Source: https://ecode360.com/11768272
Timestamp: 2019-04-26 08:11:28+00:00

Document:
§ 49-1 Statutory authority; purpose.
§ 49-3 “Compromise of private information” defined.
§ 49-4 Requirements for encrypted data.
§ 49-5 Delay of notification.
§ 49-6 Methods of notification.
§ 49-7 Notification of CSCIC.
§ 49-8 Notification of Attorney General and Consumer Protection Board.
§ 49-9 Contents of notice.
§ 49-10 Applicability to third-party information.
§ 49-11 Notification of consumer reporting agencies.
This policy is consistent with State Technology Law § 208 as added by Chapters 442 and 491 of the Laws of 2005. This policy requires notification to affected New York residents and nonresidents. New York State values the protection of private information of individuals. The municipality, the City of Glen Cove, is required to notify an individual when there has been or is reasonably believed to have been a compromise of the individual’s private information in compliance with the Information Security Breach and Notification Act and this policy.
The municipality, after consulting with the State’s Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) to determine the scope of the breach and restoration measures, must notify an individual when it has been determined that there has been, or is reasonably believed to have been, a compromise of the individual’s private information through unauthorized disclosure.
A “compromise of private information” means the unauthorized acquisition of unencrypted computerized data with private information.
If encrypted data is compromised along with the corresponding encryption key, the data is considered unencrypted and thus falls under the notification requirements.
The municipality must notify CSCIC as to the timing, content and distribution of the notices and approximate number of affected persons.
The municipality must notify the Attorney General and the Consumer Protection Board, whenever notification to a New York resident is necessary, as to the timing, content and distribution of the notices and approximate number of affected persons.
Regardless of the method by which notice is provided, the notice must include contact information for the municipality making the notification and a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired.
This policy also applies to information maintained on behalf of the municipality by a third party.
When more than 5,000 New York residents must be notified at one time, then the municipality must notify the consumer reporting agencies as to the timing, content and distribution of the notices and the approximate number of affected individuals. This notice, however, will be made without delaying notice to the individuals.
Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. The State Attorney General is responsible for compiling a list of consumer reporting agencies and furnishing the list upon request to the municipality.
Account number, credit or debit card number, in combination with any required security code, access code, or password which would permit access to an individual’s financial account.
“Private information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
Any nonmunicipal employee such as a contractor, vendor, consultant, intern, other municipality, etc.

References: § 49

§ 49

§ 49

§ 49

§ 49

§ 49

§ 49

§ 49

§ 49
 § 208