NY State Senate Bill 2015-S4887

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

Introduced
- In Committee Assembly
- In Committee Senate
- On Floor Calendar Assembly
- On Floor Calendar Senate
- Passed Assembly
- Passed Senate
Delivered to Governor
Signed By Governor

Please enter your contact information

First Name

Last Name

Email Address

A valid email address is required.

Home address is used to determine the senate district in which you reside. Your support or opposition to this bill is then shared immediately with the senator who represents you.

Optional services from the NY State Senate:

Create an account. An account allows you to officially support or oppose key legislation, sign petitions with a single click, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Include a custom message for your Senator? (Optional)

Enter a message to your senator. Many New Yorkers use this to share the reasoning behind their support or opposition to the bill. Others might share a personal anecdote about how the bill would affect them or people they care about.

Actions

View Actions

	Assembly Actions - Lowercase Senate Actions - UPPERCASE
Jan 06, 2016	referred to consumer protection
Apr 22, 2015	referred to consumer protection

co-Sponsors

2015-S4887 (ACTIVE) - Details

See Assembly Version of this Bill:: A6866
Current Committee:: Senate Consumer Protection
Law Section:: General Business Law
Laws Affected:: Amd §899-aa, add §899-bb, Gen Bus L; amd §208, St Tech L

2015-S4887 (ACTIVE) - Summary

Relates to the data security act.

2015-S4887 (ACTIVE) - Sponsor Memo

                                BILL NUMBER:S4887

TITLE OF BILL:  An act to amend the general business law and the state
technology law, in relation to the data security act

PURPOSE: New York's data security law is outdated and out of touch.
The current legal framework is weak and reactive. The purpose of this
bill is to expand protection of consumer's "private information," and
reward businesses who adopt model data security procedures. First,
this bill expands protection by broadening the definition of private
information. Second, this bill strengthens protection by requiring
companies to adopt reasonable data security standards. Finally, this
bill rewards businesses who adopt heightened data security standards
by creating a series of presumptions and safe harbors.

SUMMARY OF PROVISIONS:

Section 1 Provides that the act shall be known and may be cited as the
data security act.

Section 2. Amends the definition of "private information" in the
General Business Law § 899-aa to include biometric information (i.e.,
data generated by automatic measurements of an individual's physical
characteristics, which are used by the owner or licensee to
authenticate the individual's identity), online credentials (i.e., a
user name or email address in combination with a password or security

question and answer that would permit access), and any unsecured
protected health information as defined in The Health Insurance
Portability and Accountability Act of 1996 (45 C.F.R. pts. 160, 162,
164), as amended.

Section 3. Amends § 899-aa(4) of the General Business Law to provide
that forensic reports that are produced to local and state law
enforcement agencies, for the purposes of investigating and
identifying those responsible for a data breach, shall not constitute
a waiver of any applicable privilege or protection provided by law,
including trade secret protection. This section also states that
forensic reports produced are not subject to New York's Freedom of
Information Law

Amends § 899-aa(5) and adds a notice provision that, in the case of a
breach of a user name and password, allows for email notice, and in
the case of an email account, allows for other electronic notice
delivered to the resident online when the resident is connected to the
online account from an Internet Protocol address or online location
from which the person or business knows the resident customarily
accesses the account.

Section 4. Amends the penalties provided for in § 899-aa(6)(a) for
"knowingly" or "recklessly" violating General Business Law § 899-aa,
by increasing the maximum penalty from $150,000 to one million
dollars.

Section 5. Amends the definition of "private information" in the New
York state technology law § 208 to include online credentials (i.e., a
user name or email address in combination with a password or security
question and answer that would permit access) and any unsecured


protected health information as defined in The Health Insurance
Portability and Accountability Act of 1996 (45 C.F.R. pts.  160, 162,
164), as amended.

Section 6.  Adds a new § 899-bb to the General Business Law to:

Part 1 - Reasonable Data Security Requirements. Requires that any
person or business that conducts business in the state of New York
that owns or licenses private information must develop, implement and
maintain reasonable safeguards to protect the security,
confidentiality and integrity of the private information, including
disposal of data.

Part 2 - Rebuttable Presumption. Persons or businesses that conduct
business in New York and are certified through independent,
third-party audits annually by licensed insurers under this section
shall have a rebuttable presumption. This rebuttable presumption
states that the business or person maintained reasonable data security
safeguards to protect the security, confidentiality and integrity of
the private information.

Part 3 - Certification. Authorizes and requires the Department of
Financial Services ("DFS") to issue regulations allowing certain
independent, third party, licensed insurers to conduct audits and
certify that an entity has met the reasonable safeguard standards
under § 899-bb(1)(b)(vii).

