S T A T E O F N E W Y O R K
________________________________________________________________________
2087
2021-2022 Regular Sessions
I N S E N A T E
January 19, 2021
___________
Introduced by Sens. JORDAN, GOUNARDES -- read twice and ordered printed,
and when printed to be committed to the Committee on Budget and Reven-
ue
AN ACT to amend the tax law, in relation to a business tax credit for
purchase of data breach insurance; and providing for the repeal of
such provisions upon expiration thereof
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Section 210-B of the tax law is amended by adding a new
subdivision 55 to read as follows:
55. DATA BREACH INSURANCE CREDIT. (A) A TAXPAYER THAT IS A BUSINESS OR
OWNER OF A BUSINESS SHALL BE ALLOWED A CREDIT AGAINST THE TAX IMPOSED BY
THIS ARTICLE EQUAL TO TWENTY-FIVE PERCENT OF THE PREMIUM PAID DURING THE
TAXABLE YEAR FOR QUALIFIED DATA BREACH INSURANCE. FOR PURPOSES OF THIS
SECTION, THE TERM "QUALIFIED DATA BREACH INSURANCE" MEANS COVERAGE
PROVIDED BY AN INSURANCE COMPANY FOR EXPENSES OR LOSSES IN CONNECTION
WITH THE THEFT, LOSS, DISCLOSURE, INACCESSIBILITY, OR MANIPULATION, OF
DATA.
(B) IN ORDER TO QUALIFY FOR SUCH CREDIT, TAXPAYERS SHALL ADOPT AND BE
IN COMPLIANCE WITH ONE OF THE FOLLOWING:
(1) VERSION 1.0 OF THE FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE
CYBERSECURITY PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY AS IN EFFECT ON FEBRUARY TWELFTH, TWO THOUSAND FOURTEEN OR SUBSE-
QUENT VERSIONS OR ITERATIONS; OR
(2) ANY SIMILAR STANDARD SPECIFIED BY THE STATE COMPTROLLER, AFTER
CONSULTATION WITH THE DIRECTOR OF THE OFFICE OF INFORMATION TECHNOLOGY
SERVICES.
(C) IN THE CASE OF INSURANCE COVERAGE UNDER WHICH AMOUNTS ARE PAYABLE
FOR OTHER THAN EXPENSES OR LOSSES DESCRIBED IN PARAGRAPH (A) OF THIS
SUBDIVISION:
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01410-01-1
S. 2087 2
(1) NO AMOUNT SHALL BE TREATED AS PREMIUMS FOR QUALIFIED DATA BREACH
INSURANCE UNLESS THE CHARGE FOR SUCH INSURANCE IS EITHER SEPARATELY
STATED IN THE CONTRACT, OR FURNISHED TO THE POLICYHOLDER BY THE INSUR-
ANCE COMPANY IN A SEPARATE STATEMENT;
(2) THE AMOUNT TAKEN INTO ACCOUNT AS THE PREMIUM PAID OR INCURRED FOR
SUCH INSURANCE SHALL NOT EXCEED SUCH CHARGE; AND
(3) NO AMOUNT SHALL BE TREATED AS PAID OR INCURRED FOR SUCH INSURANCE
IF THE AMOUNT SPECIFIED IN THE CONTRACT, OR FURNISHED TO THE POLICY-
HOLDER BY THE INSURANCE COMPANY IN A SEPARATE STATEMENT, AS THE CHARGE
FOR SUCH INSURANCE IS UNREASONABLY LARGE IN RELATION TO THE TOTAL CHARG-
ES UNDER THE CONTRACT.
(D) PREMIUMS SHALL BE TAKEN INTO ACCOUNT UNDER PARAGRAPH (A) OF THIS
SUBDIVISION ONLY IF SUCH PREMIUMS ARE PAID OR INCURRED IN THE ORDINARY
COURSE OF THE TAXPAYER'S TRADE OR BUSINESS.
(E) THIS SUBDIVISION SHALL NOT APPLY TO A BUSINESS WHICH EMPLOYS ONE
HUNDRED AND ONE OR MORE EMPLOYEES.
