STATE OF NEW YORK
________________________________________________________________________
804
2025-2026 Regular Sessions
IN SENATE(Prefiled)
January 8, 2025
___________
Introduced by Sen. COMRIE -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to when and how
notification of a data breach is to be provided to the department of
financial services
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Paragraph (a) of subdivision 8 of section 899-aa of the
2 general business law, as amended by a chapter of the laws of 2024 amend-
3 ing the general business law relating to notification of a data breach,
4 as proposed in legislative bills numbers S. 2659-B and A. 8872-A, is
5 amended to read as follows:
6 (a) In the event that any New York residents are to be notified, the
7 person or business shall notify the state attorney general, the depart-
8 ment of state, the division of state police, and the department of
9 financial services as to the timing, content and distribution of the
10 notices and approximate number of affected persons and shall provide a
11 copy of the template of the notice sent to affected persons; provided,
12 however, that notice to the department of financial services shall only
13 be required if the person or business is a covered entity, as defined in
14 23 NYCRR 500.1, and provided further that such notice shall be provided
15 to the department of financial services in compliance with 23 NYCRR
16 500.17. Such notice shall be made without delaying notice to affected
17 New York residents.
18 § 2. This act shall take effect on the same date and in the same
19 manner as a chapter of the laws of 2024 amending the general business
20 law relating to notification of a data breach, as proposed in legisla-
21 tive bills numbers S. 2659-B and A. 8872-A, takes effect.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD02809-01-5
