Bill > A08614

This bill amends the state technology law to enhance data breach notification requirements for state entities, including local governments. The bill expands the definition of a "breach of the security of the system" to include unauthorized acquisition, acquisition without valid authorization, and unauthorized utilization of computerized data. It introduces a new term "cybersecurity incident," defined as an event occurring on or through a computer network that jeopardizes the integrity, confidentiality, or availability of computer systems, information networks, or infrastructure. The bill requires state entities that own, license, or maintain computerized data containing private information to disclose any security breaches to affected New York state residents in the most expedient time possible. When a breach occurs, the state entity must consult with the state office of information technology services to determine the breach's scope and restoration measures. Additionally, the bill mandates that state entities notify the owner or licensee of the information if they maintain computerized data they do not own and a breach occurs. The bill aims to improve transparency and prompt communication in the event of data compromises, helping to protect individuals' personal information and providing a clearer framework for handling cybersecurity incidents.

Government Affairs

https://www.nysenate.gov/legislation/bills/2025/A8614