S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  7781--A
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                               May 15, 2017
                                ___________
 
 Introduced  by  M. of A. PEOPLES-STOKES -- read once and referred to the
   Committee on Ways and Means -- recommitted to the  Committee  on  Ways
   and  Means  in  accordance  with  Assembly Rule 3, sec. 2 -- committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee

 AN ACT to amend the tax law, in relation to a business  tax  credit  for
   purchase  of  data  breach  insurance; and providing for the repeal of
   such provisions upon expiration thereof
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Section  210-B  of the tax law is amended by adding a new
 subdivision 53 to read as follows:
   53. DATA BREACH INSURANCE CREDIT. (A) A TAXPAYER THAT IS A BUSINESS OR
 OWNER OF A BUSINESS SHALL BE ALLOWED A CREDIT AGAINST THE TAX IMPOSED BY
 THIS ARTICLE EQUAL TO TWENTY-FIVE PERCENT OF THE PREMIUM PAID DURING THE
 TAXABLE YEAR FOR QUALIFIED DATA BREACH INSURANCE. FOR PURPOSES  OF  THIS
 SECTION,  THE  TERM  "QUALIFIED  DATA  BREACH  INSURANCE" MEANS COVERAGE
 PROVIDED BY AN INSURANCE COMPANY FOR EXPENSES OR  LOSSES  IN  CONNECTION
 WITH  THE  THEFT, LOSS, DISCLOSURE, INACCESSIBILITY, OR MANIPULATION, OF
 DATA.
   (B) IN ORDER TO QUALIFY FOR SUCH CREDIT, TAXPAYERS SHALL ADOPT AND  BE
 IN COMPLIANCE WITH ONE OF THE FOLLOWING:
   (1) VERSION 1.0 OF THE FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE
 CYBERSECURITY PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECH-
 NOLOGY AS IN EFFECT ON FEBRUARY TWELFTH, TWO THOUSAND FOURTEEN OR SUBSE-
 QUENT VERSIONS OR ITERATIONS; OR
   (2)  ANY  SIMILAR  STANDARD  SPECIFIED BY THE STATE COMPTROLLER, AFTER
 CONSULTATION WITH THE DIRECTOR OF THE OFFICE OF  INFORMATION  TECHNOLOGY
 SERVICES.

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD00228-04-8

              

