Bill Text: NY S07038 | 2017-2018 | General Assembly | Introduced

---

Bill Title: Prohibits consumer credit reporting agencies from charging a fee to a consumer requesting the placement of a security freeze.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced - Dead) 2018-01-03 - REFERRED TO CONSUMER PROTECTION [S07038 Detail]

Download: New_York-2017-S07038-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________
                                          7038
                    IN SENATE
                                       (Prefiled)
                                     January 3, 2018
                                       ___________
        Introduced  by  Sen. KENNEDY -- read twice and ordered printed, and when
          printed to be committed to the Committee on Consumer Protection
        AN ACT to amend the general business law,  in  relation  to  a  consumer
          credit reporting agency's actions following a security breach
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:
     1    Section 1. Subdivision (n) of section 380-t of  the  general  business
     2  law is amended by adding a new paragraph 3 to read as follows:
     3    (3)  No  consumer  credit  reporting  agency  shall  charge a fee to a
     4  consumer requesting the placement of a security freeze or the lifting of
     5  a security freeze following a  security  breach  of  a  consumer  credit
     6  reporting agency.
     7    For  the  purposes  of  this  paragraph, the term "breach of security"
     8  shall mean the unauthorized disclosure or use by an employee or agent of
     9  an agency, or the unauthorized  possession  by  someone  other  than  an
    10  employee or agent of an agency, of personal identifying information that
    11  compromises  the security, confidentiality or integrity of such informa-
    12  tion. Good faith or inadvertent possession of any  personal  identifying
    13  information  by  an  employee  or  agent of an agency for the legitimate
    14  purposes of the agency, and good faith or legally mandated disclosure of
    15  any personal identifying information by an employee or agent of an agen-
    16  cy for the legitimate purposes of the  agency  shall  not  constitute  a
    17  breach of security.
    18    §  2.  This  act  shall take effect immediately and shall apply to any
    19  data breach that occurred on or after January 1, 2017.
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD13705-01-7