Part 4 Safe Harbor. If a covered person or business complies with NIST
(an agency of the United States Department of Commerce) Special
Publication 800-53, the covered person or business shall not be liable
to the New York Attorney General's office or any affected New York
consumer as a result of unauthorized access to private information by
a third party. To be eligible for this safe harbor, entities must be
annually assessed as compliant with this heightened standard. This
assessment must be done by an independent, third-party licensed
assessment organization, accredited by FedRAMP and the General
Services Administration. Currently, there are 31 accredited third
party assessment organizations and they are listed online.

Part 5-Enforcement- Provides the attorney general may seek an
injunction and damages for actual costs or losses incurred by a person
as a result of failure to adopt the protections provided in this
section, including consequential financial losses, as well as
penalties of up to $250 per person, up to $10 million. Evidence of
financial loss is not required for the court to impose a penalty under
this section. Whenever the court shall determine that a person or
business violated this section knowingly or recklessly, the court may
impose a civil penalty of up to one thousand dollars per person;
provided however, that the aggregate amount of any civil penalties so
imposed shall not exceed the greater of fifty million dollars or three
times the aggregate amount of any actual costs and losses as
determined by the court. Also provides for a statute of limitations of
three years immediately after the date of the act complained of or the
date of discovery of such act.

Section 7. Adds a new § 208(9) to the New York State Technology law
that minors the new § 899-bb(2) of the General Business Law.


Section 8. Bill has an effect date of January 1, 2016.

JUSTIFICATION:  It will take a `cyber-Pearl Harbor' to wake up the
nation to the vulnerabilities in its computer systems. When Secretary
of Defense Leon E. Panetta uttered the words `cyber-Pearl Harbor,' it
was not intended to be hyperbolic. Rather, Panetta was describing a
collective cyberattack; one that would cause "physical destruction and
the loss of life," that "would paralyze and shock the nation,
[creating] a new, profound sense of vulnerability." While
cyber-attacks to date have not yet resulted in whole scale
catastrophe, they are exponentially increasing in breadth and
magnitude, threatening the security of businesses and customers alike.

New York's data security law is outdated, toothless and fails to
address some of the fundamental issues concerning data security
breaches. For example, there is no black-letter law requiring a
company to maintain "reasonable data security," except if they collect
Social Security Numbers. The law only requires that a company provide
notice to consumers and the New York Attorney General's office if
there is a breach of "private information," which is generally defined
as a name in combination with a Social Security Number, driver's
license or an account or credit card number.

This legal framework is weak and reactive. It does not address the
current crisis in data security, and has done little to prevent data
breaches such as the recent breaches of Home Depot, and Target.
Moreover, our present law fails to acknowledge a basic fact about data
breaches: it can happen to anyone, even those businesses that employ
the strictest data security measures available. For those who are
meeting top standards for security, law enforcement should be treating
them like a victim of a crime, not a perpetrator.

This bill addresses the deficiencies in our legal framework.
Specifically, this bill expands and strengthens protection for
sensitive information and rewards those who adopt model data security
practices.

PRIOR LEGISLATIVE HISTORY: None

EXISTING LAW:  The NYS Information Security Breach and Notification
Act (General Business Law § 899-aa) provides that in the event of
unauthorized access to "private information," defined as personal
information in combination with a Social Security Number, driver's
license or an account or credit card number, the New York Notification
Act requires the business or state entity to notify affected customers
and inform appropriate authorities. Notification must be made "in the
most expedient time possible and without reasonable delay but subject
and consistent with legitimate needs of law enforcement."  Covered
state entities are also required to have a notification policy. The
New York Attorney General is granted standing to bring an action
against businesses that violate the New York Notification Act.

The New York State Social Security Number Protection Law (General
Business Law § 399-dd) protects the use and disclosure of social
security numbers. The law provides that any covered individual or
entity that possesses Social Security numbers must adopt reasonable
measures to limit access to the Social Security numbers. Any person or


employee who has access to Social Security numbers must have a
legitimate reason for the access. Moreover each covered individual or
entity must provide safeguards "necessary" or "appropriate" to include
unauthorized access and to protect confidentiality of the numbers.
(The law does not define specific measures that are deemed "necessary"
or "appropriate"). The first violation of the law may result in a
civil penalty of no more than $1,000 for a single violation and
$100,000 for multiple violations. Any subsequent violation may result
in a civil penalty of no more than $5,000 for a single violation and
$250,000 for multiple violations. There is no private cause of action
under this law, and only the Attorney General can enforce its
provisions.

FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:  None

EFFECTIVE DATE: January 1, 2016.

