STAFF CONTACT :
BILL
SUBJECT
DATE
SUMMARY: This bill requires that any business which owns or licenses computerized data which includes vulnerable personal information shall disclose any breach of security of the system to any resident of New York whose information was reasonably believed to have been acquired by an unauthorized person. The bill also allows for a class action suit to be brought against the company whose security was breached. If the suit is successful, each subscriber receives not less than $500, regardless of the amount of actual damages proved.
PERSONAL DATA: This bill does not tackle the real issue in question. The bill is designed to protect an individual's personal data. What the bill actually does is punish those businesses that maintain personal data if their security is breached, through no fault of their own. Businesses that collect and store personal data have gone to great lengths and expense to protect this information and keep it secure.
PENALTIES: If a business' security is breached, through no fault of its own, the business is forced to pay a penalty. The legislation allows for penalties for each instance where it fails to notify the consumers “immediately following the discovery” if the security is breached. The company could be subject to a class action lawsuit, and is then liable for “not less than $500 in damages, regardless of actual damages proved...”. This is an invitation to any trial lawyer, who would not have prove that anyone was harmed by such breach, but merely that notification was not done in a timely manner.
CONCLUSION: The goal of this legislation is laudable. However, this bill punishes companies and businesses attempting to protect their customers - the consumers. Many companies need certain personal information about their customers in order to conduct their business - in order to protect these very customers. The punitive measures under this legislation are focused on the wrong party. Rather than attempting to correct and address identity theft and other similar crimes - this legislation punishes the very companies attempting to help and aid consumers. For the above stated reason, The Business Council opposes this legislation and recommends it not be adopted.