New York breach notification law goes into effect

IDG News Service - NEW YORK -- New York has joined the growing list of states requiring that companies notify their customers whenever private information has been compromised. The state's Information Security Breach and Notification Act went into effect Wednesday, according to a spokeswoman for the state's attorney general, Eliot Spitzer.

The law, which is similar to California's SB-1386 notification law, requires businesses and state agencies to inform New York residents "whose unencrpyted personal information may have been acquired by an unauthorized person," according to the text of the legislation.

New York's law is one of a growing number of legislative and regulatory efforts that are forcing executives to pay more attention to security, said Dan Aiken, compliance director at New York's Hospital for Special Surgery. "Now, like in California, if your information is compromised, or if you have reason to believe it may have been compromised, you have to report it," he said, speaking at the Infosecurity conference in New York Wednesday. "There's a real risk to brand name, to your public reputation."

According to a recent survey of security breach victims in the U.S., 20% of respondents said they had terminated their relationship with the company in charge of the data. Another 40% said they would consider doing so, according to the study, which was conducted this year by Ponemon Institute LLC, a privacy think tank in Tucson, Ariz.

Since California's notification law was passed, it has brought dozens of information security breaches to light and put computer security and privacy in the public spotlight. One of the most prominent disclosures was by ChoicePoint Inc., which recently took a $6 million charge for legal expenses and fees related to the theft of personal information belonging to 145,000 consumers that had been stored in its database.

The California law has had a far-reaching effect, said Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit advocacy organization. "Ever since the ChoicePoint breach happened ... companies have essentially taken the California law and adopted it as a best practice," she said.

Ponemon estimates that just over 30% of U.S. companies have now adopted such a policy.

While it is unclear how much of an effect the New York law will have, given the level of disclosure already required by the 20 other states, Givens believes that it will be good for consumers.

The law will also put pressure on the federal government to adopt similar notification legislation, Givens said. Observers expect some form of federal legislation to be passed next year.

One security vendoragreed that the New York law was important.

"New York is one of the most populous states in the country," said Marv Goldschmitt, vice president of business development at Tizor Systems, a vendor of data monitoring appliances. "It matters significantly. Eliot Spitzer is a loud voice of consumer and public consciousness, so it's clearly a statement that will be heard."