Quick Facts
Breach Based on Harm Threshold: No
Deadline for Consumer Notice: Most expedient time possible and without unreasonable delay
Government Notification Required: Yes
Scope of this Summary:
Notification requirements applicable to persons or businesses that own, license, or maintain covered info. Some types of businesses may be exempt from some or all of these requirements, and non-commercial entities may be subject to different requirements.
Risk of Harm Threshold
Notice to affected individuals is not required if the covered entity determines the private information was inadvertently disclosed by an authorized person and the person or entity reasonably determines that the exposure is not likely to result in: misuse of the private information, financial harm to the affected individuals, or emotional harm to the affected individuals, in the case of unknown disclosure of online credentials.
Breach Defined
Unauthorized access to or acquisition of covered info that compromises the data's security, confidentiality, or integrity, excluding certain good-faith acquisitions by employees or agents. The statute lists factors that can be considered to determine if covered info was "acquired."
Encryption Safe Harbor
Statute does not apply to information that is encrypted, so long as encryption key was not accessed or acquired.
Form of Covered Info
Electronic Only
Covered Information
- Information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person, in combination with any one or more of the following data elements:
- Social Security number.
- Driver's license number or non-driver identification card number.
- Account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual's financial account.
- Account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual's financial account without additional identifying information, security code, access code, or password.
- Biometric information, meaning data generated by electronic measurements of an individual's unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual's identity.
- A consumer credit card that can be used without a CVV code may trigger a breach.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
Consumer Notice Timing
Must be made in the most expedient time possible and without unreasonable delay and consistent with any measures necessary to determine the scope of the breach and to restore the integrity of the system.
Consumer Notice Method
By written notice, telephone notice (if a log of notifications is kept), or electronic notice (if resident expressly consented to receiving electronic notice, a log of each notification is kept, and business does not require resident to consent to receive notice electronically as a condition of the business relationship). Substitute notice is available if certain criteria are satisfied.
Consumer Notice Content
The notification shall include:
- Contact information for the person or business making the notification.
- Telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identity theft prevention and protection information.
- A description of the categories of information that were, or are reasonably believed to have been, accessed or acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so accessed or acquired.
Delayed Notice
Notification may be delayed if law enforcement determines notice may impede a criminal investigation.
Government Notice
If residents are notified, must notify the NY Attorney General, the NY Department of State Division of Consumer Protection and New York State Police of the timing, content, and distribution of the notices and the approximate number of affected persons. Collaboration affords affected businesses the ability to effectuate notice to all required recipients via the Office of the Attorney General's online portal. This notice must not delay consumer notice.
Regardless of whether a breach affects private information as defined by the general data breach statute, if a covered entity notifies the secretary of health and human services of a breach under HIPAA or HITECH requirements, the covered entity must also notify the NY attorney general within five days
Consumer Reporting Agency Notice
If more than 5,000 residents are notified, must notify Consumer Reporting Agencies of timing, distribution, and content of the consumer notice and the approximate number of affected persons. CRA notice must not delay consumer notice.
Exceptions for Other Laws
Entities subject to breach notification requirements under the following laws are not required to send additional state law notice to affected individuals: Gramm-Leach-Bliley Act, Health Information Portability and Accountability Act (HIPAA), and Health Information Technology for Economic and Clinical Health Act (HITECH Act).
Third-Party Notice
If you maintain covered info on behalf of another entity, you must notify it immediately following discovery of a breach.
Private Right of Action
*The New York general breach notification statute does not provide for a private right of action; however, it expressly states that it does not exclude other remedies permitted by law (N.Y. Gen. Bus. Law § 899-aa(6)(b)).
Potential Penalties
Violations may result in civil penalties.
This summary is for informational purposes only. It provides general information and not legal advice or opinions regarding specific facts. Additional requirements or conditions may apply to any or all provisions referenced herein. For more information about the state data breach notification laws or other data security matters, please seek the advice of counsel.
Last revised on June 15, 2023