2015-S4887 (ACTIVE) - Bill Text download pdf

                            
                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                  4887

                       2015-2016 Regular Sessions

                            I N  S E N A T E

                             April 22, 2015
                               ___________

Introduced  by  Sen. VENDITTO -- (at request of the Attorney General) --
  read twice and ordered printed, and when printed to  be  committed  to
  the Committee on Consumer Protection

AN  ACT  to amend the general business law and the state technology law,
  in relation to the data security act

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. This act shall be known and may be cited as the "data secu-
rity act".
  S  2.  The  opening  paragraph  and  paragraph (b) of subdivision 1 of
section 899-aa of the general business law, as added by chapter  442  of
the laws of 2005, are amended to read as follows:
  As  used  in this section, AND SECTION EIGHT HUNDRED NINETY-NINE-BB OF
THIS ARTICLE, the following terms shall have the following meanings:
  (b) "Private information" shall mean EITHER: (I) personal  information
consisting of any information in combination with any one or more of the
following  data  elements,  when  either the personal information or the
data element is not encrypted, or encrypted with an encryption key  that
has also been acquired:
  (1) social security number;
  (2)  driver's license number or non-driver identification card number;
[or]
  (3) account number, credit or debit card number, in  combination  with
any  required  security code, access code, or password that would permit
access to an individual's financial account; OR
  (4) BIOMETRIC INFORMATION, MEANING DATA GENERATED BY  AUTOMATIC  MEAS-
UREMENTS  OF AN INDIVIDUAL'S PHYSICAL CHARACTERISTICS, WHICH ARE USED BY
THE OWNER OR LICENSEE TO AUTHENTICATE THE INDIVIDUAL'S IDENTITY;
  (II) A USER NAME OR EMAIL ADDRESS IN COMBINATION WITH  A  PASSWORD  OR
SECURITY  QUESTION  AND  ANSWER  THAT  WOULD  PERMIT ACCESS TO AN ONLINE
ACCOUNT; OR
  (III) ANY UNSECURED PROTECTED HEALTH INFORMATION  AS  DEFINED  IN  THE
HEALTH  INSURANCE  PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (45 C.F.R.
PTS. 160, 162, 164), AS AMENDED FROM TIME TO TIME.

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD08145-09-5

S. 4887                             2

  "Private information" does not include publicly available  information
which  is  lawfully  made  available to the general public from federal,
state, or local government records.
  S  3.  Subdivisions  4 and 5 of section 899-aa of the general business
law, as added by chapter 442 of the laws of 2005, are amended to read as
follows:
  4. (A) The notification required by this section may be delayed  if  a
law enforcement agency determines that such notification impedes a crim-
inal  investigation.  The notification required by this section shall be
