STATE OF NEW YORK ________________________________________________________________________ 1670 2023-2024 Regular Sessions IN ASSEMBLY January 17, 2023 ___________ Introduced by M. of A. SANTABARBARA -- read once and referred to the Committee on Consumer Affairs and Protection AN ACT to amend the general business law, in relation to disclosure of breaches of the security of the system The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Subdivision 2 of section 899-aa of the general business 2 law, as amended by chapter 117 of the laws of 2019, is amended to read 3 as follows: 4 2. Any person or business which owns or licenses computerized data 5 which includes private information shall disclose any breach of the 6 security of the system [following] within five days of the discovery or 7 notification of the breach in the security of the system to any resident 8 of New York state whose private information was, or is reasonably 9 believed to have been, accessed or acquired by a person without valid 10 authorization. [The disclosure shall be made in the most expedient time 11 possible and without unreasonable delay, consistent with the legitimate 12 needs of law enforcement, as provided in subdivision four of this 13 section, or any measures necessary to determine the scope of the breach 14 and restore the integrity of the system.] 15 § 2. This act shall take effect immediately. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD03110-01-3