How New York Data Breach Law Interacts with Federal Rules

The law distinguishes identifying details, called "personal information," from "private information" that triggers notification. The latter includes identifying information paired with Social Security numbers, driver's license numbers, qualifying financial account details, biometrics, or medical or health insurance information. Online credentials that permit account access can also qualify.

Encryption does not exempt data when an unauthorized person also obtains the key. Businesses reviewing broader privacy and data protection duties should identify which records satisfy this statutory definition.

Section 899-aa covers unauthorized access as well as acquisition. Access logs or evidence that someone viewed or altered records can matter without a confirmed download. Copying, possession, or fraudulent use can indicate acquisition.

Good-faith employee access for business purposes is excluded if the information is neither misused nor disclosed without authorization. Investigators should document what the person accessed and why.

GBL § 899-bb separately requires reasonable administrative, technical, and physical safeguards, including employee training, vendor oversight, monitoring, and secure disposal. Qualifying small businesses may use proportionate safeguards.

Compliance with specified regulatory security requirements can satisfy § 899-bb, but does not automatically remove breach notification duties. A data privacy compliance program should address both.

Under § 899-aa(2), owners and licensees must notify affected residents without unreasonable delay and generally within 30 days after discovery. The duty includes reasonably suspected unauthorized access or acquisition.

Service providers maintaining another entity's covered information must notify the owner or licensee immediately, and no later than 30 days after discovery. That notice does not replace resident notification.

When residents require notice, § 899-aa(8) also requires reports to the Attorney General, Department of State, and Division of State Police. NYDFS-covered entities have additional reporting duties. More than 5,000 simultaneous resident notices also trigger reporting to consumer reporting agencies.

Resident notices must identify the business, describe affected information categories, and provide required government resources. Written, consent-based electronic, telephone, and substitute notices have different conditions. Agency filings must not delay resident notices.

A law enforcement agency may authorize delay when disclosure would impede a criminal investigation. Notification resumes when the agency determines disclosure no longer compromises it.

An exception covers certain inadvertent disclosures by authorized people when specified harms are unlikely. Businesses must document that determination and retain it for at least five years. If more than 500 residents are affected, they must submit it to the Attorney General within 10 days. An undocumented assumption that the incident caused no harm does not satisfy this exception.

Under 23 NYCRR § 500.17(a), covered financial entities must report qualifying cybersecurity incidents to NYDFS promptly, no later than 72 hours after determining an incident occurred. Triggers include certain regulatory notices, material operational threats, and ransomware deployments.

This is not a universal 72-hour deadline. Qualifying incidents at affiliates or service providers can also trigger reporting for covered entities.

HIPAA generally requires covered entities to notify individuals of breaches of unsecured protected health information without unreasonable delay, within 60 days. HHS reports for breaches affecting 500 or more individuals are generally due within 60 days; smaller breaches may be reported within 60 days after the calendar year ends. Business associates notify covered entities.

The FTC Safeguards Rule, 16 C.F.R. § 314.4(j), requires covered financial institutions to report qualifying events involving at least 500 consumers' unencrypted information within 30 days after discovery. Unlike financial regulation, HIPAA regulatory affairs concern healthcare information.

Section 899-aa(2)(b) recognizes qualifying individual notices under specified regulatory schemes, but state agency and consumer reporting agency filings may remain due. Section 899-aa(9) additionally requires certain HIPAA-regulated entities to notify the Attorney General within five business days after notifying HHS, even for some information outside the state definition.

A breach notice alone does not prove wrongdoing or create a damages claim. The Attorney General may investigate violations; private data breach disputes require separate legal grounds. Section 899-bb does not independently create a private right of action.

Under GBL § 899-aa(6), the Attorney General may seek injunctive relief for notification violations. Courts may also award actual losses to affected individuals and impose civil penalties for knowing or reckless violations.

GBL § 899-bb separately authorizes enforcement of reasonable security requirements through applicable consumer protection provisions. Investigations may examine notification records, security safeguards, and how an organization responded after discovering unauthorized access.

Receiving a breach notification does not automatically entitle an individual to compensation. Section 899-bb expressly does not create a private right of action.

Affected individuals may have claims under other applicable laws, depending on the company's conduct, the information involved, and the harm suffered. These questions require separate analysis beyond statutory notification compliance.