NY State Senate Bill 2017-S6923A

Senate Bill S6923A

2017-2018 Legislative Session

Relates to requiring a consumer credit reporting agency to offer identity theft prevention and mitigation services in the case of a breach of the security of such agency's system

download bill text pdf

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
May 09, 2018	print number 6923a
May 09, 2018	amend (t) and recommit to consumer protection
Jan 03, 2018	referred to consumer protection
Oct 18, 2017	referred to rules

Bill Amendments

Original

A (Active)

2017-S6923 - Details

See Assembly Version of this Bill:: A8695
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L
Versions Introduced in 2019-2020 Legislative Session:: S3582, A2374

2017-S6923 - Summary

Relates to requiring a consumer credit reporting agency to offer identity theft prevention and mitigation services in the case of a breach of the security of such agency's system.

2017-S6923 - Sponsor Memo

                                
 
BILL NUMBER: S6923

SPONSOR: CARLUCCI
 
TITLE OF BILL:  An act to amend the general business law, in relation
to prohibiting fees for security freezes by consumer credit reporting
agencies in the case of a breach of information

 
PURPOSE OR GENERAL IDEA OF BILL:

This bill would provide reasonable consumer protections following a
breach of consumer credit data at a credit reporting agency (CRA), when
such a breach involves social security numbers.

 
SUMMARY OF SPECIFIC PROVISIONS:

Section 1 amends subdivision n of section 380-t of the general business
law by adding a new paragraph 3 that would require that when a credit
reporting agency suffers a breach of information containing consumer
social security numbers, the CRA must provide lifetime identity theft
prevention services, and if applicable, identity theft mitigation
services to affected customers. Additionally, this new paragraph would

prohibit fees relating to the implementation and lifting of security
freezes on consumer credit reports, if those reports were part of a
breach of information containing social security numbers.

Section 2 amends subdivision q of section 380-t of the general business
law by including new language to be included in a consumers summary of
rights CRAB must provide consumers on credit freezes to inform them that
in the instance of a breach of date involving a social security number,
that a consumer has the right to freeze their credit at no cost.

Section 3 sets the effective date.

 
JUSTIFICATION:

In late July 2017, one of the three main CRAB, Equifax Inc., experienced
a major data breach involving personal information that included theft
of social security numbers. At the time it was widely reported to impact
over 140 million accounts, but the full extent of the breach is still
uncertain. CRAB have been the subject of public scrutiny in years past
for their inaccurate files kept on unknowing consumers and the cumber-
some process they subject average people to in order to rectify such
errors. The magnitude of this breach won't be known for years, but the
status quo where consumers must bear the burden to protect their own
identities is unacceptable. To date, Equifax has offered to waive fees
for security freezes for a short time period, and offered 12 months of
identity theft prevention services at no charge. This response is simply
insufficient given that innocent people's information was stolen through
no fault of their own. This legislation aims to establish the minimal
amount of long term protection consumers could ask for, and even still
it is just that, the bare minimum.

 
PRIOR LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS TO THE STATE:

None to the state.
 
EFFECTIVE DATE:  This act shall take effect immediately and shall be
deemed to have been in full force and effect on and after July 1, 2017.

2017-S6923 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6923
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                             October 18, 2017
                                ___________
 
 Introduced  by Sen. CARLUCCI -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the general business law,  in  relation  to  prohibiting
   fees for security freezes by consumer credit reporting agencies in the
   case of a breach of information

