S T A T E O F N E W Y O R K
________________________________________________________________________
2704
2019-2020 Regular Sessions
I N S E N A T E
January 29, 2019
___________
Introduced by Sen. KENNEDY -- read twice and ordered printed, and when
printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to a consumer
credit reporting agency's actions following a security breach
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Subdivision (n) of section 380-t of the general business
law is amended by adding a new paragraph 3 to read as follows:
(3) NO CONSUMER CREDIT REPORTING AGENCY SHALL CHARGE A FEE TO A
CONSUMER REQUESTING THE PLACEMENT OF A SECURITY FREEZE OR THE LIFTING OF
A SECURITY FREEZE FOLLOWING A SECURITY BREACH OF A CONSUMER CREDIT
REPORTING AGENCY.
FOR THE PURPOSES OF THIS PARAGRAPH, THE TERM "BREACH OF SECURITY"
SHALL MEAN THE UNAUTHORIZED DISCLOSURE OR USE BY AN EMPLOYEE OR AGENT OF
AN AGENCY, OR THE UNAUTHORIZED POSSESSION BY SOMEONE OTHER THAN AN
EMPLOYEE OR AGENT OF AN AGENCY, OF PERSONAL IDENTIFYING INFORMATION THAT
COMPROMISES THE SECURITY, CONFIDENTIALITY OR INTEGRITY OF SUCH INFORMA-
TION. GOOD FAITH OR INADVERTENT POSSESSION OF ANY PERSONAL IDENTIFYING
INFORMATION BY AN EMPLOYEE OR AGENT OF AN AGENCY FOR THE LEGITIMATE
PURPOSES OF THE AGENCY, AND GOOD FAITH OR LEGALLY MANDATED DISCLOSURE OF
ANY PERSONAL IDENTIFYING INFORMATION BY AN EMPLOYEE OR AGENT OF AN AGEN-
CY FOR THE LEGITIMATE PURPOSES OF THE AGENCY SHALL NOT CONSTITUTE A
BREACH OF SECURITY.
§ 2. This act shall take effect immediately and shall apply to any
data breach that occurred on or after January 1, 2019.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04123-01-9