INCLUDING INFORMATION SECURITY MEASURES AND
 CONTROLS,  TO  HELP  OWNERS AND OPERATORS OF CRITICAL INFRASTRUCTURE AND

 A. 9780                            16
 
 PUBLIC AND PRIVATE COMPUTER SYSTEMS, NETWORKS AND OPERATIONS, TO IDENTI-
 FY, ASSESS, AND MANAGE CYBER RISK;
   (D)  FOCUS  ON  IDENTIFYING CROSS-SECTOR SECURITY STANDARDS AND GUIDE-
 LINES APPLICABLE TO  CRITICAL  INFRASTRUCTURE  AND  PUBLIC  AND  PRIVATE
 COMPUTER SYSTEMS, NETWORKS AND OPERATIONS;
   (E)  IDENTIFY  AREAS  FOR IMPROVEMENT THAT SHOULD BE ADDRESSED THROUGH
 FUTURE COLLABORATION WITH PARTICULAR  SECTORS  AND  STANDARDS-DEVELOPING
 ORGANIZATIONS;
   (F) ENABLE TECHNICAL INNOVATION AND ACCOUNT FOR ORGANIZATIONAL DIFFER-
 ENCES,  TO  PROVIDE GUIDANCE THAT IS TECHNOLOGY NEUTRAL AND THAT ENABLES
 CRITICAL INFRASTRUCTURE SECTORS AND PUBLIC AND PRIVATE COMPUTER SYSTEMS,
 NETWORKS AND OPERATIONS,  TO  BENEFIT  FROM  A  COMPETITIVE  MARKET  FOR
 PRODUCTS  AND  SERVICES  THAT  MEET THE STANDARDS, METHODOLOGIES, PROCE-
 DURES, PROCESSES, SAFEGUARDS, PROTOCOLS AND BEST PRACTICES TO BE  DEVEL-
 OPED TO ADDRESS CYBER RISKS;
   (G)  INCLUDE  GUIDANCE  FOR  MEASURING THE PERFORMANCE OF AN ENTITY IN
 IMPLEMENTING THE CYBER SECURITY FRAMEWORK;
   (H) INCLUDE METHODOLOGIES TO IDENTIFY  AND  MITIGATE  IMPACTS  OF  THE
 CYBER SECURITY FRAMEWORK AND ASSOCIATED INFORMATION SECURITY MEASURES OR
 CONTROLS  ON BUSINESS CONFIDENTIALITY, AND TO PROTECT INDIVIDUAL PRIVACY
 AND CIVIL LIBERTIES; AND
   (I) ENGAGE IN THE REVIEW OF THREAT AND VULNERABILITY  INFORMATION  AND
 TECHNICAL EXPERTISE.
   7.  THE  REGULATIONS PROMULGATED PURSUANT TO SUBDIVISION THREE OF THIS
 SECTION SHALL ADDITIONALLY ESTABLISH A VOLUNTARY CRITICAL INFRASTRUCTURE
 CYBER SECURITY PROGRAM TO SUPPORT THE ADOPTION  OF  THE  CYBER  SECURITY
 FRAMEWORK  BY  OWNERS  AND  OPERATORS OF CRITICAL INFRASTRUCTURE AND ANY
 OTHER INTERESTED ENTITIES, WHERE UNDER THIS PROGRAM IMPLEMENTATION GUID-
 ANCE OR SUPPLEMENTAL MATERIALS WOULD BE DEVELOPED TO ADDRESS SECTOR-SPE-
 CIFIC RISKS AND OPERATING ENVIRONMENTS.
   8. IN DEVELOPING THE NEW YORK STATE CYBER SECURITY INFORMATION SHARING
 AND ANALYSIS PROGRAM IN ACCORDANCE WITH THE PROVISIONS OF THIS  SECTION,
 THE  OFFICE,  IN CONSULTATION WITH THE DIVISION OF HOMELAND SECURITY AND
 EMERGENCY SERVICES AND THE DIVISION OF STATE POLICE, SHALL  PRODUCE  AND
 SUBMIT A REPORT, TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE,
 AND THE SPEAKER OF THE ASSEMBLY, MAKING RECOMMENDATIONS ON THE FEASIBIL-
 ITY,  SECURITY  BENEFITS,  AND RELATIVE MERITS OF INCORPORATING SECURITY
 SAFEGUARDS, STANDARDS, PROTOCOLS AND  BEST  PRACTICES  INTO  ACQUISITION
 PLANNING  AND CONTRACT ADMINISTRATION. SUCH REPORT SHALL FURTHER ADDRESS
 WHAT STEPS CAN BE  TAKEN  TO  HARMONIZE  AND  MAKE  CONSISTENT  EXISTING
 PROCUREMENT  REQUIREMENTS  RELATED TO CYBER SECURITY AND THE FEASIBILITY
 OF INCLUDING RISK-BASED SECURITY STANDARDS INTO PROCUREMENT AND CONTRACT
 ADMINISTRATION.
   § 4. This act shall take effect on the one hundred eightieth day after
 it shall have become a law; provided, however, that the office of infor-
 mation technology services is authorized and directed to (i) publish its
 model comprehensive security programs containing recommended  standards,
 safeguards,  protocols and best practices for holders of personal infor-
 mation in accordance with section 404 of the state  technology  law,  as
 added  by  section three of this act, and (ii) establish the information
 sharing and analysis program and promulgate  regulations  regarding  the
 same,  in  accordance  with  section 410 of the state technology law, as
 added by section three of this act, on or before the one hundred  fifti-
 eth day after this act shall have become a law.