S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   7786
 
                             I N  S E N A T E
 
                             January 11, 2022
                                ___________
 
 Introduced  by  Sen. KRUEGER -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the state technology law, in relation to  the  notifica-
   tion  of  certain  agencies  of  a  breach of the security system or a
   breach of the security network
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Section  209  of  the state technology law, as added by a
 chapter of the laws of 2021 amending the state technology  law  relating
 to  the  notification  of  certain  state  agencies  of a data breach or
 network security breach, as proposed in  legislative  bills  numbers  S.
 7019 and A.  7612, is amended to read as follows:
   § 209. Notification of [data] A breach [or network] OF THE security OF
 THE  SYSTEM  OR A breach OF NETWORK SECURITY; shared data. 1. The office
 shall, within twenty-four hours  [following  the  discovery  of  a  data
 breach  or  network security breach or receiving notice of a data breach
 or network security breach] OF EITHER BEING  NOTIFIED  OF  OR  RECEIVING
 EVIDENCE  OF  A  BREACH  OF  THE  SECURITY OF THE SYSTEM, OR A BREACH OF
 NETWORK SECURITY, AS DEFINED IN PARAGRAPHS (A) AND  (B)  OF  SUBDIVISION
 THREE  OF THIS SECTION, notify the chief information officer, [and where
 appropriate,] the chief information security officer, AND  WHERE  APPRO-
 PRIATE, THE CYBER SECURITY COORDINATOR of any state entity with which it
 shares  data, provides networked services or shares a network connection
 whose data, services or connection is [or may have been the subject  of]
 REASONABLY  SUSPECTED  TO BE AFFECTED BY ANY such breach [whether or not
 such data was, or is reasonably believed to have been, acquired or  used
 by an unauthorized person].
   2. The office shall[, in addition to the provisions of subdivision one
 of  this  section,  notify]  PROVIDE the chief information officer, [and
 where appropriate,] the chief information security  officer,  AND  WHERE
 APPROPRIATE, THE CYBER RISK COORDINATOR of [such] ANY state entity [with
 which  it  shares  data, provides networked services or shares a network
 connection and whose data is or  may  have  been  the  subject  of  such
 breach,  of],  WHO HAS BEEN NOTIFIED PURSUANT TO SUBDIVISION ONE OF THIS
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD10523-02-2
 S. 7786                             2
 
 SECTION, WITH  its  plan  for  remediation  of  the  breach  and  future
 protection of such data and network.
   3. For purposes of this section:
   (a) ["Data breach" shall mean an intentional or unintentional incident
 where  data  is  disclosed, released, stolen, or taken without the know-
 ledge or authorization of the data's owner or steward]  "BREACH  OF  THE
 SECURITY  OF THE SYSTEM" SHALL HAVE THE SAME MEANING AS DEFINED IN PARA-
 GRAPH (B) OF SUBDIVISION ONE OF SECTION TWO HUNDRED EIGHT OF THIS  ARTI-
 CLE.
   (b)  ["Network  security breach" shall mean an intentional or uninten-
 tional incident where an unauthorized party  has  gained  access  to  an
 organization's  network  without  the  knowledge or authorization of the
 network owner or steward] "BREACH OF NETWORK SECURITY" SHALL MEAN  UNAU-
 THORIZED  ACCESS  TO OR ACCESS WITHOUT VALID AUTHORIZATION OF A COMPUTER
 NETWORK WHICH COMPROMISES THE SECURITY, CONFIDENTIALITY, OR INTEGRITY OF
 SUCH NETWORK.
   (c) "State entity" shall [mean  any  state  board,  bureau,  division,
 committee,  commission,  council,  department,  public authority, public
 benefit corporation, office or other governmental  entity  performing  a
 governmental  or proprietary function for the state of New York, includ-
 ing the state legislature and the judiciary] HAVE THE  SAME  MEANING  AS
 PROVIDED  BY  PARAGRAPH  (C)  OF  SUBDIVISION ONE OF SECTION TWO HUNDRED
 EIGHT OF THIS ARTICLE.
   § 2. This act shall take effect on the  same  date  and  in  the  same
 manner  as  a  chapter of the laws of 2021 amending the state technology
 law relating to the notification of certain state  agencies  of  a  data
 breach  or  network  security  breach,  as proposed in legislative bills
 numbers S.  7019 and A. 7612, takes effect.