made after such law enforcement agency determines that such notification
does not compromise such investigation.
  (B) THE PRODUCTION OF FORENSIC REPORTS TO LOCAL AND STATE LAW ENFORCE-
MENT AGENCIES FOR THE PURPOSES OF INVESTIGATING  AND  IDENTIFYING  THOSE
RESPONSIBLE FOR A BREACH OF THE SECURITY OF THE SYSTEM SHALL NOT CONSTI-
TUTE A WAIVER OF ANY APPLICABLE PRIVILEGE OR PROTECTION PROVIDED BY LAW,
INCLUDING  TRADE  SECRET  PROTECTION,  AND  FORENSIC REPORTS SO PRODUCED
SHALL NOT BE SUBJECT TO DISCLOSURE UNDER ARTICLE SIX OF THE PUBLIC OFFI-
CERS LAW.
  5. The notice required by this section shall be directly  provided  to
the affected persons by one of the following methods:
  (a) written notice;
  (b)  electronic  notice,  provided  that  the person to whom notice is
required has expressly consented to receiving said notice in  electronic
form  and a log of each such notification is kept by the person or busi-
ness who notifies affected  persons  in  such  form;  provided  further,
however,  that  in no case shall any person or business require a person
to consent to accepting said notice in  said  form  as  a  condition  of
establishing    any   business   relationship   or   engaging   in   any
transaction[.];
  (c) telephone notification provided that a log of each such  notifica-
tion is kept by the person or business who notifies affected persons; or
  (d)  Substitute notice, if a business demonstrates to the state attor-
ney general that the cost of providing notice would exceed  two  hundred
fifty thousand dollars, or that the affected class of subject persons to
be  notified  exceeds  five  hundred thousand, or such business does not
have sufficient contact information. Substitute notice shall consist  of
all of the following:
  (1)  e-mail  notice  when  such business has an e-mail address for the
subject persons;
  (2) conspicuous posting of the notice  on  such  business's  web  site
page, if such business maintains one; and
  (3) notification to major statewide media.
  (E)  IN THE CASE OF A BREACH OF THE SECURITY OF THE SYSTEM INVOLVING A
USER NAME, AND PASSWORD OR SECURITY  QUESTION  AND  ANSWER  WHICH  WOULD
PERMIT  ACCESS TO AN ONLINE ACCOUNT, AS PROVIDED IN SUBPARAGRAPH (II) OF
PARAGRAPH (B) OF SUBDIVISION ONE OF THIS SECTION, AND NO  OTHER  PRIVATE
INFORMATION  DEFINED  IN  SUCH PARAGRAPH (B), THE PERSON OR BUSINESS MAY
COMPLY WITH THIS SECTION BY  PROVIDING  NOTIFICATION  IN  ELECTRONIC  OR
OTHER  FORM  THAT  DIRECTS THE PERSON WHOSE PRIVATE INFORMATION HAS BEEN
BREACHED PROMPTLY TO CHANGE HIS OR HER PASSWORD AND SECURITY QUESTION OR
ANSWER, AS APPLICABLE, OR TO TAKE OTHER STEPS APPROPRIATE TO PROTECT THE
ONLINE ACCOUNT WITH THE PERSON OR BUSINESS AND ALL OTHER ONLINE ACCOUNTS
FOR WHICH THE PERSON WHOSE PRIVATE INFORMATION HAS  BEEN  BREACHED  USES
THE SAME INFORMATION.
  (F)  IN  THE  CASE OF A BREACH OF THE SECURITY OF THE SYSTEM INVOLVING
THE LOGIN CREDENTIALS OF AN EMAIL ACCOUNT FURNISHED  BY  THE  PERSON  OR

