Ask Reggi Your Question Now
Can you summarize NYCL STT 208?
Internet Security and Privacy Act > Notification; person without valid authorization has acquired private information
Short Summary
This legal document, known as the Internet Security and Privacy Act, governs the notification of data breaches and the protection of private information in the state of New York. It defines ‘private information’ as personal information combined with specific data elements, such as social security numbers, driver’s license numbers, account numbers, credit or debit card numbers, and biometric information. The document requires state entities that own or license computerized data containing private information to disclose any breach of the security system to affected residents of New York state. The disclosure must be made in a timely manner, considering law enforcement needs and measures to determine the breach’s scope and restore data system integrity. The document also outlines notification methods, including written notice, electronic notice, telephone notification, and substitute notice. It establishes the obligation to provide contact information, relevant agency details, and a description of the accessed or acquired information. The state entity must notify the state attorney general, the department of state, and the state office of information technology services regarding the breach and affected persons. The document also emphasizes the importance of training state entities on best practices for preventing security breaches. Additionally, it requires covered entities to notify the state attorney general of breaches under the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act. Finally, the document mandates that certain entities adopt a notification policy consistent with its provisions within 120 days of its effective date.
Whom does it apply to?
State entities in the state of New York
What does it govern?
Notification of data breaches and protection of private information
What are exemptions?
Inadvertent disclosure of private information by authorized persons, where no misuse or harm is likely to occur
What are the Penalties?
Not specified in the provided document
Jurisdiction
New York