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Subdivision (n) of section 380-t of  the  general  business
 law is amended by adding a new paragraph 3 to read as follows:
   (3)(I)  UPON  A  BREACH  OF DATA OF A CONSUMER CREDIT REPORTING AGENCY
 WHICH INCLUDES ANY SOCIAL SECURITY NUMBER, SUCH AGENCY  SHALL  OFFER  TO
 EACH  CONSUMER, WHOSE INFORMATION, INCLUDING SOCIAL SECURITY NUMBER, WAS
 BREACHED OR IS REASONABLY BELIEVED  TO  HAVE  BEEN  BREACHED,  UNLIMITED
 REASONABLE  IDENTITY THEFT PREVENTION SERVICES AND, IF APPLICABLE, IDEN-
 TIFY THEFT MITIGATION SERVICES AT NO COST TO SUCH CONSUMERS. SUCH AGENCY
 SHALL PROVIDE ALL INFORMATION NECESSARY FOR SUCH CONSUMER TO  ENROLL  IN
 SUCH  SERVICES  AND  SHALL  INCLUDE INFORMATION ON HOW SUCH CONSUMER CAN
 REQUEST A SECURITY FREEZE. SUCH SERVICES ARE NOT REQUIRED IF,  AFTER  AN
 APPROPRIATE  INVESTIGATION,  THE  AGENCY  REASONABLY DETERMINES THAT THE
 BREACH OF SECURITY IS UNLIKELY TO RESULT IN HARM TO THE CONSUMERS  WHOSE
 INFORMATION HAS BEEN BREACHED.
   (II) UPON A BREACH OF DATA OF A CONSUMER CREDIT REPORTING AGENCY WHICH
 INCLUDES ANY SOCIAL SECURITY NUMBER, NO CONSUMER CREDIT REPORTING AGENCY
 SHALL,  AT ANY TIME, CHARGE A FEE TO A CONSUMER REQUESTING THE PLACEMENT
 OF A SECURITY FREEZE, OR FOR ANY SUBSEQUENT REMOVAL OF A FREEZE  OR  THE
 TEMPORARY LIFT OF A FREEZE FOR A SPECIFIC PARTY OR PERIOD OF TIME OR FOR
 THE ISSUANCE OF A REPLACEMENT PERSONAL IDENTIFICATION NUMBER OR PASSWORD
 WHEN  THE CONSUMER FAILS TO RETAIN THE PERSONAL IDENTIFICATION NUMBER OR
 PASSWORD PROVIDED TO SUCH CONSUMER BY  SUCH  CONSUMER  CREDIT  REPORTING
 AGENCY.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13504-03-7

