Bill > S08169

This bill amends the state technology law to expand and clarify requirements for data breach notifications by state entities, including local governments. It introduces a new definition of "cybersecurity incident" as an event that threatens the integrity, confidentiality, or availability of computer networks, information systems, or infrastructure. The bill broadens the definition of a "breach of the security of the system" to include unauthorized acquisition, acquisition without valid authorization, and unauthorized utilization of computerized data. State entities are now required to notify New York state residents whose private information has been accessed, acquired, or utilized without valid authorization, and must do so in the most expedient time possible. The bill also mandates that state entities consult with the state office of information technology services to determine the breach's scope and restoration measures, with the office required to deliver a report within 90 days. Additionally, if a state entity maintains computerized data that it does not own, it must notify the data owner or licensee immediately upon discovering a breach. The bill aims to improve cybersecurity transparency and protect individuals' personal information by ensuring prompt and comprehensive breach notifications.

Budget and Finance, Business and Industry, Government Affairs

https://www.nysenate.gov/legislation/bills/2025/S8169