New York State Assembly

 
•  Summary 
 
•  Actions 
 
•  Committee Votes 
 
•  Floor Votes 
 
•  Memo 
 
•  Text 
 
•  LFIN 
 
•  Chamber Video/Transcript 

A02374 Summary:

A02374 Actions:

A02374 Committee Votes:

Committee:CONSUMER AFFAIRS AND PROTECTION   Chair:DenDekker      
DATE:02/05/2019AYE/NAY:15/0  Action: Favorable refer to committee Codes        
DenDekker
Aye
Mikulin
Aye
Abbate
Aye
McDonough
Aye
Quart
Aye
Miller
Aye
Buchwald
Aye
Palumbo
Excused
Simon
Aye
Dilan
Aye
Seawright
Aye
Rozic
Aye
Niou
Aye
Pheffer Amato
Aye
Williams
Aye
Fall
Aye

Committee:CODES   Chair:Lentol      
DATE:02/11/2019AYE/NAY:22/0  Action: Favorable         
Lentol
Aye
Ra
Aye
Schimminger
Aye
Giglio
Aye
Pretlow
Aye
Montesano
Aye
Cook
Aye
Morinello
Aye
Cymbrowitz
Aye
Palumbo
Aye
O'Donnell
Aye
Garbarino
Aye
Lavine
Aye
Perry
Aye
Zebrowski
Aye
Abinanti
Aye
Weprin
Aye
Mosley
Aye
Hevesi
Aye
Fahy
Aye
Seawright
Aye
Rosenthal
Aye

A02374 Floor Votes:

A02374 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
 submitted in accordance with Assembly Rule III, Sec 1(f)



 
BILL NUMBER: A2374
 
SPONSOR: Dinowitz

 
TITLE OF BILL:  An act to amend the general business law, in relation
to requiring a consumer credit reporting agency to offer identity theft
prevention and mitigation services in the case of a breach of the secu-
rity of such agency's system
 
 
PURPOSE OR GENERAL IDEA OF BILL:
 
This bill would provide reasonable consumer protections following a
breach of consumer credit data at a credit reporting agency (CRA), when
such a breach involves social security numbers.
 
 
SUMMARY OF SPECIFIC PROVISIONS:

Section 1 amends subdivision n of section 380-t of the general business
law by adding a new paragraph 3 that would require that when a credit
reporting agency suffers a breach of information containing consumer
social security numbers, the CRA must provide lifetime identity theft
prevention services, and if applicable, identity theft mitigation
services to affected customers. Additionally, this new paragraph would
prohibit fees relating to the implementation and lifting of security
freezes on consumer credit reports, if those reports were part of a
breach of information containing social security numbers.
 
Section 2 amends subdivision q of section 380-t of the general business
law by including new language to be included in a consumers summary of
rights CRAs must provide consumers on credit freezes to inform them that
in the instance of a breach of date involving a social security number,
that a consumer has the right to freeze their credit at no cost.

Section 3 sets the effective date.
 
 
JUSTIFICATION:
 
In late July 2017, one of the three main CRAs, Equifax Inc., experienced
a major data breach involving personal information that included theft
of social security numbers. At the time it was widely reported to impact
over 140 million accounts, but the full extent of the breach is still
uncertain. CRAs have been the subject of public scrutiny in years past
for their inaccurate files kept on unknowing consumers and the cumber-
some process they subject average people to in order to rectify such
errors. The magnitude of this breach won't be known for years, but the
status quo where consumers must bear the burden to protect their own
identities is unacceptable. To date, Equifax has offered to waive fees
for security freezes for a short time period, and offered 12 months of
identity theft prevention services at no charge. This response is simply
insufficient given that innocent people's information was stolen through
no fault of their own. This legislation aims to establish the minimal
amount of long term protection consumers could ask for, and even still
it is just that, the bare minimum.
 
 
PRIOR LEGISLATIVE HISTORY:
 
2017-18- A.8695A - Passed Assembly/S.6923A - Referred to Consumer
Protection
 
 
FISCAL IMPLICATIONS TO THE STATE:
None to the state.
 
 
EFFECTIVE DATE:
This act shall take effect on the sixtieth day after it shall have
become a law and shall apply to any breach of the security of a consumer
credit reporting agency that occurred no more than three years prior to
the effective date of this act.

A02374 Text:

 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                          2374
 
                               2019-2020 Regular Sessions
 
                   IN ASSEMBLY
 
                                    January 22, 2019
                                       ___________
 
        Introduced  by M. of A. DINOWITZ, BUCHWALD, GOTTFRIED, SIMON, SEAWRIGHT,
          SIMOTAS, BARRON, THIELE, FAHY, WRIGHT, GUNTHER, SOLAGES, ORTIZ, BRAUN-
          STEIN, WILLIAMS, OTIS, L. ROSENTHAL, SANTABARBARA, GALEF -- read  once
          and referred to the Committee on Consumer Affairs and Protection
 
        AN  ACT  to  amend  the general business law, in relation to requiring a
          consumer credit reporting agency to offer  identity  theft  prevention
          and  mitigation  services  in  the case of a breach of the security of
          such agency's system
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section  1.  Subdivision  (n) of section 380-t of the general business
     2  law is amended by adding a new paragraph 3 to read as follows:
     3    (3)(i) Upon a breach of the security of the system of a consumer cred-
     4  it reporting agency which includes  any  social  security  number,  such
     5  agency shall offer to each consumer, whose information, including social
     6  security  number,  was  breached  or is reasonably believed to have been
     7  breached, reasonable identity theft prevention services and, if applica-
     8  ble, identify theft mitigation services for a period not to exceed  five
     9  years at no cost to such consumers. Such agency shall provide all infor-
    10  mation necessary for such consumers to enroll in such services and shall
    11  include information on how such consumers can request a security freeze.
    12  A  consumer  credit reporting agency shall not be required to offer such
    13  services if, after an appropriate investigation, the  agency  reasonably
    14  determines  that the breach of security is unlikely to result in harm to
    15  the consumers whose information has been breached.
    16    (ii) "Breach of the security of the system" as used in this  paragraph
    17  shall have the same definition as in paragraph (c) of subdivision one of
    18  section eight hundred ninety-nine-aa of this chapter.
    19    §  2.    This act shall take effect on the sixtieth day after it shall
    20  have become a law and shall apply to any breach of the security  of  the
    21  system  of a consumer credit reporting agency that occurred no more than
    22  three years prior to the effective date of this act.
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD01262-01-9