Recent Amendment To New York State Technology Law Demonstrates Rapid Evolution Of Privacy Laws

The New York State Technology Law (STT) § 209 governs the obligations of state agencies if there is a data breach or other privacy incident. Under the STT, state agencies are defined to include state boards, bureaus, divisions, committees, commissions, councils, departments, public authorities, public benefit corporations, offices, or other governmental entities performing governmental or proprietary functions for the state of New York. In short, even though data collection and use by private entities is governed by the New York General Business Law (GBL) § 899-aa, the STT impacts a number of public entities. The GBL applies to all entities that own license or maintain personal information of New York residents and requires notification to state entities in the event of unauthorized access or exfiltration to personal information. The STT addresses the obligations of those state entities upon receiving notice of a data breach.