NY State Senate Bill 2019-S5721A

Senate Bill S5721A

2019-2020 Legislative Session

Requires certain businesses to offer identity theft prevention and mitigation services in the case of a security breach

download bill text pdf

Archive: Last Bill Status - In Senate Committee Internet And Technology Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 08, 2020	referred to internet and technology returned to senate died in assembly
Jun 18, 2019	referred to consumer affairs and protection delivered to assembly passed senate ordered to third reading cal.1515 committee discharged and committed to rules
May 20, 2019	print number 5721a
May 20, 2019	amend and recommit to internet and technology
May 13, 2019	referred to internet and technology

Votes

- Jun 18, 2019 - Floor Vote
  S5721A
  
  44
  
  Aye
  
  18
  
  Nay
  
  0
  
  Absent
  
  0
  
  Excused
  
  0
  
  Abstained
  - - Floor Vote: Jun 18, 2019
      
      aye (44)
      
      Addabbo Jr.
      
      Akshar
      
      Bailey
      
      Benjamin
      
      Biaggi
      
      Boyle
      
      Breslin
      
      Brooks
      
      Carlucci
      
      Comrie
      
      Felder
      
      Gaughran
      
      Gianaris
      
      Gounardes
      
      Harckham
      
      Hoylman-Sigal
      
      Jackson
      
      Kaminsky
      
      Kaplan
      
      Kavanagh
      
      Kennedy
      
      Krueger
      
      Liu
      
      Martinez
      
      May
      
      Mayer
      
      Metzger
      
      Montgomery
      
      Myrie
      
      Parker
      
      Persaud
      
      Ramos
      
      Ritchie
      
      Rivera
      
      Robach
      
      Salazar
      
      Sanders Jr.
      
      Savino
      
      Sepúlveda
      
      Serrano
      
      Skoufis
      
      Stavisky
      
      Stewart-Cousins
      
      Thomas
      
      nay (18)
      
      Amedore
      
      Antonacci
      
      Flanagan
      
      Funke
      
      Gallivan
      
      Griffo
      
      Helming
      
      Jacobs
      
      Jordan
      
      LaValle
      
      Lanza
      
      Little
      
      O'Mara
      
      Ortt
      
      Ranzenhofer
      
      Serino
      
      Seward
      
      Tedisco
  Jun 18, 2019 - Rules Committee Vote
  S5721A
  
  13
  
  Aye
  
  5
  
  Nay
  
  1
  
  Aye with Reservations
  
  0
  
  Absent
  
  0
  
  Excused
  
  0
  
  Abstained
  - - Rules Committee Vote: Jun 18, 2019
      
      aye (13)
      
      Benjamin
      
      Breslin
      
      Comrie
      
      Gianaris
      
      Hoylman-Sigal
      
      Kennedy
      
      Krueger
      
      Liu
      
      Martinez
      
      Parker
      
      Robach
      
      Savino
      
      Stewart-Cousins
      
      nay (5)
      
      Flanagan
      
      LaValle
      
      Lanza
      
      Little
      
      Seward
      
      aye wr (1)
      
      Griffo

Bill Amendments

Original

A (Active)

2019-S5721 - Details

See Assembly Version of this Bill:: A7897
Current Committee:: Senate Internet And Technology
Law Section:: General Business Law
Laws Affected:: Amd §899-aa, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2021-2022: S3161, A3088
2023-2024: S700, A1725

2019-S5721 - Summary

Requires certain businesses to offer identity theft prevention and mitigation services in the case of a security breach; exempts businesses under financial hardship.

2019-S5721 - Sponsor Memo

                                
 
BILL NUMBER: S5721

SPONSOR: COMRIE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to requiring certain businesses to offer identity theft prevention and
mitigation services in the case of a security breach

 
PURPOSE OR GENERAL IDEA OF BILL:

To require businesses that suffer a data/security breach to offer free,
reasonable credit report monitoring, identify theft prevention services,
and, in certain applicable situations-identity theft mitigation
services.

