The New York Information Security Breach and Notification Act (ISBNA)

Who is affected by ISBNA?

The Act applies to all businesses operating in New York state and those maintaining records containing the personal information of New York residents. The Act requires businesses to “disclose any breach of the security of the system following discovery or notification of the breach… to any resident… whose private information was, or is reasonably believed to have been, acquired by a person without valid authorization.” Under the Act, personal information is defined as any non-public name or number that may be used to identify a specific individual, including:

• A social security number
• A driver’s license number or non-driver identification card number
• A financial account number
• A credit card or debit card number accompanied by applicable passwords or security codes

Disclosure must be made in the most expedient time possible and without unreasonable delay. Failure to abide by the Act can result in court-awarded damages for actual costs or losses incurred by an individual, as well as sanctions of up to $150,000 for intentional or reckless violation of the ISBNA.