S. 4887                             3

BUSINESS  AS  PROVIDED IN SUBPARAGRAPH (II) OF PARAGRAPH (B) OF SUBDIVI-
SION ONE OF THIS SECTION, THE PERSON OR BUSINESS SHALL NOT  COMPLY  WITH
THIS SECTION BY PROVIDING THE SECURITY BREACH NOTIFICATION TO THAT EMAIL
ADDRESS,  BUT  SHALL,  INSTEAD,  COMPLY  WITH  THIS SECTION BY PROVIDING
NOTICE BY ANOTHER METHOD DESCRIBED IN THIS SUBDIVISION OR BY  CLEAR  AND
CONSPICUOUS NOTICE DELIVERED TO THE RESIDENT ONLINE WHEN THE RESIDENT IS
CONNECTED  TO  THE  ONLINE  ACCOUNT FROM AN INTERNET PROTOCOL ADDRESS OR
ONLINE LOCATION FROM WHICH THE PERSON OR  BUSINESS  KNOWS  THE  RESIDENT
CUSTOMARILY ACCESSES THE ACCOUNT.
  S  4.  Paragraph (a) of subdivision 6 of section 899-aa of the general
business law, as amended by chapter 491 of the laws of 2005, is  amended
to read as follows:
  (a)  whenever  the attorney general shall believe from evidence satis-
factory to him OR HER that  there  is  a  violation  of  this  [article]
SECTION  he  OR SHE may bring an action in the name and on behalf of the
people of the state of New York, in a court of justice having  jurisdic-
tion  to issue an injunction, to enjoin and restrain the continuation of
such violation.  In such action, preliminary relief may be granted under
article sixty-three of the civil practice law and rules. In such  action
the  court  may  award  damages for actual costs or losses incurred by a
person entitled to notice pursuant to this [article] SECTION, if notifi-
cation was not provided  to  such  person  pursuant  to  this  [article]
SECTION,  including  consequential  financial losses. Whenever the court
shall determine in such action that a person or business  violated  this
[article]  SECTION knowingly or recklessly, the court may impose a civil
penalty of the greater of five thousand dollars or up to ten dollars per
instance of failed notification, provided that the latter  amount  shall
not exceed one [hundred fifty thousand] MILLION dollars.
  S  5. Paragraph (a) of subdivision 1 of section 208 of the state tech-
nology law, as added by chapter 442 of the laws of 2005, is  amended  to
read as follows:
  (a)  "Private information" shall mean EITHER: (I) personal information
in combination with any one or more of the following data elements, when
either the personal information or the data element is not encrypted  or
encrypted with an encryption key that has also been acquired:
  (1) social security number;
  (2)  driver's license number or non-driver identification card number;
or
  (3) account number, credit or debit card number, in  combination  with
any  required security code, access code, or password which would permit
access to an individual's financial account;
  (II) A USER NAME OR EMAIL ADDRESS IN COMBINATION WITH  A  PASSWORD  OR
SECURITY  QUESTION  AND  ANSWER  THAT  WOULD  PERMIT ACCESS TO AN ONLINE
ACCOUNT; OR
  (III) ANY UNSECURED PROTECTED HEALTH INFORMATION  AS  DEFINED  IN  THE
HEALTH  INSURANCE  PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (45 C.F.R.
PTS. 160, 162, 164), AS AMENDED FROM TIME TO TIME.
  "Private information" does not include publicly available  information
that  is  lawfully  made  available  to the general public from federal,
state, or local government records.
  S 6. The general business law is amended by adding a new section  899-
bb to read as follows:
  S  899-BB.  DATA SECURITY REQUIREMENTS. 1. REASONABLE SAFEGUARDS.  (A)
ANY PERSON OR BUSINESS THAT CONDUCTS BUSINESS IN  NEW  YORK  STATE,  AND
OWNS OR LICENSES COMPUTERIZED DATA WHICH INCLUDES PRIVATE INFORMATION OF
A  RESIDENT OF NEW YORK SHALL DEVELOP, IMPLEMENT AND MAINTAIN REASONABLE

