Bill > S05005

This bill creates a new legal provision in New York's General Business Law that establishes a private right of action for consumers whose sensitive identifying information is improperly obtained by unauthorized third parties. The bill defines "identifying information" broadly to include social security numbers, driver's license numbers, bank and credit card numbers, personal identification numbers (PINs), electronic signatures, biometric data, account passwords, and any information that could be used to access financial accounts or obtain goods and services. If a consumer reporting agency or information user experiences a breach of a consumer's identifying information, they would be legally liable to pay the consumer $10,000, plus any actual damages resulting from the breach, and potentially the consumer's legal costs and attorney's fees if they successfully pursue the action in court. This legislation aims to provide stronger financial protections and legal recourse for consumers whose sensitive personal information is compromised, incentivizing organizations to maintain robust data security practices.

Business and Industry

https://www.nysenate.gov/legislation/bills/2025/S5005