RitezyNew York legal help
Ask for free

Privacy & online · Your right

Data breaches in New York: your right to be notified and what to do next

Updated By The editorial teamNot reviewed by an attorney — based on the official sources below

In short

Under New York's General Business Law § 899-aa, a business that owns or licenses computerized private information about New York residents must notify you after discovering a breach — in the most expedient time possible and without unreasonable delay, and within 30 days after discovery, unless law enforcement needs a delay. 'Private information' includes your Social Security number, driver's license number, financial account or card numbers with access codes, biometric data, medical and health insurance information, and online usernames with passwords. The notice must tell you what was exposed and how to reach the company and the agencies that help. The Attorney General enforces the law.

Read on for the details, the exceptions and the sources.

In plain words

Data breach
Unauthorized access to, or acquisition of, computerized data that compromises the security, confidentiality or integrity of private information.
Private information
Information that identifies you combined with sensitive data, such as your Social Security number, account number with a password, or medical information — when not encrypted, or when the encryption key was also taken.
Security freeze
A block you place at each credit bureau so no one can open new credit in your name. It's free under federal law.
SHIELD Act
The New York law that strengthened the breach notice rules and requires businesses to keep reasonable safeguards for private information.

What is it?

General Business Law § 899-aa(2) requires any person or business that owns or licenses computerized data including private information to disclose a breach to every New York resident whose private information was, or is reasonably believed to have been, accessed or acquired without valid authorization. A business that only maintains data for someone else must notify the owner immediately, within 30 days of discovery (§ 899-aa(3)). Separately, § 899-bb requires businesses to maintain reasonable safeguards to protect private information.

Who qualifies?

Any New York resident whose 'private information' was involved. Under § 899-aa(1)(b), that means either:

  • Personal information combined with one or more of: Social Security number; driver's license or non-driver ID number; account, credit or debit card number with a code or password that allows access to the account, or that can be used without one; biometric information; medical information; or health insurance information — where the data or the combination isn't encrypted, or the encryption key was also accessed; or
  • A username or e-mail address together with a password or security question and answer that would allow access to an online account.

Exceptions

  • Publicly available information lawfully made public in government records is not private information (§ 899-aa(1)(b)).
  • Good-faith access by an employee or agent for business purposes isn't a breach, if the information isn't misused or further disclosed (§ 899-aa(1)(c)).
  • No individual notice is needed if the exposure was an inadvertent disclosure by authorized persons and the business reasonably decides it won't likely cause misuse or harm; it must document that in writing, and send it to the Attorney General if more than 500 New Yorkers were affected (§ 899-aa(2)(a)).
  • If the business already notified you under certain federal or state rules (such as the federal financial privacy and health privacy rules or the DFS cybersecurity regulation), it needn't notify you again, but must still notify the State agencies (§ 899-aa(2)(b)).
  • Notice may be delayed while law enforcement determines that it would impede a criminal investigation (§ 899-aa(4)).

How much?

The law gives you a right to be told, not a set payment. Its enforcement provision is a lawsuit by the Attorney General: the court can order the violation stopped and award damages for actual costs or losses incurred by people who weren't notified as required, including consequential financial losses. If the business violated the law knowingly or recklessly, the court can impose a civil penalty of the greater of $5,000 or up to $20 per failed notification, capped at $250,000 (§ 899-aa(6)(a)). Whether you can bring your own lawsuit over a breach depends on other laws and the facts — ask a lawyer.

How is it calculated?

The civil penalty is calculated per failed notification: for example, if a business knowingly failed to notify 20,000 New Yorkers, up to $20 per notice could be as much as $400,000, so the $250,000 cap would apply. If it failed to notify 100 people, $20 each would be only $2,000, so the penalty would be the $5,000 figure instead. Damages for people who weren't notified depend on their actual costs and losses.

What documents do you need?

  • The breach notice letter or e-mail, and the date you received it
  • Statements for any affected bank or card accounts
  • Your credit reports from the three bureaus
  • Records of any fraud, and of the time and money you spent dealing with it
  • Copies of reports to the police, the bank and the Attorney General

How do you get it?

  1. Read the notice closely

    It must describe which categories of information were exposed, give the business's contact information, and list the phone numbers and websites of state and federal agencies that help with breach response and identity theft (§ 899-aa(7)).

  2. Lock down accounts

    Change passwords and security questions for the affected account and any account that used the same password; turn on two-step login.

  3. Freeze your credit

    If your Social Security number or financial information was exposed, place a free security freeze with each credit bureau (15 U.S.C. § 1681c-1(i)).

  4. Watch your accounts

    Check bank and card statements and your credit reports for activity you don't recognize.

  5. Report problems

    If you think a business failed to notify you, or the notice was late, report it to the New York Attorney General.

What if they refuse?

If a business won't confirm whether your data was involved, or you learned of a breach long after it happened, file a complaint with the New York Attorney General, which receives and investigates breach reports. Businesses must also notify the Attorney General, the Department of State and the Division of State Police of breaches affecting New Yorkers — and DFS if they are regulated by it (§ 899-aa(8)(a)).

Deadlines

  • Notice to you: as fast as possible and within 30 days after discovery, unless law enforcement requires a delay (§ 899-aa(2), (4)).
  • A business that maintains data for another must notify the owner within 30 days of discovery (§ 899-aa(3)).
  • If more than 5,000 New Yorkers are notified at once, the credit bureaus must also be told (§ 899-aa(8)(b)).
  • The Attorney General must sue within 3 years after learning of the violation or receiving the breach notice, and never more than 6 years after the breach was discovered, unless the company hid it (§ 899-aa(6)(c)).

Frequently asked questions

How long does a company have to tell me about a data breach in New York?

It must notify you in the most expedient time possible and without unreasonable delay, and within 30 days after discovering the breach, unless law enforcement needs a delay for an investigation (General Business Law § 899-aa(2), (4)).

Does a leaked password count?

Yes. A username or e-mail address combined with a password or security question and answer that allows access to an online account is 'private information' under § 899-aa(1)(b)(ii).

Can I sue the company for the breach?

The statute's enforcement provision is an action by the Attorney General, and § 899-bb, which requires reasonable data security, says it creates no private right of action. Other claims may exist depending on the facts — ask a lawyer.

Is a credit freeze really free?

Yes. Federal law requires each nationwide credit bureau to place a security freeze free of charge when you ask (15 U.S.C. § 1681c-1(i)).

Want your own situation checked?

This page is general. Describe what happened, attach the letter or document you received, and get a free first answer — then, if you want, a full check against New York and federal law and a letter ready to send.

Check my situation — free

Official sources

This page was written from the sources below. “Checked” is the date the source was last opened and read.

Related questions

Related guides

This page is general information based on the official sources listed, current as of the update date. It is not legal advice and does not replace a review of your own situation; if a case is already in court, a deadline is close, the amount is large, or there are criminal, immigration or family-law consequences, talk to a lawyer or legal aid.