S. 4887                             4

SAFEGUARDS TO PROTECT THE SECURITY, CONFIDENTIALITY AND INTEGRITY OF THE
PRIVATE INFORMATION, INCLUDING DISPOSAL OF DATA.
  (B)  THE  FOLLOWING SHALL BE DEEMED TO BE IN COMPLIANCE WITH PARAGRAPH
(A) OF THIS SUBDIVISION:
  (I) A PERSON OR BUSINESS THAT COMPLIES WITH A  STATE  OR  FEDERAL  LAW
PROVIDING  GREATER  PROTECTION TO PRIVATE INFORMATION THAN THAT PROVIDED
BY THIS SECTION;
  (II) A PERSON OR BUSINESS THAT IS SUBJECT TO AND COMPLIES  WITH  REGU-
LATIONS PROMULGATED PURSUANT TO TITLE V OF THE GRAMM-LEACH-BLILEY ACT OF
1999 (15 U.S.C. 6801 TO 6809);
  (III)  A  PERSON  OR BUSINESS THAT COMPLIES WITH CURRENT INTERNATIONAL
STANDARDS ORGANIZATION STANDARDS FOR INFORMATION SECURITY;
  (IV) A PERSON OR BUSINESS THAT IS SUBJECT TO AND COMPLIES  WITH  REGU-
LATIONS IMPLEMENTING THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY
ACT  OF  1996  (45  C.F.R. PARTS 160 AND 164) AND THE HEALTH INFORMATION
TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT, AS AMENDED FROM TIME TO
TIME;
  (V) A PERSON OR BUSINESS THAT COMPLIES WITH CURRENT NATIONAL INSTITUTE
OF STANDARDS AND TECHNOLOGY STANDARDS AS REFERENCED IN SUBDIVISION THREE
OF THIS SECTION; OR
  (VI) A PERSON OR BUSINESS  THAT  IMPLEMENTS  AN  INFORMATION  SECURITY
PROGRAM THAT INCLUDES THE FOLLOWING:
  (A)  ADMINISTRATIVE  SAFEGUARDS  SUCH  AS  THE FOLLOWING, IN WHICH THE
PERSON OR BUSINESS:
  (I) DESIGNATES ONE  OR  MORE  EMPLOYEES  TO  COORDINATE  THE  SECURITY
PROGRAM;
  (II) IDENTIFIES REASONABLY FORESEEABLE INTERNAL AND EXTERNAL RISKS;
  (III)  ASSESSES  THE SUFFICIENCY OF SAFEGUARDS IN PLACE TO CONTROL THE
IDENTIFIED RISKS;
  (IV) TRAINS AND MANAGES EMPLOYEES IN THE  SECURITY  PROGRAM  PRACTICES
AND PROCEDURES;
  (V) SELECTS SERVICE PROVIDERS CAPABLE OF MAINTAINING APPROPRIATE SAFE-
GUARDS, AND REQUIRES THOSE SAFEGUARDS BY CONTRACT;
  (VI)  ADJUSTS THE SECURITY PROGRAM IN LIGHT OF BUSINESS CHANGES OR NEW
CIRCUMSTANCES; AND
  (B) TECHNICAL SAFEGUARDS SUCH AS THE FOLLOWING, IN WHICH THE PERSON OR
BUSINESS:
  (I) ASSESSES RISKS IN NETWORK AND SOFTWARE DESIGN;
  (II) ASSESSES RISKS IN INFORMATION PROCESSING, TRANSMISSION AND  STOR-
AGE;
  (III) DETECTS, PREVENTS AND RESPONDS TO ATTACKS OR SYSTEM FAILURES;
  (IV)  REGULARLY  TESTS AND MONITORS THE EFFECTIVENESS OF KEY CONTROLS,
SYSTEMS AND PROCEDURES; AND
  (C) PHYSICAL SAFEGUARDS SUCH AS THE FOLLOWING, IN WHICH THE PERSON  OR
BUSINESS:
  (I) ASSESSES RISKS OF INFORMATION STORAGE AND DISPOSAL;
  (II) DETECTS, PREVENTS AND RESPONDS TO INTRUSIONS;
  (III) PROTECTS AGAINST UNAUTHORIZED ACCESS TO OR USE OF PRIVATE INFOR-
MATION DURING OR AFTER THE COLLECTION, TRANSPORTATION AND DESTRUCTION OR
DISPOSAL OF THE INFORMATION; AND
  (IV)  DISPOSES OF PRIVATE INFORMATION AFTER IT IS NO LONGER NEEDED FOR
BUSINESS PURPOSES BY ERASING ELECTRONIC MEDIA SO  THAT  THE  INFORMATION
CANNOT BE READ OR RECONSTRUCTED.
  2.  REBUTTABLE PRESUMPTION. A PERSON OR BUSINESS THAT OBTAINS AN INDE-
PENDENT, THIRD-PARTY AUDIT AND CERTIFICATION  ANNUALLY  UNDER  THE  DATA
SECURITY  STANDARD  LISTED  IN  PARAGRAPH (B) OF SUBDIVISION ONE OF THIS

