L.L. 2005/046

Enactment date: 5/19/2005

Int. No. 141-A

By Council Members Reed, Brewer, Gentile, Gioia, Monserrate, Nelson, Moskowitz, Addabbo, Liu, Koppell, Weprin and The Public Advocate (Ms. Gotbaum)

A Local Law to amend the administrative code of the city of New York, in relation to requiring businesses to notify consumers in the event of a security breach of personal identifying information.

Be it enacted by the Council as follows:

Section One. Legislative declaration. The Council finds that acts of identity theft are plaguing New Yorkers. Federal Trade Commission statistics for 2002 and 2003 indicate that identity theft is the single most common consumer fraud complaint in the nation. New York City residents are as likely to be victimized by identity theft as the citizens of many cities within the United States.

The Council finds that identity thieves often gain control of victims' sensitive personal information by hacking into computers or otherwise violating the security of data systems. When such unauthorized persons acquire individuals' personal information, they are able to access bank accounts, take control of credit cards, and defraud unsuspecting victims. The Council thus finds that one of the most effective ways to curtail identity thieves is to inform would-be victims that the security of their sensitive personal information has been violated; individuals can then take the steps necessary to regain control of their privacy and finances.

Accordingly, the Council finds it necessary to require businesses required to be licensed by the Department of Consumer Affairs, or pursuant to provisions of state law enforced by the department, to inform individuals whenever there has been a breach of security with respect to sensitive personal information. Business people can best serve their fellow New Yorkers by making such disclosures expeditiously, while acting in accordance with the procedures of the New York City Police Department and other legitimate law enforcement agents.

* * *

[Consolidated provisions are not included in this Appendix A]

* * *

§ 3. If any section, subdivision, sentence, clause, phrase or other portion of this local law is, for any reason, declared unconstitutional or invalid in whole or in part, by any court of competent jurisdiction, such portion shall be deemed severable, and such unconstitutionality or invalidity shall not affect the validity of the remaining portions of this law, which remaining portions shall continue in full force and effect.

§ 4. This local law shall take effect 120 days after it shall have been enacted into law; provided that the Commissioner may take any actions necessary prior to such effective date for the implementation of this local law including, but not limited to, establishing guidelines and promulgating rules.