BILL NUMBER: S6889

SPONSOR: CARLUCCI
 
TITLE OF BILL:

An act to amend the general business law, in relation to the timeliness
of disclosure of a breach of the security of a system which contains
private information

 
PURPOSE:

To require that persons or businesses possessing consumer's personal
information must provide a preliminary notification that a breach has or
may have occurred to the attorney general within twenty-four hours and
to all persons potentially effected within forty-eight hours.

 
SUMMARY OF PROVISIONS:

Section 1 - Requires that, in the event of a data breach, persons or
businesses possessing consumer's personal information must provide a
preliminary notification that a breach. This preliminary notification
              

must be provided to the attorney general within twenty-four hours of the
discovery of a breach. Preliminary notification must then be provided to
all persons effected or potentially effected by the breach within
forty-eight hours of its discovery.

Section 2 - Effective date.

 
EXISTING LAW:

Currently, no preliminary notice of a breach need be provided to any
parties. Notice that a breach has occurred must only be provided to
effected parties within a reasonable amount of time.

 
JUSTIFICATION:

Recent headlines have been dominated by a massive data breach that
impacted the largest credit-reporting firm in the United States. This
breach is estimated to have effected 143 million Americans, or 44% of
the population. Millions suddenly found that their birthdates, home
addresses, telephone numbers, and, in some cases, even their social
security numbers and drivers license numbers had been leaked.

The implications of such a large scale and egregious breach of consumer
data security are serious. Millions have been exposed to the possibility
of becoming victims of identity theft. This can lead to ongoing credit
problems and major costs to consumers to remedy the damage done. We must
do more to make sure that data breaches are prevented. But just as
important, is making sure consumers and law enforcement have the tools
available to mitigate damage as soon as a breach occurs. This bill, part
of a larger package that will target consumer data breaches at every
stage, will provide one of those tools.

Under current law, companies that experience a data breach must notify
any effected parties within a reasonable amount of time. This is not
enough time to allow consumers to begin taking the necessary steps to
protect themselves once their data has been compromised. This bill
addresses this by requiring that companies that are compromised by a
data breach provide a preliminary notification to any effected or poten-
tially effected consumers within forty-eight hours of the discovery of a
breach.

This expedited timeline is critical because it will provide consumers
with the ability to take essential protective measures in a timely
manner. For instance, consumers would now be able to quickly place a
credit freeze on their information to prevent its further spread or
subscribe to a credit-monitoring program.

Additionally, this bill would require that a company that has suffered a
breach also send a preliminary notification to the attorney general
within twenty-four hours of the discovery of a breach. This allows the
attorney general to immediately begin getting the word out to the public
and, just as importantly, to begin protecting consumers from further
harm.

 
LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

None to the state.

 
EFFECTIVE DATE:
Immediately.