Privacy & Information Security Law Blog

On July 25, 2019, New York Governor Andrew Cuomo signed into law Senate Bill S5575B (the “Bill”), an amendment to New York’s breach notification law (the “Act”). The Bill expands the Act’s definition of “breach of the security of the system” and the types of information (i.e., “private information”) covered by the Act, and makes certain changes to the Act’s requirements for breach notification.

The Act previously defined “breach of the security of the system” to mean the unauthorized acquisition of computerized data. As amended, the definition of “breach” is now broader and means unauthorized access to or acquisition of such data.

The Bill also expands the definition of “private information” to include the following types of data, in combination with a New York resident’s name, number, personal mark or other identifier that can be used to identify a natural person:

• Account number, credit or debit card number, if circumstances exist that could allow such number to be used to access an individual’s financial account without additional identifying information, security code, access code or password; and
• Biometric information (meaning data generated by electronic measurements of an individual’s unique physical characteristics).

The Bill also adds a user name or email address in combination with a password or security question and answer that would permit access to an online account to the scope of the breach notification requirement (this data need not be compromised in conjunction with a name or other identifier, as described above).

The Bill modifies the Act’s data breach notification requirements in various ways, such as:

• Creating an exception to the obligation to notify affected individuals of a breach if the exposure of private information was an inadvertent disclosure by persons authorized to access private information, and the business reasonably determines such exposure will not likely result in misuse of such information, or financial harm to the affected persons (or emotional harm, in the case of unknown disclosure of online credentials).
  • In such case, the business responsible for such an inadvertent disclosure must document this determination in writing and maintain a record of the incident for five years.
  • If the incident affects over 500 New York residents, the business must provide its written determination as to the risk of harm to the New York Attorney General (“AG”) within ten days after the determination.
• Providing that businesses that provide notice of a breach to affected individuals in compliance with the breach notification requirements of HIPAA or GLBA, or other data security rules and regulations of any federal or New York state agency, need not provide separate notice to the affected individuals under New York’s breach law. The Bill does not eliminate the requirement to notify the New York AG, Department of State and New York State Police in such event. (The Bill specifically requires businesses that provide notification of a breach—including breach of information that is not “private information”—to the secretary of health and human services pursuant to HIPAA provide such notification to the New York AG within five business days of notifying the secretary.)
• Supplementing the existing content requirements for notice to affected individuals. As amended, such notice must include the telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identity theft prevention and protection information.

The Bill also amends New York’s general business law by enacting a “reasonable security requirement,” which requires businesses that own or license computerized data that includes the “private information” of New York residents to develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information, including, but not limited to, disposal of the data.

The Bill’s amendments to the breach notification law take effect on October 23, 2019. The amendments to New York’s general business law take effect on March 21, 2020.

Separately, on the same day, Governor Cuomo signed S.3582 , which requires credit reporting agencies (“CRA”) that experienced a data breach involving Social Security numbers to provide five-year identity theft prevention services, and, if applicable, identity theft mitigation services to affected consumers. This law also will require CRAs to inform consumers about credit freezes and provide them the right to freeze their credit at no cost. This bill takes effect September 23, 2019, and will apply to breaches that occurred no more than three years prior to that date.