 S. 6923                             2
 
   (III)  "BREACH  OF  THE SECURITY" AS USED IN THIS PARAGRAPH SHALL MEAN
 THE UNAUTHORIZED ACQUISITION OR ACQUISITION WITHOUT VALID  AUTHORIZATION
 OF  COMPUTERIZED DATA THAT COMPROMISES THE SECURITY, CONFIDENTIALITY, OR
 INTEGRITY OF PRIVATE INFORMATION.  GOOD  FAITH  ACQUISITION  OF  PRIVATE
 INFORMATION  BY AN EMPLOYEE OR AGENT OF THE BUSINESS FOR THE PURPOSES OF
 THE BUSINESS IS NOT A BREACH OF THE SECURITY  OF  THE  SYSTEM,  PROVIDED
 THAT  THE  PRIVATE  INFORMATION  IS  NOT USED OR SUBJECT TO UNAUTHORIZED
 DISCLOSURE.
   § 2. Subdivision (q) of section 380-t of the general business law,  as
 amended  by  chapter  279  of  the  laws  of 2008, is amended to read as
 follows:
   (q) (1) Any time a consumer credit reporting  agency  is  required  to
 send  a  summary  of rights required under 15 U.S.C. section 1681g, to a
 consumer residing in this state the following notice shall  be  included
 with such summary of rights:
   "NEW YORK CONSUMERS HAVE THE RIGHT TO OBTAIN A SECURITY FREEZE.
   YOU  HAVE  A RIGHT TO PLACE A "SECURITY FREEZE" ON YOUR CREDIT REPORT,
 WHICH WILL PROHIBIT A CONSUMER CREDIT REPORTING  AGENCY  FROM  RELEASING
 INFORMATION  IN YOUR CREDIT REPORT WITHOUT YOUR EXPRESS AUTHORIZATION. A
 SECURITY FREEZE MUST  BE  REQUESTED  IN  WRITING  DELIVERY  CONFIRMATION
 REQUESTED  OR  VIA  TELEPHONE, SECURE ELECTRONIC MEANS, OR OTHER METHODS
 DEVELOPED BY THE CONSUMER CREDIT REPORTING AGENCY. THE  SECURITY  FREEZE
 IS  DESIGNED  TO PREVENT CREDIT, LOANS, AND SERVICES FROM BEING APPROVED
 IN YOUR NAME WITHOUT YOUR CONSENT.  IN THE CASE OF A SECURITY BREACH  OF
 DATA  OF  A  CONSUMER  CREDIT REPORTING AGENCY WHICH INCLUDES ANY SOCIAL
 SECURITY NUMBER YOU HAVE A RIGHT TO REQUEST  A  SECURITY  FREEZE  AT  NO
 COST.  HOWEVER, YOU SHOULD BE AWARE THAT USING A SECURITY FREEZE TO TAKE
 CONTROL OVER WHO GETS ACCESS TO THE PERSONAL AND  FINANCIAL  INFORMATION
 IN  YOUR CREDIT REPORT MAY DELAY, INTERFERE WITH, OR PROHIBIT THE TIMELY
 APPROVAL OF ANY SUBSEQUENT REQUEST OR APPLICATION YOU MAKE  REGARDING  A
 NEW  LOAN, CREDIT, MORTGAGE, GOVERNMENT SERVICES OR PAYMENTS, INSURANCE,
 RENTAL HOUSING, EMPLOYMENT, INVESTMENT, LICENSE, CELLULAR PHONE,  UTILI-
 TIES,  DIGITAL  SIGNATURE,  INTERNET  CREDIT  CARD TRANSACTION, OR OTHER
 SERVICES, INCLUDING AN EXTENSION OF CREDIT AT POINT OF  SALE.  WHEN  YOU
 PLACE  A  SECURITY  FREEZE ON YOUR CREDIT REPORT, YOU WILL BE PROVIDED A
 PERSONAL IDENTIFICATION NUMBER OR PASSWORD  TO  USE  IF  YOU  CHOOSE  TO
 REMOVE THE FREEZE ON YOUR CREDIT REPORT OR AUTHORIZE THE RELEASE OF YOUR
 CREDIT  REPORT  TO  A  SPECIFIC  PARTY OR FOR A PERIOD OF TIME AFTER THE
 FREEZE IS IN PLACE. TO PROVIDE THAT AUTHORIZATION YOU MUST  CONTACT  THE
 CONSUMER CREDIT REPORTING AGENCY AND PROVIDE ALL OF THE FOLLOWING:
   (1) THE PERSONAL IDENTIFICATION NUMBER OR PASSWORD;
   (2) PROPER IDENTIFICATION TO VERIFY YOUR IDENTITY;
   (3)  THE  PROPER INFORMATION REGARDING THE PARTY OR PARTIES WHO ARE TO
 RECEIVE THE CREDIT REPORT OR THE PERIOD OF TIME  FOR  WHICH  THE  REPORT
 SHALL BE AVAILABLE TO USERS OF THE CREDIT REPORT; AND
   (4) PAYMENT OF ANY APPLICABLE FEE.
   A  CONSUMER CREDIT REPORTING AGENCY MUST AUTHORIZE THE RELEASE OF YOUR
 CREDIT REPORT NO LATER THAN THREE  BUSINESS  DAYS  AFTER  RECEIVING  THE
 ABOVE  INFORMATION.  EFFECTIVE  SEPTEMBER  FIRST,  TWO  THOUSAND NINE, A
 CONSUMER CREDIT REPORTING AGENCY THAT RECEIVES A REQUEST  VIA  TELEPHONE
 OR  SECURE  ELECTRONIC  METHOD  SHALL RELEASE A CONSUMER'S CREDIT REPORT
 WITHIN FIFTEEN MINUTES WHEN THE REQUEST IS RECEIVED.
   A SECURITY FREEZE DOES NOT APPLY TO CIRCUMSTANCES IN WHICH YOU HAVE AN
 EXISTING ACCOUNT RELATIONSHIP AND A COPY OF YOUR REPORT IS REQUESTED  BY
 YOUR  EXISTING CREDITOR OR ITS AGENTS OR AFFILIATES FOR CERTAIN TYPES OF
 ACCOUNT REVIEW, COLLECTION, FRAUD CONTROL OR SIMILAR ACTIVITIES.

