New York Breach Law
December 07, 2005 - New York has joined the growing list of states requiring that companies notify their customers whenever private information has been compromised. The state's Information Security Breach and Notification Act went into effect in December 2005.
The law, which is similar to California's SB-1386 notification law, requires
businesses and state agencies to inform New York residents "whose
unencrpyted personal information may have been acquired by an unauthorized
person," according to the text of the legislation.
New York's law is one of a growing number of legislative and regulatory
efforts that are forcing executives to pay more attention to security. If
your information is compromised, or if you have reason to believe it may
have been compromised, you have to report it.
According to a recent survey of security breach victims in the U.S., 20% of
respondents said they had terminated their relationship with the company in
charge of the data. Another 40% said they would consider doing so, according
to the study, which was conducted this year by Ponemon Institute LLC, a
privacy think tank in Tucson, Ariz.
Since California's notification law was passed, it has brought dozens of
information security breaches to light and put computer security and privacy
in the public spotlight. One of the most prominent disclosures was by
ChoicePoint Inc., which recently took a $6 million charge for legal expenses
and fees related to the theft of personal information belonging to 145,000
consumers that had been stored in its database.