BILL NUMBER: S3078
SPONSOR: COMRIE
 
TITLE OF BILL:
An act to amend the general business law, in relation to credit monitor-
ing services
 
PURPOSE:
To require that companies that suffer a data breach provide free credit
monitoring services to effected persons for up to one year following the
breach.
 
SUMMARY OF PROVISIONS:
Section 1 - Requires that companies that suffer a data breach provide
free credit monitoring services to effected persons for up to one year
following the breach.
Section 2 - Effective date.
 
JUSTIFICATION:
Recent headlines have been dominated by a. massive data breach that
impacted the largest credit-reporting firm in the United States. This
breach is estimated to have effected 143 million Americans, or 44t of
the population. Millions suddenly found that their birthdates, home
addresses, telephone numbers, and, in some cases, even their social
security numbers and drivers license numbers had been leaked.
The implications of such a large scale and egregious breach of consumer
data security are serious. Millions have been exposed to the possibility
of becoming victims identity theft. This can lead to ongoing credit
problems and major costs to consumers to remedy the damage done. We must
do more to make sure that data breaches are prevented. But just as
important, is making sure consumers and law enforcement have the tools
available to mitigate damage as soon as a breach occurs. This bill, part
of a larger package that will target consumer data breaches at every
stage, will provide one of those tools.
This bill will require that companies that suffer a breach provide free
credit monitoring services to victims for up to one year following the
discovery of the breach. Credit monitoring is key to identifying the
occurrence of identity theft. This bill is a significant step toward
putting power back in the hands of the consumer.
 
LEGISLATIVE HISTORY:
2024: S1713 Comrie/ A3913 Fahy
2022: S3674
2017-18: SC912/A2732 - CONSUMER PROTECTION/consumer affairs & protection
 
FISCAL IMPLICATIONS:
None to the state.
 
EFFECTIVE DATE:
Immediately.

Statutes affected:
S3078: 899-aa general business law, 899-aa(7) general business law