 S. 6923                             3
 
   IF YOU ARE ACTIVELY SEEKING CREDIT, YOU  SHOULD  UNDERSTAND  THAT  THE
 PROCEDURES  INVOLVED IN LIFTING A SECURITY FREEZE MAY SLOW YOUR APPLICA-
 TION FOR CREDIT. YOU  SHOULD  PLAN  AHEAD  AND  LIFT  A  FREEZE,  EITHER
 COMPLETELY  IF  YOU  ARE  SHOPPING AROUND, OR SPECIFICALLY FOR A CERTAIN
 CREDITOR,  BEFORE APPLYING FOR NEW CREDIT. WHEN SEEKING CREDIT OR PURSU-
 ING ANOTHER TRANSACTION REQUIRING ACCESS TO YOUR CREDIT  REPORT,  IT  IS
 NOT  NECESSARY  TO  RELINQUISH  YOUR  PIN OR PASSWORD TO THE CREDITOR OR
 BUSINESS; YOU CAN CONTACT THE CONSUMER CREDIT REPORTING AGENCY DIRECTLY.
 IF YOU CHOOSE TO GIVE OUT YOUR PIN OR PASSWORD TO THE CREDITOR OR  BUSI-
 NESS,  IT  IS RECOMMENDED THAT YOU OBTAIN A NEW PIN OR PASSWORD FROM THE
 CONSUMER CREDIT REPORTING AGENCY."
   (2) If a consumer requests information about a security  freeze,  such
 consumer shall be provided with the notice set forth in paragraph one of
 this  subdivision  and  with  any  other information necessary to place,
 temporarily lift or permanently lift a security  freeze,  including  but
 not  limited  to  the  address,  telephone number or point of contact at
 which the consumer credit reporting agency receives such requests.
   § 3. This act shall take effect immediately and  shall  be  deemed  to
 have been in full force and effect on and after July 1, 2017.

2017-S6923A (ACTIVE) - Details

See Assembly Version of this Bill:: A8695
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Amd §380-t, Gen Bus L
Versions Introduced in 2019-2020 Legislative Session:: S3582, A2374

2017-S6923A (ACTIVE) - Summary

Relates to requiring a consumer credit reporting agency to offer identity theft prevention and mitigation services in the case of a breach of the security of such agency's system.

2017-S6923A (ACTIVE) - Sponsor Memo

                                
 
BILL NUMBER: S6923A

SPONSOR: CARLUCCI
 
TITLE OF BILL:  An act to amend the general business law, in relation
to requiring a consumer credit reporting agency to offer identity theft
prevention and mitigation services in the case of a breach of the secu-
rity of such agency's system

 
PURPOSE OR GENERAL IDEA OF BILL:

This bill would require a consumer credit reporting agency to provide
reasonable identity theft prevention/mitigation services to a consumer
at no cost following a breach of the security of the system of such
agency involving a consumer's social security number.

 
SUMMARY OF SPECIFIC PROVISIONS:

Section 1 amends subdivision n of section 380-t of the general business
law by adding a new paragraph 3 that would require that when a consumer
credit reporting agency suffers a breach of the security of their system
which includes consumer social security numbers, such agency must offer

to provide reasonable identity theft prevention services, and if appli-
cable, identity theft mitigation services to affected consumers for a
period not to exceed five years at no cost to such consumers.

Section 2 sets the effective date.

