NY State Senate Bill S7019

Archive: Last Bill Status - Signed by Governor

Introduced
In Committee
On Floor Calendar
- Passed Senate
- Passed Assembly
Delivered to Governor
Signed by Governor

Your Voice

Please enter your contact information

First Name *

Last Name *

Email Address *

A valid email address is required.

Home address search or enter your address manually *

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Leave this field blank

Actions

view actions (13)

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Dec 22, 2021	approval memo.148 signed chap.796
Dec 10, 2021	delivered to governor
Jun 03, 2021	returned to senate passed assembly ordered to third reading rules cal.387 substituted for a7612
Jun 02, 2021	referred to governmental operations delivered to assembly passed senate
Jun 01, 2021	ordered to third reading cal.1416 committee discharged and committed to rules
May 24, 2021	referred to internet and technology

Votes

Co-Sponsors

S7019 (ACTIVE) - Details

See Assembly Version of this Bill:: A7612
Law Section:: State Technology Law
Laws Affected:: Add §209, St Tech L

S7019 (ACTIVE) - Summary

Relates to the notification of certain state agencies within twenty-four hours of a discovery of a data breach or network security breach.

S7019 (ACTIVE) - Sponsor Memo

 
BILL NUMBER: S7019

SPONSOR: KRUEGER
 
TITLE OF BILL:

An act to amend the state technology law, in relation to the notifica-
tion of certain state agencies of a data breach or network security
breach

 
PURPOSE:

This legislation would require the Office of Information Technology
Services to notify, within 24 hours following discovery of a data breach
or receiving notice of a data breach or network security breach, the
chief information officer or where appropriate the chief information
security officer of a state entity with which the office shares data of
such breach.

 
SUMMARY OF SPECIFIC PROVISIONS:

Section 1 of the bill adds a new section 209 to the state technology
law. Subdivision 1 of the new section 209 requires the office, within 24

hours following discovery of a data breach or network security breach,
to notify the chief information officer and where appropriate the chief
information security officer of any state entity with which it shares
data, provides networked services or shares a network connection and
whose data is or may have been the subject of such breach whether or not
such data was, or is reasonably believed to have been, acquired or used
by an unauthorized person.

Subdivision 2 of the new section 209 requires the office to notify the
chief information officer and where appropriate the chief information
security officer of such state entity with which it shares data,
provides networked services or shares a network connection and whose
data is or may have been the subject of such breach of its plan for
remediation of the breach and future protection of such data and
network.

Subdivision 3 defines "data breach" as an intentional or unintentional
incident where data is disclosed, released, stolen, or taken without the
knowledge or authorization of the data's owner or steward.  Addi-
tionally, "network security breach" is defined as an intentional or
unintentional incident where an unauthorized party has gained access to
an organization's network without the knowledge or authorization of the
network owner or steward. Finally, "state entity" is defined as any
state board, bureau, division, committee, commission, council, depart-
ment, public authority, public benefit corporation, office or other
governmental entity performing a governmental or proprietary function
for the state of New York, including the state legislature and the judi-
ciary.

Section 2 of the bill provides for an immediate effective date.

 
JUSTIFICATION:

The Office of Information Technology Services (Office) has, since its
creation in 2002, assumed an interactive role with state entities by
sharing data and providing support serves to these entities. The Office

has access to an unprecedented amount of information and shared
information/data.

It is imperative that such data be protected and yet, occurrences of
breach occur. In January of 2020 such a breach occurred and the Office
failed to inform the state entities with which it shares data that the
breach had occurred thereby putting other systems at risk.  Though the
Office became aware of the breach in late January, the issue went unre-
ported until April when it was disclosed in the Wall Street Journal.

This bill would address this failure by requiring notification by the
Office when a breach occurs. Additionally, the bill requires the Office
to inform the entities of its plan for remediation of the breach.

 
PRIOR LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

Minimal.

 
EFFECTIVE DATE:
This act shall take effect immediately.

