New York General Business Law § 899-aa

Enacted:  12.7.2005

Type of Data Covered: Computerized or electronic data. 

​

Is Breach Defined?

“Breach of the security of the system” shall mean unauthorized acquisition or acquisition without valid authorization of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a business. Good faith acquisition of personal information by an employee or agent of the business for the purposes of the business is not a breach of the security of the system, provided that the private information is not used or subject to unauthorized disclosure."

​

​

When is notice required?

​

Notice is required for all affected residents "...in the most expedient time possible, consistent with the legitimate needs of law enforcement...or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system." Notification may be written, electronic, telephonic, or via "substitute notice" procedures, depending on circumstances. Notice must "include contact information for the person or business making the notification and a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired." The Attorney General must receive notice for all breaches and any affecting over 5,000 residents trigger notice to consumer credit agencies. 

​

What are the penalties for non-compliance?

​

Violations have their own section of the law, § 899-aa(6), which reads as follows: 

​

• 6.  

  • (a)  whenever the attorney general shall believe from evidence satisfactory to him that there is a violation of this article he may bring an action in the name and on behalf of the people of the state of New York, in a court of justice having jurisdiction to issue an injunction, to enjoin and restrain the continuation of such violation. In such action, preliminary relief may be granted under article sixty-three of the civil practice law and rules. In such action the court may award damages for actual costs or losses incurred by a person entitled to notice pursuant to this article, if notification was not provided to such person pursuant to this article, including consequential financial losses. Whenever the court shall determine in such action that a person or business violated this article knowingly or recklessly, the court may impose a civil penalty of the greater of five thousand dollars or up to ten dollars per instance of failed notification, provided that the latter amount shall not exceed one hundred fifty thousand dollars.

  • (b)  the remedies provided by this section shall be in addition to any other lawful remedy available.

  • (c)  no action may be brought under the provisions of this section unless such action is commenced within two years immediately after the date of the act complained of or the date of discovery of such act.

​

​