 
JUSTIFICATION:

In late July 2017, one of the three main CRAs, Equifax Inc., experienced
a major data breach involving personal information that included theft
of social security numbers. At the time it was widely reported to impact
over 140 million accounts, but the full extent of the breach is still
uncertain. CRAs have been the subject of public scrutiny in years past
for their inaccurate files kept on unknowing consumers and the cumber-
some process they subject average people to in order to rectify such
errors. The magnitude of this breach won't be known for years, but the
status quo where consumers must bear the burden to protect their own
identities is unacceptable. To date, Equifax has offered to waive fees
for security freezes for a short time period, and offered 12 months of
identity theft prevention services at no charge. This response is simply
insufficient given that innocent people's information was stolen through
no fault of their own. This legislation aims to establish the minimal
amount of long term protection consumers could ask for, and even still
it is just that, the bare minimum.

 
PRIOR LEGISLATIVE HISTORY:

This is a new bill.

 
FISCAL IMPLICATIONS TO THE STATE:

None to the state.

 
EFFECTIVE DATE:
This act shall take effect on the sixtieth day after it shall have
become a law and shall apply to any breach of the security of the system
of a consumer credit reporting agency that occurred no more than three
years prior to the effective date of this act.

2017-S6923A (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  6923--A
 
                        2017-2018 Regular Sessions
 
                             I N  S E N A T E
 
                             October 18, 2017
                                ___________
 
 Introduced  by Sen. CARLUCCI -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules  --  recommitted  to
   the Committee on Consumer Protection in accordance with Senate Rule 6,
   sec.  8  --  committee  discharged, bill amended, ordered reprinted as
   amended and recommitted to said committee

 AN ACT to amend the general business law, in  relation  to  requiring  a
   consumer  credit  reporting  agency to offer identity theft prevention
   and mitigation services in the case of a breach  of  the  security  of
   such agency's system
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Subdivision (n) of section 380-t of  the  general  business
 law is amended by adding a new paragraph 3 to read as follows:
   (3)(I) UPON A BREACH OF THE SECURITY OF THE SYSTEM OF A CONSUMER CRED-
 IT  REPORTING  AGENCY  WHICH  INCLUDES  ANY SOCIAL SECURITY NUMBER, SUCH
 AGENCY SHALL OFFER TO EACH CONSUMER, WHOSE INFORMATION, INCLUDING SOCIAL
 SECURITY NUMBER, WAS BREACHED OR IS REASONABLY  BELIEVED  TO  HAVE  BEEN
 BREACHED, REASONABLE IDENTITY THEFT PREVENTION SERVICES AND, IF APPLICA-
 BLE,  IDENTIFY THEFT MITIGATION SERVICES FOR A PERIOD NOT TO EXCEED FIVE
 YEARS AT NO COST TO SUCH CONSUMERS. SUCH AGENCY SHALL PROVIDE ALL INFOR-
 MATION NECESSARY FOR SUCH CONSUMERS TO ENROLL IN SUCH SERVICES AND SHALL
 INCLUDE INFORMATION ON HOW SUCH CONSUMERS CAN REQUEST A SECURITY FREEZE.
 A CONSUMER CREDIT REPORTING AGENCY SHALL NOT BE REQUIRED TO  OFFER  SUCH
 SERVICES  IF,  AFTER AN APPROPRIATE INVESTIGATION, THE AGENCY REASONABLY
 DETERMINES THAT THE BREACH OF SECURITY IS UNLIKELY TO RESULT IN HARM  TO
 THE CONSUMERS WHOSE INFORMATION HAS BEEN BREACHED.
   (II)  "BREACH OF THE SECURITY OF THE SYSTEM" AS USED IN THIS PARAGRAPH
 SHALL HAVE THE SAME DEFINITION AS IN PARAGRAPH (C) OF SUBDIVISION ONE OF
 SECTION EIGHT HUNDRED NINETY-NINE-AA OF THIS CHAPTER.
   § 2.  This act shall take effect on the sixtieth day  after  it  shall
 have  become  a law and shall apply to any breach of the security of the
 system of a consumer credit reporting agency that occurred no more  than
 three years prior to the effective date of this act.

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD13504-07-8

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.