STATE OF NEW YORK
        ________________________________________________________________________
                                          2374
                               2019-2020 Regular Sessions
                   IN ASSEMBLY
                                    January 22, 2019
                                       ___________
        Introduced  by M. of A. DINOWITZ, BUCHWALD, GOTTFRIED, SIMON, SEAWRIGHT,
          SIMOTAS, BARRON, THIELE, FAHY, WRIGHT, GUNTHER, SOLAGES, ORTIZ, BRAUN-
          STEIN, WILLIAMS, OTIS, L. ROSENTHAL, SANTABARBARA, GALEF -- read  once
          and referred to the Committee on Consumer Affairs and Protection
        AN  ACT  to  amend  the general business law, in relation to requiring a
          consumer credit reporting agency to offer  identity  theft  prevention
          and  mitigation  services  in  the case of a breach of the security of
          such agency's system
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
     1    Section  1.  Subdivision  (n) of section 380-t of the general business
     2  law is amended by adding a new paragraph 3 to read as follows:
     3    (3)(i) Upon a breach of the security of the system of a consumer cred-
     4  it reporting agency which includes  any  social  security  number,  such
     5  agency shall offer to each consumer, whose information, including social
     6  security  number,  was  breached  or is reasonably believed to have been
     7  breached, reasonable identity theft prevention services and, if applica-
     8  ble, identify theft mitigation services for a period not to exceed  five
     9  years at no cost to such consumers. Such agency shall provide all infor-
    10  mation necessary for such consumers to enroll in such services and shall
    11  include information on how such consumers can request a security freeze.
    12  A  consumer  credit reporting agency shall not be required to offer such
    13  services if, after an appropriate investigation, the  agency  reasonably
    14  determines  that the breach of security is unlikely to result in harm to
    15  the consumers whose information has been breached.
    16    (ii) "Breach of the security of the system" as used in this  paragraph
    17  shall have the same definition as in paragraph (c) of subdivision one of
    18  section eight hundred ninety-nine-aa of this chapter.
    19    §  2.    This act shall take effect on the sixtieth day after it shall
    20  have become a law and shall apply to any breach of the security  of  the
    21  system  of a consumer credit reporting agency that occurred no more than
    22  three years prior to the effective date of this act.
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD01262-01-9