New York Governor Andrew Cuomo has signed into law Senate Bill S3582, which further expands
obligations owed to consumers when a data security breach affects a
credit reporting agency. Specifically, upon the "breach of the
security of the system" of a consumer credit reporting agency
that includes a consumer's Social Security number, that credit
reporting agency must offer identity theft prevention services and,
if applicable, identity theft mitigation services, for a period not
to exceed five years, at no cost to the affected consumers.
Additionally, the credit reporting agency must inform consumers how
to request a security freeze.
What constitutes a "breach of the security of the
system" remains the same as defined in New York's existing
data breach statute NY Gen Bus Law §899-aa. An exception to
the requirement to provide the enumerated services to consumers in
the event of a breach exists for incidents in which, after
appropriate investigation, the agency
