What does New York's data breach law ask a business to do?

Who does this law apply to?

A person or business that owns or licenses computerized private information must disclose a breach to each New York resident whose private information was, or is reasonably believed to have been, accessed or acquired without valid authorization.

No notice to affected people is owed when the exposure was an inadvertent disclosure by people allowed to see the information, and the person or business reasonably decides it will not likely lead to misuse or harm. The text says that decision is documented in writing.

Any person or business which owns or licenses computerized data which includes private information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization.

Notice to affected persons under this section is not required if the exposure of private information was an inadvertent disclosure by persons authorized to access private information, and the person or business reasonably determines such exposure will not likely result in misuse of such information, or financial harm to the affected persons or emotional harm in the case of unknown disclosure of online credentials as found in subparagraph (ii) of paragraph (b) of subdivision one of this section.

What counts as personal information?

Private information is identifying information together with a listed data element, such as a Social Security number, a driver's licence or non-driver ID number, an account or card number that would open a financial account, biometric information, medical information or health insurance information.

A user name or email address together with a password or security question and answer that would open an online account also counts.

(1) social security number; (2) driver's license number or non-driver identification card number;

(6) medical information, meaning any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;

(ii) a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The law says the disclosure must be made in the most expedient time possible and without unreasonable delay, and within thirty days after the breach is discovered, except for the legitimate needs of law enforcement.

The disclosure shall be made in the most expedient time possible and without unreasonable delay, provided that such notification shall be made within thirty days after the breach has been discovered, except for the legitimate needs of law enforcement, as provided in subdivision four of this section.

Who else must be told?

Whenever New York residents are to be notified, the person or business must tell the state attorney general, the department of state and the division of state police about the timing, content and distribution of the notices and the approximate number of people affected, with a copy of the notice template. The department of financial services is told only where the business is a covered entity under its cybersecurity regulation.

When more than five thousand New York residents are to be notified at one time, the consumer reporting agencies must be told too.

In the event that any New York residents are to be notified, the person or business shall notify the state attorney general, the department of state, the division of state police, and the department of financial services as to the timing, content and distribution of the notices and approximate number of affected persons and shall provide a copy of the template of the notice sent to affected persons;

In the event that more than five thousand New York residents are to be notified at one time, the person or business shall also notify consumer reporting agencies as to the timing, content and distribution of the notices and approximate number of affected persons.

Is encrypted information treated differently?

The definition covers data that is not encrypted, and data encrypted with a key that was also accessed or acquired.

personal information consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:

What if a vendor holds the data?

A person or business that keeps computerized private information it does not own must tell the owner or licensee immediately, and within thirty days after discovering the breach.

Any person or business which maintains computerized data which includes private information which such person or business does not own shall notify the owner or licensee of the information of any breach of the security of the system immediately, provided that such notification shall be made within thirty days following discovery, if the private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.