Did You Know?

• There are specific considerations when determining if a breach is reportable in New York
• There are comprehensive requirements for information to be included in notifications
• Notifications may only be given by specific methods and some methods must be tracked
• If your breach affects residents in other states you will need to notify those residents using the rules of that state
• If a vendor is breached, they must report it to the data owner. The data owner will be responsible to complete the reporting and consumer notification
• Notifications must be given to the State Attorney General, the Department of State and the Division Of State Police, each on a breach reporting form
• If the breach affects over 5,000 NY residents, notification must be given to the consumer reporting agencies using a list of applicable agencies provided by the attorney general
• Violations can incur penalties up to $150,000 and the business can be enjoined and be required to pay damages for actual costs plus consequential financial losses
• New York has additional laws regarding how personal data is protected and disposed of to prevent a breach
• Federal laws, industry regulations, and/or out-of-country laws may also apply