S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   1157
 
                        2025-2026 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              January 9, 2025
                                ___________
 
 Introduced  by  M.  of  A. SANTABARBARA -- read once and referred to the
   Committee on Consumer Affairs and Protection
 
 AN ACT to amend the general business law, in relation to  disclosure  of
   breaches of the security of the system
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The opening paragraph of subdivision 2 of section 899-aa of
 the general business law, as amended by chapter 647 of the laws of 2024,
 is amended to read as follows:
   Any person or business which owns or licenses computerized data  which
 includes  private  information shall disclose any breach of the security
 of the system [following] WITHIN FIVE DAYS OF THE discovery or notifica-
 tion of the breach in the security of the system to any resident of  New
 York  state  whose private information was, or is reasonably believed to
 have been, accessed or acquired by a person without valid authorization.
 [The disclosure shall be made in the most expedient  time  possible  and
 without  unreasonable  delay,  provided  that such notification shall be
 made within thirty days after the breach has been discovered, except for
 the legitimate needs of law enforcement, as provided in subdivision four
 of this section.]
   § 2. This act shall take effect immediately.
 
 
 
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD03501-01-5