S7019 (ACTIVE) - Bill Text download pdf

 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7019
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                               May 24, 2021
                                ___________
 
 Introduced  by  Sen. KRUEGER -- (at request of the State Comptroller) --
   read twice and ordered printed, and when printed to  be  committed  to
   the Committee on Internet and Technology
 
 AN  ACT  to amend the state technology law, in relation to the notifica-
   tion of certain state agencies of a data breach  or  network  security
   breach

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The state technology law is amended by adding a new section
 209 to read as follows:
   § 209. NOTIFICATION OF DATA BREACH OR NETWORK SECURITY BREACH;  SHARED
 DATA.  1.  THE  OFFICE  SHALL,  WITHIN  TWENTY-FOUR  HOURS FOLLOWING THE
 DISCOVERY OF A DATA BREACH  OR  NETWORK  SECURITY  BREACH  OR  RECEIVING
 NOTICE  OF  A  DATA  BREACH OR NETWORK SECURITY BREACH, NOTIFY THE CHIEF
 INFORMATION OFFICER, AND WHERE APPROPRIATE, THE CHIEF INFORMATION  SECU-
 RITY  OFFICER,  OF  ANY STATE ENTITY WITH WHICH IT SHARES DATA, PROVIDES
 NETWORKED SERVICES OR SHARES A NETWORK CONNECTION WHOSE  DATA,  SERVICES
 OR  CONNECTION IS OR MAY HAVE BEEN THE SUBJECT OF SUCH BREACH WHETHER OR
 NOT SUCH DATA WAS, OR IS REASONABLY BELIEVED TO HAVE BEEN,  ACQUIRED  OR
 USED BY AN UNAUTHORIZED PERSON.
    2. THE OFFICE SHALL, IN ADDITION TO THE PROVISIONS OF SUBDIVISION ONE
 OF  THIS SECTION, NOTIFY THE CHIEF INFORMATION OFFICER, AND WHERE APPRO-
 PRIATE, THE CHIEF INFORMATION SECURITY OFFICER,  OF  SUCH  STATE  ENTITY
 WITH  WHICH  IT  SHARES  DATA,  PROVIDES  NETWORKED SERVICES OR SHARES A
 NETWORK CONNECTION AND WHOSE DATA IS OR MAY HAVE  BEEN  THE  SUBJECT  OF
 SUCH  BREACH,  OF  ITS  PLAN  FOR  REMEDIATION  OF THE BREACH AND FUTURE
 PROTECTION OF SUCH DATA AND NETWORK.
   3. FOR PURPOSES OF THIS SECTION:
   (A) "DATA BREACH" SHALL MEAN AN INTENTIONAL OR UNINTENTIONAL  INCIDENT
 WHERE  DATA  IS  DISCLOSED, RELEASED, STOLEN, OR TAKEN WITHOUT THE KNOW-
 LEDGE OR AUTHORIZATION OF THE DATA'S OWNER OR STEWARD.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD10523-01-1

 S. 7019                             2
 
   (B) "NETWORK SECURITY BREACH" SHALL MEAN AN  INTENTIONAL  OR  UNINTEN-
 TIONAL  INCIDENT  WHERE  AN  UNAUTHORIZED  PARTY HAS GAINED ACCESS TO AN
 ORGANIZATION'S NETWORK WITHOUT THE KNOWLEDGE  OR  AUTHORIZATION  OF  THE
 NETWORK OWNER OR STEWARD.
   (C)  "STATE  ENTITY"  SHALL  MEAN  ANY  STATE BOARD, BUREAU, DIVISION,
 COMMITTEE, COMMISSION, COUNCIL,  DEPARTMENT,  PUBLIC  AUTHORITY,  PUBLIC
 BENEFIT  CORPORATION,  OFFICE  OR OTHER GOVERNMENTAL ENTITY PERFORMING A
 GOVERNMENTAL OR PROPRIETARY FUNCTION FOR THE STATE OF NEW YORK,  INCLUD-
 ING THE STATE LEGISLATURE AND THE JUDICIARY.
   § 2.  This act shall take effect immediately.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

The New York State Senate

senate Bill S7019

Sponsored By

Archive: Last Bill Status - Signed by Governor

Your Voice

Actions

Votes

Jun 2, 2021 - floor Vote

Floor Vote: Jun 2, 2021

Jun 1, 2021 - Rules committee Vote

Rules Committee Vote: Jun 1, 2021

Co-Sponsors

S7019 (ACTIVE) - Details

S7019 (ACTIVE) - Summary

S7019 (ACTIVE) - Sponsor Memo

S7019 (ACTIVE) - Bill Text download pdf

Comments

senate Bill S7019

Share this bill

Sponsored By

Liz Krueger

Archive: Last Bill Status - Signed by Governor

Your Voice

Actions

Votes

Jun 2, 2021 - floor Vote

Floor Vote: Jun 2, 2021

Jun 1, 2021 - Rules committee Vote

Rules Committee Vote: Jun 1, 2021

Co-Sponsors

Alessandra Biaggi

S7019 (ACTIVE) - Details

S7019 (ACTIVE) - Summary

S7019 (ACTIVE) - Sponsor Memo

S7019 (ACTIVE) - Bill Text download pdf

Comments