NY Gen Bus L § 899-BB (2021)
2021 New York Laws GBS - General Business Article 39-F - Notification of Unauthorized Acquisition of Private Information; Data Security Protections 899-BB - Data Security Protections.

§  899-bb.  Data  security protections. 1. Definitions. (a) "Compliant regulated entity" shall mean any person or business that is subject  to, and in compliance with, any of the following data security requirements:  (i)  regulations  promulgated  pursuant  to  Title  V  of  the federal Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), as amended from time to time;  (ii) regulations implementing the  Health  Insurance  Portability  and Accountability  Act  of  1996  (45 C.F.R. parts 160 and 164), as amended from time to time, and the Health Information  Technology  for  Economic and Clinical Health Act, as amended from time to time;  (iii)  part  five  hundred  of  title  twenty-three  of  the  official compilation of codes, rules and regulations of the state of New York, as amended from time to time; or  (iv) any other  data  security  rules  and  regulations  of,  and  the statutes  administered by, any official department, division, commission or agency of the federal or New York state  government  as  such  rules, regulations  or  statutes  are interpreted by such department, division, commission or agency or by the federal or New York state courts.  (b) "Private information" shall have the same meaning  as  defined  in section eight hundred ninety-nine-aa of this article.  (c)  "Small business" shall mean any person or business with (i) fewer than fifty employees; (ii) less than  three  million  dollars  in  gross annual  revenue  in  each  of the last three fiscal years; or (iii) less than five million  dollars  in  year-end  total  assets,  calculated  in accordance with generally accepted accounting principles.   2.  Reasonable  security  requirement. (a) Any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain  reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.  (b)  A  person  or  business  shall be deemed to be in compliance with paragraph (a) of this subdivision if it either:  (i) is a compliant regulated entity as defined in subdivision  one  of this section; or  (ii) implements a data security program that includes the following:  (A)  reasonable  administrative  safeguards  such as the following, in which the person or business:  (1) designates one  or  more  employees  to  coordinate  the  security program;  (2) identifies reasonably foreseeable internal and external risks;  (3)  assesses  the  sufficiency  of safeguards in place to control the identified risks;  (4) trains and manages employees in the security program practices and procedures;  (5) selects  service  providers  capable  of  maintaining  appropriate safeguards, and requires those safeguards by contract; and  (6)  adjusts  the security program in light of business changes or new circumstances; and  (B) reasonable technical safeguards such as the  following,  in  which the person or business:  (1) assesses risks in network and software design;  (2)   assesses  risks  in  information  processing,  transmission  and storage;  (3) detects, prevents and responds to attacks or system failures; and  (4) regularly tests and monitors the effectiveness  of  key  controls, systems and procedures; and  (C) reasonable physical safeguards such as the following, in which the person or business:  (1) assesses risks of information storage and disposal;  (2) detects, prevents and responds to intrusions;  (3)  protects  against  unauthorized  access  to  or  use  of  private information  during  or  after  the   collection,   transportation   and destruction or disposal of the information; and  (4) disposes of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.  (c) A small business as defined in paragraph (c) of subdivision one of this  section  complies  with  subparagraph  (ii)  of  paragraph  (b) of subdivision two of this section if the small business's security program contains reasonable administrative, technical  and  physical  safeguards that  are appropriate for the size and complexity of the small business, the nature and  scope  of  the  small  business's  activities,  and  the sensitivity of the personal information the small business collects from or about consumers.  (d)  Any person or business that fails to comply with this subdivision shall be deemed to have violated section  three  hundred  forty-nine  of this  chapter,  and the attorney general may bring an action in the name and on behalf of the people of the state of  New  York  to  enjoin  such violations  and  to  obtain  civil penalties under section three hundred fifty-d of this chapter.  (e) Nothing in this section shall create a private right of action.