S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7612
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                               May 19, 2021
                                ___________
 
 Introduced by M. of A. OTIS, ZEBROWSKI -- (at request of the State Comp-
   troller)  --  read  once and referred to the Committee on Governmental
   Operations
 
 AN ACT to amend the state technology law, in relation to  the  notifica-
   tion  of  certain  state agencies of a data breach or network security
   breach

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The state technology law is amended by adding a new section
 209 to read as follows:
   §  209. NOTIFICATION OF DATA BREACH OR NETWORK SECURITY BREACH; SHARED
 DATA. 1. THE  OFFICE  SHALL,  WITHIN  TWENTY-FOUR  HOURS  FOLLOWING  THE
 DISCOVERY  OF  A  DATA  BREACH  OR  NETWORK SECURITY BREACH OR RECEIVING
 NOTICE OF A DATA BREACH OR NETWORK SECURITY  BREACH,  NOTIFY  THE  CHIEF
 INFORMATION  OFFICER, AND WHERE APPROPRIATE, THE CHIEF INFORMATION SECU-
 RITY OFFICER, OF ANY STATE ENTITY WITH WHICH IT  SHARES  DATA,  PROVIDES
 NETWORKED  SERVICES  OR SHARES A NETWORK CONNECTION WHOSE DATA, SERVICES
 OR CONNECTION IS OR MAY HAVE BEEN THE SUBJECT OF SUCH BREACH WHETHER  OR
 NOT  SUCH  DATA WAS, OR IS REASONABLY BELIEVED TO HAVE BEEN, ACQUIRED OR
 USED BY AN UNAUTHORIZED PERSON.
    2. THE OFFICE SHALL, IN ADDITION TO THE PROVISIONS OF SUBDIVISION ONE
 OF THIS SECTION, NOTIFY THE CHIEF INFORMATION OFFICER, AND WHERE  APPRO-
 PRIATE,  THE  CHIEF  INFORMATION  SECURITY OFFICER, OF SUCH STATE ENTITY
 WITH WHICH IT SHARES DATA,  PROVIDES  NETWORKED  SERVICES  OR  SHARES  A
 NETWORK  CONNECTION  AND  WHOSE  DATA IS OR MAY HAVE BEEN THE SUBJECT OF
 SUCH BREACH, OF ITS PLAN  FOR  REMEDIATION  OF  THE  BREACH  AND  FUTURE
 PROTECTION OF SUCH DATA AND NETWORK.
   3. FOR PURPOSES OF THIS SECTION:
   (A)  "DATA BREACH" SHALL MEAN AN INTENTIONAL OR UNINTENTIONAL INCIDENT
 WHERE DATA IS DISCLOSED, RELEASED, STOLEN, OR TAKEN  WITHOUT  THE  KNOW-
 LEDGE OR AUTHORIZATION OF THE DATA'S OWNER OR STEWARD.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD10523-01-1

 A. 7612                             2
 
   (B)  "NETWORK  SECURITY  BREACH" SHALL MEAN AN INTENTIONAL OR UNINTEN-
 TIONAL INCIDENT WHERE AN UNAUTHORIZED PARTY  HAS  GAINED  ACCESS  TO  AN
 ORGANIZATION'S  NETWORK  WITHOUT  THE  KNOWLEDGE OR AUTHORIZATION OF THE
 NETWORK OWNER OR STEWARD.
   (C)  "STATE  ENTITY"  SHALL  MEAN  ANY  STATE BOARD, BUREAU, DIVISION,
 COMMITTEE, COMMISSION, COUNCIL,  DEPARTMENT,  PUBLIC  AUTHORITY,  PUBLIC
 BENEFIT  CORPORATION,  OFFICE  OR OTHER GOVERNMENTAL ENTITY PERFORMING A
 GOVERNMENTAL OR PROPRIETARY FUNCTION FOR THE STATE OF NEW YORK,  INCLUD-
 ING THE STATE LEGISLATURE AND THE JUDICIARY.
   § 2.  This act shall take effect immediately.