S. 4887                             5

SECTION SHALL  RECEIVE  A  REBUTTABLE  PRESUMPTION  THAT  IT  MAINTAINED
REASONABLE  SAFEGUARDS  TO  PROTECT  THE  SECURITY,  CONFIDENTIALITY AND
INTEGRITY OF THE PRIVATE INFORMATION.
  3.  CERTIFICATION  AUTHORITY AND REGULATION.  THE DEPARTMENT OF FINAN-
CIAL  SERVICES  SHALL  PROMULGATE  REGULATIONS  REGARDING   INDEPENDENT,
THIRD-PARTY  LICENSED  INSURERS RESPONSIBLE FOR CERTIFYING ENTITIES THAT
MEET THE REASONABLE DATA SECURITY REQUIREMENTS SET FORTH IN SUBPARAGRAPH
(VI) OF PARAGRAPH (B) OF SUBDIVISION ONE OF THIS SECTION.
  4. SAFE HARBOR. ANY PERSON OR BUSINESS THAT COMPLIES WITH THE MOST  UP
TO  DATE  VERSION  OF THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
SPECIAL PUBLICATION 800-53 SHALL BE IMMUNE FROM  LIABILITY  IN  A  CIVIL
ACTION,  INCLUDING  BUT NOT LIMITED TO AN ACTION BROUGHT BY THE ATTORNEY
GENERAL, RESULTING FROM UNAUTHORIZED ACCESS TO PRIVATE INFORMATION BY  A
THIRD-PARTY  ABSENT  EVIDENCE  OF WILLFUL MISCONDUCT, BAD FAITH OR GROSS
NEGLIGENCE. COMPLIANCE MUST BE CERTIFIED  ANNUALLY  BY  AN  INDEPENDENT,
THIRD-PARTY  LICENSED  INSURER,  AUTHORIZED BY THE NATIONAL INSTITUTE OF
STANDARDS AND TECHNOLOGY.
  5. ENFORCEMENT. (A) WHENEVER THE ATTORNEY GENERAL SHALL  BELIEVE  FROM
EVIDENCE  SATISFACTORY  TO  HIM OR HER THAT THERE IS A VIOLATION OF THIS
SECTION HE OR SHE MAY BRING AN ACTION IN THE NAME AND ON BEHALF  OF  THE
PEOPLE  OF THE STATE OF NEW YORK, IN A COURT OF JUSTICE HAVING JURISDIC-
TION TO ISSUE AN INJUNCTION, TO ENJOIN AND RESTRAIN THE CONTINUATION  OF
SUCH  VIOLATION. IN SUCH ACTION, PRELIMINARY RELIEF MAY BE GRANTED UNDER
ARTICLE SIXTY-THREE OF THE CIVIL PRACTICE LAW AND RULES. IN SUCH ACTION,
THE COURT MAY AWARD DAMAGES FOR ACTUAL COSTS OR  LOSSES  INCURRED  BY  A
PERSON AS A RESULT OF THE FAILURE BY A PERSON OR BUSINESS TO COMPLY WITH
THE  DATA  SECURITY  REQUIREMENTS  SET  FORTH IN THIS SECTION, INCLUDING
CONSEQUENTIAL FINANCIAL LOSSES, AS WELL AS A CIVIL PENALTY OF UP TO  TWO
HUNDRED  FIFTY  DOLLARS, WHICH PENALTY MAY BE INCREASED BY A FACTOR LESS
THAN OR EQUAL TO THE NUMBER OF PERSONS  WHOSE  PRIVATE  INFORMATION  WAS
COMPROMISED;  PROVIDED  HOWEVER,  THAT THE AGGREGATE AMOUNT OF ANY CIVIL
PENALTIES SO IMPOSED SHALL NOT EXCEED TEN MILLION DOLLARS. WHENEVER  THE
COURT  SHALL  DETERMINE  THAT A PERSON OR BUSINESS VIOLATED THIS SECTION
KNOWINGLY OR RECKLESSLY, THE COURT MAY, IN  LIEU  OF  IMPOSING  A  CIVIL
PENALTY  AS SET FORTH ABOVE, INSTEAD IMPOSE A CIVIL PENALTY OF UP TO ONE
THOUSAND DOLLARS, WHICH PENALTY MAY BE INCREASED BY A FACTOR  LESS  THAN
OR  EQUAL TO THE NUMBER OF PERSONS WHOSE PRIVATE INFORMATION WAS COMPRO-
MISED; PROVIDED HOWEVER, THAT THE AGGREGATE AMOUNT OF ANY  CIVIL  PENAL-
TIES SO IMPOSED SHALL NOT EXCEED THE GREATER OF FIFTY MILLION DOLLARS OR
THREE  TIMES  THE  AGGREGATE  AMOUNT  OF  ANY ACTUAL COSTS AND LOSSES AS
DETERMINED BY THE COURT. A COURT MAY AWARD A CIVIL PENALTY  PURSUANT  TO
THIS PARAGRAPH WITHOUT A SHOWING OF FINANCIAL LOSS.
  (B)  THE REMEDIES PROVIDED BY THIS SECTION SHALL BE IN ADDITION TO ANY
OTHER LAWFUL REMEDY AVAILABLE.
  (C) NO ACTION MAY BE BROUGHT UNDER  THE  PROVISIONS  OF  THIS  SECTION
UNLESS SUCH ACTION IS COMMENCED WITHIN THREE YEARS IMMEDIATELY AFTER THE
DATE  OF  THE  ACT OR OMISSION COMPLAINED OF OR THE DATE OF DISCOVERY OF
SUCH ACT OR OMISSION.
  S 7. Section 208 of the state technology law is amended  by  adding  a
new subdivision 9 to read as follows:
  9.  DATA SECURITY REQUIREMENTS.  (A) ANY STATE ENTITY THAT OWNS, MAIN-
TAINS, OR OTHERWISE POSSESSES PRIVATE INFORMATION SHALL DEVELOP,  IMPLE-
MENT  AND MAINTAIN REASONABLE SAFEGUARDS TO PROTECT THE SECURITY, CONFI-
DENTIALITY AND INTEGRITY OF THE PRIVATE INFORMATION, INCLUDING  DISPOSAL
OF DATA.