 A. 7781--A                          2
 
   (C)  IN THE CASE OF INSURANCE COVERAGE UNDER WHICH AMOUNTS ARE PAYABLE
 FOR OTHER THAN EXPENSES OR LOSSES DESCRIBED IN  PARAGRAPH  (A)  OF  THIS
 SUBDIVISION:
   (1)  NO  AMOUNT SHALL BE TREATED AS PREMIUMS FOR QUALIFIED DATA BREACH
 INSURANCE UNLESS THE CHARGE FOR  SUCH  INSURANCE  IS  EITHER  SEPARATELY
 STATED  IN  THE CONTRACT, OR FURNISHED TO THE POLICYHOLDER BY THE INSUR-
 ANCE COMPANY IN A SEPARATE STATEMENT;
   (2) THE AMOUNT TAKEN INTO ACCOUNT AS THE PREMIUM PAID OR INCURRED  FOR
 SUCH INSURANCE SHALL NOT EXCEED SUCH CHARGE; AND
   (3)  NO AMOUNT SHALL BE TREATED AS PAID OR INCURRED FOR SUCH INSURANCE
 IF THE AMOUNT SPECIFIED IN THE CONTRACT, OR  FURNISHED  TO  THE  POLICY-
 HOLDER  BY  THE INSURANCE COMPANY IN A SEPARATE STATEMENT, AS THE CHARGE
 FOR SUCH INSURANCE IS UNREASONABLY LARGE IN RELATION TO THE TOTAL CHARG-
 ES UNDER THE CONTRACT.
   (D) PREMIUMS SHALL BE TAKEN INTO ACCOUNT UNDER PARAGRAPH (A)  OF  THIS
 SUBDIVISION  ONLY  IF SUCH PREMIUMS ARE PAID OR INCURRED IN THE ORDINARY
 COURSE OF THE TAXPAYER'S TRADE OR BUSINESS.
   (E) THIS SUBDIVISION SHALL NOT APPLY TO A BUSINESS WHICH  EMPLOYS  ONE
 HUNDRED AND ONE OR MORE EMPLOYEES.
   §  2. Section 606 of the tax law is amended by adding a new subsection
 (iii) to read as follows:
   (III) DATA BREACH INSURANCE CREDIT. (1) A TAXPAYER THAT IS A  BUSINESS
 OR OWNER OF A BUSINESS SHALL BE ALLOWED A CREDIT AGAINST THE TAX IMPOSED
 BY  THIS ARTICLE EQUAL TO TWENTY-FIVE PERCENT OF THE PREMIUM PAID DURING
 THE TAXABLE YEAR FOR QUALIFIED DATA BREACH INSURANCE.  FOR  PURPOSES  OF
 THIS  SECTION, THE TERM "QUALIFIED DATA BREACH INSURANCE" MEANS COVERAGE
 PROVIDED BY AN INSURANCE COMPANY FOR EXPENSES OR  LOSSES  IN  CONNECTION
 WITH  THE  THEFT, LOSS, DISCLOSURE, INACCESSIBILITY, OR MANIPULATION, OF
 DATA.
   (2) IN ORDER TO QUALIFY FOR SUCH CREDIT, TAXPAYERS SHALL ADOPT AND  BE
 IN COMPLIANCE WITH ONE OF THE FOLLOWING:
   (A) VERSION 1.0 OF THE FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE
 CYBERSECURITY PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECH-
 NOLOGY AS IN EFFECT ON FEBRUARY TWELFTH, TWO THOUSAND FOURTEEN OR SUBSE-
 QUENT VERSIONS OR ITERATIONS; OR
   (B)  ANY  SIMILAR  STANDARD  SPECIFIED BY THE STATE COMPTROLLER, AFTER
 CONSULTATION WITH THE DIRECTOR OF THE OFFICE OF  INFORMATION  TECHNOLOGY
 SERVICES.
   (3)  IN THE CASE OF INSURANCE COVERAGE UNDER WHICH AMOUNTS ARE PAYABLE
 FOR OTHER THAN EXPENSES OR LOSSES DESCRIBED IN  PARAGRAPH  ONE  OF  THIS
 SUBSECTION:
   (A)  NO  AMOUNT SHALL BE TREATED AS PREMIUMS FOR QUALIFIED DATA BREACH
 INSURANCE UNLESS THE CHARGE FOR  SUCH  INSURANCE  IS  EITHER  SEPARATELY
 STATED  IN  THE CONTRACT, OR FURNISHED TO THE POLICYHOLDER BY THE INSUR-
 ANCE COMPANY IN A SEPARATE STATEMENT;
   (B) THE AMOUNT TAKEN INTO ACCOUNT AS THE PREMIUM PAID OR INCURRED  FOR
 SUCH INSURANCE SHALL NOT EXCEED SUCH CHARGE; AND
   (C)  NO AMOUNT SHALL BE TREATED AS PAID OR INCURRED FOR SUCH INSURANCE
 IF THE AMOUNT SPECIFIED IN THE CONTRACT, OR  FURNISHED  TO  THE  POLICY-
 HOLDER  BY  THE INSURANCE COMPANY IN A SEPARATE STATEMENT, AS THE CHARGE
 FOR SUCH INSURANCE IS UNREASONABLY LARGE IN RELATION TO THE TOTAL CHARG-
 ES UNDER THE CONTRACT.
   (4) PREMIUMS SHALL BE TAKEN INTO ACCOUNT UNDER PARAGRAPH ONE  OF  THIS
 SUBSECTION  ONLY  IF  SUCH PREMIUMS ARE PAID OR INCURRED IN THE ORDINARY
 COURSE OF THE TAXPAYER'S TRADE OR BUSINESS.

 A. 7781--A                          3
 
   (5) THIS SUBSECTION SHALL NOT APPLY TO A BUSINESS  WHICH  EMPLOYS  ONE
 HUNDRED AND ONE OR MORE EMPLOYEES.
   §  3. Subparagraph (B) of paragraph 1 of subsection (i) of section 606
 of the tax law is amended by adding a  new  clause  (xliv)  to  read  as
 follows:
   (XLIV) DATA BREACH INSURANCE    AMOUNT OF CREDIT UNDER SUBDIVISION
   CREDIT UNDER SUBSECTION (III)   FIFTY-THREE OF SECTION TWO HUNDRED
                                   TEN-B
   § 4. This act shall take effect immediately and shall apply to taxable
 years  beginning  on  and after the first of January next succeeding the
 date on which it shall have become a law and shall remain in effect  for
 five  years  after  it  shall have become a law, when upon such date the
 provisions of this act shall expire and be deemed repealed.