 
SUMMARY OF PROVISIONS:

This bill amends the General Business Law to require businesses that
suffer a data/security breach to offer free, reasonable credit report
monitoring, and identify theft prevention services.

Furthermore, in the case of a data/security breach that involves the

disclosure of a Social Security Number-identity theft mitigation
services are required for a two year period.

An exemption process from the provision of identity theft mitigation
services for small businesses is provided for; which allows for consid-
eration of financial hardship.

 
JUSTIFICATION:

Data and security breaches are an all too common occurrence in the
modern age. Such breaches occur among many large corporations such as
Yahoo, Marriott, EBay, Target and JP Morgan. The theft of personal data,
including Social Security Numbers puts consumers at inordinate risk for
dire financial consequences, such as having their identity stolen and
their credit totally ruined.

This legislation requires breached entities to act in a responsible
manner toward those customers who were violated via offering free,
reasonable credit report monitoring, and identify theft prevention
services to those affected.

In addition where the disclosure of a Social Security Number is
involved, identity theft mitigation services are required for a two year
period.

Small Businesses, which may be unduly burdened by the identity theft
mitigation services requirement, may apply for a financial hardship
exemption.

 
PRIOR LEGISLATIVE HISTORY:

New Proposal-May of 2019.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the 180th day after it shall have become a
law. Effective immediately, the addition, amendment and/or repeal of any
rule or regulation necessary for the implementation of this act on its
effective date is authorized to be made and completed on or before such
date.

2019-S5721 - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   5721
 
                        2019-2020 Regular Sessions
 
                             I N  S E N A T E
 
                               May 13, 2019
                                ___________
 
 Introduced  by  Sen.  COMRIE -- read twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology
 
 AN ACT to amend the general  business  law,  in  relation  to  requiring
   certain  businesses  to offer identity theft prevention and mitigation
   services in the case of a security breach

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Subdivision  2  of section 899-aa of the general business
 law, as added by chapter 442 of the laws of 2005, is amended and  a  new
 subdivision 10 is added to read as follows:
   2.  Any  person or business which conducts business in New York state,
 and which owns or licenses  computerized  data  which  includes  private
 information  shall  disclose  any  breach  of the security of the system
 following discovery or notification of the breach in the security of the
 system to any resident of New York state whose private information  was,
 or  is  reasonably  believed  to have been, acquired by a person without
 valid authorization. The disclosure shall be made in the most  expedient
 time possible and without unreasonable delay, consistent with the legit-
 imate  needs of law enforcement, as provided in subdivision four of this
 section, or any measures necessary to determine the scope of the  breach
 and  restore  the  reasonable  integrity of the system.   THE DISCLOSURE
 REQUIRED BY THIS SUBDIVISION SHALL INCLUDE  SUFFICIENT  INFORMATION  FOR
 ANY  RESIDENT  OF  NEW  YORK  STATE WHOSE PRIVATE INFORMATION WAS, OR IS
 REASONABLY BELIEVED TO HAVE BEEN, ACQUIRED BY  A  PERSON  WITHOUT  VALID
 AUTHORIZATION,  TO  OBTAIN  FREE,  REASONABLE  CREDIT REPORT MONITORING,
 IDENTITY THEFT PREVENTION SERVICES AND, IF  APPLICABLE,  IDENTITY  THEFT
 MITIGATION SERVICES AS DESCRIBED IN SUBDIVISION TEN OF THIS SECTION.
   10. (A) WHERE A SECURITY BREACH FROM A PERSON OR BUSINESS OTHER THAN A
 CONSUMER  CREDIT REPORTING AGENCY INCLUDES A SOCIAL SECURITY NUMBER, AND
 THAT PERSON OR BUSINESS THAT IS REQUIRED TO PROVIDE NOTICE UNDER  SUBDI-
 VISION  TWO  OF  THIS  SECTION, THAT PERSON OR BUSINESS SHALL OFFER EACH
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD11671-01-9