S. 4887                             6

  (B)  THE  FOLLOWING SHALL BE DEEMED TO BE IN COMPLIANCE WITH PARAGRAPH
(A) OF THIS SUBDIVISION:
  (I) A STATE ENTITY THAT COMPLIES WITH A STATE OR FEDERAL LAW PROVIDING
GREATER  PROTECTION  TO  PRIVATE  INFORMATION THAN THAT PROVIDED BY THIS
SECTION;
  (II) A STATE ENTITY THAT IS SUBJECT TO AND COMPLIES  WITH  REGULATIONS
PROMULGATED  PURSUANT  TO  TITLE V OF THE GRAMM-LEACH-BLILEY ACT OF 1999
(15 U.S.C. 6801 TO 6809);
  (III) A STATE ENTITY THAT COMPLIES WITH THE MOST CURRENT INTERNATIONAL
STANDARDS ORGANIZATION STANDARDS FOR INFORMATION SECURITY;
  (IV) A STATE ENTITY THAT IS SUBJECT TO AND COMPLIES  WITH  REGULATIONS
IMPLEMENTING  THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
1996 (45 C.F.R. PARTS 160 AND 164) AND THE HEALTH INFORMATION TECHNOLOGY
FOR ECONOMIC AND CLINICAL HEALTH ACT, AS AMENDED FROM TIME TO TIME;
  (V) A STATE ENTITY THAT COMPLIES WITH CURRENT  NATIONAL  INSTITUTE  OF
STANDARDS AND TECHNOLOGY STANDARDS; OR
  (VI)  A  STATE  ENTITY THAT IMPLEMENTS AN INFORMATION SECURITY PROGRAM
THAT INCLUDES THE FOLLOWING:
  (A) ADMINISTRATIVE SAFEGUARDS SUCH AS  THE  FOLLOWING,  IN  WHICH  THE
STATE ENTITY:
  (I)  DESIGNATES  ONE  OR  MORE  EMPLOYEES  TO  COORDINATE THE SECURITY
PROGRAM;
  (II) IDENTIFIES REASONABLY FORESEEABLE INTERNAL AND EXTERNAL RISKS;
  (III) ASSESSES THE SUFFICIENCY OF SAFEGUARDS IN PLACE TO  CONTROL  THE
IDENTIFIED RISKS;
  (IV)  TRAINS  AND  MANAGES EMPLOYEES IN THE SECURITY PROGRAM PRACTICES
AND PROCEDURES;
  (V) SELECTS SERVICE PROVIDERS CAPABLE OF MAINTAINING APPROPRIATE SAFE-
GUARDS, AND REQUIRES THOSE SAFEGUARDS BY CONTRACT; AND
  (VI) ADJUSTS THE SECURITY PROGRAM IN LIGHT OF BUSINESS CHANGES OR  NEW
CIRCUMSTANCES;
  (B)  TECHNICAL  SAFEGUARDS  SUCH  AS THE FOLLOWING, IN WHICH THE STATE
ENTITY:
  (I) ASSESSES RISKS IN NETWORK AND SOFTWARE DESIGN;
  (II) ASSESSES RISKS IN INFORMATION PROCESSING, TRANSMISSION AND  STOR-
AGE;
  (III)  DETECTS,  PREVENTS  AND RESPONDS TO ATTACKS OR SYSTEM FAILURES;
AND
  (IV) REGULARLY TESTS AND MONITORS THE EFFECTIVENESS OF  KEY  CONTROLS,
SYSTEMS AND PROCEDURES; AND
  (C)  PHYSICAL  SAFEGUARDS  SUCH  AS  THE FOLLOWING, IN WHICH THE STATE
ENTITY:
  (I) ASSESSES RISKS OF INFORMATION STORAGE AND DISPOSAL;
  (II) DETECTS, PREVENTS AND RESPONDS TO INTRUSIONS;
  (III) PROTECTS AGAINST UNAUTHORIZED ACCESS TO OR USE OF PRIVATE INFOR-
MATION DURING OR AFTER THE COLLECTION, TRANSPORTATION AND DESTRUCTION OR
DISPOSAL OF THE INFORMATION; AND
  (IV) DISPOSES OF PRIVATE INFORMATION AFTER IT IS NO LONGER NEEDED  FOR
BUSINESS PURPOSES OR AS REQUIRED BY LOCAL, STATE OR FEDERAL LAW BY ERAS-
ING  ELECTRONIC  MEDIA  SO THAT THE INFORMATION CANNOT BE READ OR RECON-
STRUCTED.
  S 8. This act shall take effect January 1, 2016.

Comments

Open Legislation is a forum for New York State legislation. All comments are subject to review and community moderation is encouraged.

Comments deemed off-topic, commercial, campaign-related, self-promotional; or that contain profanity, hate or toxic speech; or that link to sites outside of the nysenate.gov domain are not permitted, and will not be published. Attempts to intimidate and silence contributors or deliberately deceive the public, including excessive or extraneous posting/posts, or coordinated activity, are prohibited and may result in the temporary or permanent banning of the user. Comment moderation is generally performed Monday through Friday. By contributing or voting you agree to the Terms of Participation and verify you are over 13.

Create an account. An account allows you to sign petitions with a single click, officially support or oppose key legislation, and follow issues, committees, and bills that matter to you. When you create an account, you agree to this platform's terms of participation.

Senate Bill S4887

Sponsored By

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

co-Sponsors

2015-S4887 (ACTIVE) - Details

2015-S4887 (ACTIVE) - Summary

2015-S4887 (ACTIVE) - Sponsor Memo

2015-S4887 (ACTIVE) - Bill Text download pdf

Comments

Senate Bill S4887

Share this bill

Sponsored By

Michael Venditto

Archive: Last Bill Status - In Senate Committee Consumer Protection Committee

co-Sponsors

Kevin S. Parker

2015-S4887 (ACTIVE) - Details

2015-S4887 (ACTIVE) - Summary

2015-S4887 (ACTIVE) - Sponsor Memo

2015-S4887 (ACTIVE) - Bill Text download pdf

Comments