Relates to creating a private right of action for the breach of a consumer's identifying information such as their social security number, driver's license number, bank account number, credit or debit card number, personal identification number, automated or electronic signature, unique biometric data, account passwords or other information that can be used to access an individual's financial accounts or to obtain goods and services.
STATE OF NEW YORK
________________________________________________________________________
5005
2025-2026 Regular Sessions
IN SENATE
February 18, 2025
___________
Introduced by Sen. SEPULVEDA -- read twice and ordered printed, and when
printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law, in relation to creating a
private right of action for the breach of a consumer's identifying
information
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new section
2 380-mm to read as follows:
3 § 380-mm. Civil liability for breach of a consumer's identifying
4 information. 1. For purposes of this section the term "identifying
5 information" means an individual's:
6 (a) social security number;
7 (b) driver's license number;
8 (c) bank account number;
9 (d) credit or debit card number;
10 (e) personal identification number (PIN);
11 (f) automated or electronic signature;
12 (g) unique biometric data;
13 (h) account passwords; or
14 (i) any other piece of information that can be used to access an indi-
15 vidual's financial accounts or to obtain goods or services.
16 2. A consumer reporting agency, or other user of information, in
17 possession of a consumer's identifying information when such identifying
18 information is impermissibly obtained by an unauthorized third party, is
19 liable to such consumer in an amount equal to the sum of:
20 (a) ten-thousand dollars;
21 (b) any actual damages sustained by the consumer as a result of such
22 breach of identifying information; and
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD09265-01-5
S. 5005 2
1 (c) in the case of any successful action to enforce any liability
2 under this section, the costs of the action together with reasonable
3 attorney's fees as determined by the court.
4 § 2. This act shall take effect immediately.