 S. 5721                             2
 
 RESIDENT OF THIS STATE WHOSE SOCIAL SECURITY NUMBER WAS DISCLOSED IN THE
 BREACH OF SECURITY OR IS REASONABLY BELIEVED TO HAVE BEEN  DISCLOSED  IN
 THE  BREACH  OF  SECURITY, REASONABLE CREDIT REPORT MONITORING, IDENTITY
 THEFT  PREVENTION SERVICES AND, IF APPLICABLE, IDENTITY THEFT MITIGATION
 SERVICES AT NO COST TO SAID RESIDENT FOR A PERIOD OF NOT LESS THAN TWEN-
 TY-FOUR MONTHS.
   (B) THE REQUIREMENT TO PROVIDE TWENTY-FOUR MONTHS  OF  IDENTITY  THEFT
 MITIGATION  SERVICES  SHALL  NOT APPLY TO ANY INDIVIDUAL PERSON OR SMALL
 BUSINESS AS DEFINED IN SECTION ONE HUNDRED THIRTY-ONE  OF  THE  ECONOMIC
 DEVELOPMENT LAW THAT CAN DEMONSTRATE A FINANCIAL HARDSHIP DIRECTLY OWING
 TO  SUCH  COMPLIANCE. A REQUEST FOR A FINANCIAL HARDSHIP WAIVER SHALL BE
 MADE TO THE COMMISSIONER OF THE DEPARTMENT OF FINANCIAL  SERVICES  ON  A
 FORM PRESCRIBED BY THE DEPARTMENT OF FINANCIAL SERVICES.
   § 2. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.  Effective immediately, the addition, amend-
 ment and/or repeal of any rule or regulation necessary for the implemen-
 tation  of  this act on its effective date are authorized to be made and
 completed on or before such effective date.

2019-S5721A (ACTIVE) - Details

See Assembly Version of this Bill:: A7897
Current Committee:: Senate Internet And Technology
Law Section:: General Business Law
Laws Affected:: Amd §899-aa, Gen Bus L
Versions Introduced in Other Legislative Sessions:: 2021-2022: S3161, A3088
2023-2024: S700, A1725

2019-S5721A (ACTIVE) - Summary

Requires certain businesses to offer identity theft prevention and mitigation services in the case of a security breach; exempts businesses under financial hardship.

2019-S5721A (ACTIVE) - Sponsor Memo

                                
 
BILL NUMBER: S5721A

SPONSOR: COMRIE
 
TITLE OF BILL:  An act to amend the general business law, in relation
to requiring certain businesses to offer identity theft prevention and
mitigation services in the case of a security breach

 
PURPOSE:

This bill would require any person or business to provide free reason-
able credit report monitoring, identity theft prevention services, and
if applicable, identity theft mitigation services should they suffer a
data breach including a consumer's social security number.

 
SUMMARY OF PROVISIONS:

Section one amends section 899-aa of the general business law by adding
a new subdivision 10 that would require any person or business, other
than a credit reporting agency, to provide free reasonable credit report
monitoring, identity theft prevention services, and if applicable, iden-
tity theft mitigation services should they suffer a data breach includ-

ing a consumer's social security number. These services would be
required to be provided to affected consumers for a minimum of two
years. Additionally such person or business would be required to provide
notice to a consumer whose social security number was disclosed on how
to obtain such services free of charge. This section also provides that
any person or small business may apply to the Department of Financial
Services for a financial hardship waiver if they are able to demonstrate
to the Department that these requirements would impose a financial hard-
ship.

Section two sets the effective date.

 
JUSTIFICATION:

Data and security breaches are an all too common occurrence in the
modern age. Such breaches occur among many large corporations such as
Yahoo, Marriott, EBay, Target and JP Morgan. The theft of personal data,
including Social Security Numbers puts consumers at inordinate risk for
dire financial consequences, such as having their identity stolen and
their credit totally ruined.

This legislation would require any person or business to provide free
reasonable credit report monitoring, identity theft prevention services,
and if applicable, identity theft mitigation services should they suffer
a data breach including a consumer's social security number. These
services would be required to be provided to affected consumers for a
minimum of two years. Additionally such person or business would be
required to provide notice to a consumer whose social security number
was disclosed on how to obtain such services free of charge. The bill
also provides that any person or small business may apply to the Depart-
ment of Financial Services for a financial hardship waiver if they are
able to demonstrate to the Department that these requirements would
impose a financial hardship.