§ 2. Section 606 of the tax law is amended by adding a new subsection
(kkk) to read as follows:
(KKK) DATA BREACH INSURANCE CREDIT. (1) A TAXPAYER THAT IS A BUSINESS
OR OWNER OF A BUSINESS SHALL BE ALLOWED A CREDIT AGAINST THE TAX IMPOSED
BY THIS ARTICLE EQUAL TO TWENTY-FIVE PERCENT OF THE PREMIUM PAID DURING
THE TAXABLE YEAR FOR QUALIFIED DATA BREACH INSURANCE. FOR PURPOSES OF
THIS SECTION, THE TERM "QUALIFIED DATA BREACH INSURANCE" MEANS COVERAGE
PROVIDED BY AN INSURANCE COMPANY FOR EXPENSES OR LOSSES IN CONNECTION
WITH THE THEFT, LOSS, DISCLOSURE, INACCESSIBILITY, OR MANIPULATION, OF
DATA.
(2) IN ORDER TO QUALIFY FOR SUCH CREDIT, TAXPAYERS SHALL ADOPT AND BE
IN COMPLIANCE WITH ONE OF THE FOLLOWING:
(A) VERSION 1.0 OF THE FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE
CYBERSECURITY PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY AS IN EFFECT ON FEBRUARY TWELFTH, TWO THOUSAND FOURTEEN OR SUBSE-
QUENT VERSIONS OR ITERATIONS; OR
(B) ANY SIMILAR STANDARD SPECIFIED BY THE STATE COMPTROLLER, AFTER
CONSULTATION WITH THE DIRECTOR OF THE OFFICE OF INFORMATION TECHNOLOGY
SERVICES.
(3) IN THE CASE OF INSURANCE COVERAGE UNDER WHICH AMOUNTS ARE PAYABLE
FOR OTHER THAN EXPENSES OR LOSSES DESCRIBED IN PARAGRAPH ONE OF THIS
SUBSECTION:
(A) NO AMOUNT SHALL BE TREATED AS PREMIUMS FOR QUALIFIED DATA BREACH
INSURANCE UNLESS THE CHARGE FOR SUCH INSURANCE IS EITHER SEPARATELY
STATED IN THE CONTRACT, OR FURNISHED TO THE POLICYHOLDER BY THE INSUR-
ANCE COMPANY IN A SEPARATE STATEMENT;
(B) THE AMOUNT TAKEN INTO ACCOUNT AS THE PREMIUM PAID OR INCURRED FOR
SUCH INSURANCE SHALL NOT EXCEED SUCH CHARGE; AND
(C) NO AMOUNT SHALL BE TREATED AS PAID OR INCURRED FOR SUCH INSURANCE
IF THE AMOUNT SPECIFIED IN THE CONTRACT, OR FURNISHED TO THE POLICY-
HOLDER BY THE INSURANCE COMPANY IN A SEPARATE STATEMENT, AS THE CHARGE
FOR SUCH INSURANCE IS UNREASONABLY LARGE IN RELATION TO THE TOTAL CHARG-
ES UNDER THE CONTRACT.
(4) PREMIUMS SHALL BE TAKEN INTO ACCOUNT UNDER PARAGRAPH ONE OF THIS
SUBSECTION ONLY IF SUCH PREMIUMS ARE PAID OR INCURRED IN THE ORDINARY
COURSE OF THE TAXPAYER'S TRADE OR BUSINESS.
(5) THIS SUBSECTION SHALL NOT APPLY TO A BUSINESS WHICH EMPLOYS ONE
HUNDRED AND ONE OR MORE EMPLOYEES.
S. 2087 3
§ 3. Subparagraph (B) of paragraph 1 of subsection (i) of section 606
of the tax law is amended by adding a new clause (xlvi) to read as
follows:
(XLVI) DATA BREACH INSURANCE AMOUNT OF CREDIT UNDER SUBDIVISION
CREDIT UNDER SUBSECTION (KKK) FIFTY-FIVE OF SECTION TWO HUNDRED
TEN-B
§ 4. This act shall take effect immediately and shall apply to taxable
years beginning on and after the first of January next succeeding the
date on which it shall have become a law and shall remain in effect for
five years after it shall have become a law, when upon such date the
provisions of this act shall expire and be deemed repealed.