 
LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the 180th day after it shall have become
law. Effective immediately, the addition, amendment and/or repeal of any
rule or regulation necessary for the implementation of this act on its
effective date are authorized to be made and completed on or before such
effective date.

2019-S5721A (ACTIVE) - Bill Text download pdf

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  5721--A
 
                        2019-2020 Regular Sessions
 
                             I N  S E N A T E
 
                               May 13, 2019
                                ___________
 
 Introduced  by  Sen.  COMRIE -- read twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology --
   committee discharged, bill amended, ordered reprinted as  amended  and
   recommitted to said committee
 
 AN  ACT  to  amend  the  general  business law, in relation to requiring
   certain businesses to offer identity theft prevention  and  mitigation
   services in the case of a security breach
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Section 899-aa of the general business law  is  amended  by
 adding a new subdivision 10 to read as follows:
   10. (A) WHERE A SECURITY BREACH FROM A PERSON OR BUSINESS OTHER THAN A
 CONSUMER  CREDIT REPORTING AGENCY INCLUDES A SOCIAL SECURITY NUMBER, AND
 THAT PERSON OR BUSINESS IS REQUIRED TO PROVIDE NOTICE UNDER  SUBDIVISION
 TWO  OF  THIS SECTION, THAT PERSON OR BUSINESS SHALL OFFER EACH RESIDENT
 OF THIS STATE WHOSE SOCIAL SECURITY NUMBER WAS DISCLOSED IN  THE  BREACH
 OF  SECURITY  OR  IS  REASONABLY  BELIEVED TO HAVE BEEN DISCLOSED IN THE
 BREACH OF SECURITY, REASONABLE CREDIT REPORT MONITORING, IDENTITY  THEFT
 PREVENTION  SERVICES  AND,  IF  APPLICABLE,  IDENTITY  THEFT  MITIGATION
 SERVICES AT NO COST TO SAID RESIDENT FOR A PERIOD OF NOT LESS THAN TWEN-
 TY-FOUR MONTHS. THE DISCLOSURE  REQUIRED  BY  SUBDIVISION  TWO  OF  THIS
 SECTION  SHALL  INCLUDE  INFORMATION  FOR ANY RESIDENT OF NEW YORK STATE
 WHOSE SOCIAL SECURITY NUMBER WAS DISCLOSED AS A RESULT OF A DATA  BREACH
 TO  OBTAIN  FREE,  REASONABLE  CREDIT  REPORT MONITORING, IDENTITY THEFT
 PREVENTION  SERVICES  AND,  IF  APPLICABLE,  IDENTITY  THEFT  MITIGATION
 SERVICES AS DESCRIBED IN THIS SECTION.
   (B)  THE  REQUIREMENT  TO PROVIDE TWENTY-FOUR MONTHS OF IDENTITY THEFT
 MITIGATION SERVICES SHALL NOT APPLY TO ANY INDIVIDUAL  PERSON  OR  SMALL
 BUSINESS  AS  DEFINED  IN SECTION ONE HUNDRED THIRTY-ONE OF THE ECONOMIC
 DEVELOPMENT LAW THAT CAN DEMONSTRATE A FINANCIAL HARDSHIP DIRECTLY OWING
 TO SUCH COMPLIANCE. A REQUEST FOR A FINANCIAL HARDSHIP WAIVER  SHALL  BE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD11671-02-9

 S. 5721--A                          2
 
 MADE  TO  THE  COMMISSIONER OF THE DEPARTMENT OF FINANCIAL SERVICES ON A
 FORM PRESCRIBED BY THE DEPARTMENT OF FINANCIAL SERVICES.
   § 2. This act shall take effect on the one hundred eightieth day after
 it shall have become a law.  Effective immediately, the addition, amend-
 ment and/or repeal of any rule or regulation necessary for the implemen-
 tation  of  this act on its effective date are authorized to be made and
 completed on or before such effective date.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.