New York S 8169: Requires all state entities to notify affected individuals in the event of a data breach where information is compromised

Bill Text

Bill Search and Legislative Information | New York State Assembly 

• 

• 

• 

• 

• 

• 

• 

• 

 Skip to main content 

 New York State Assembly

 Speaker Carl E. Heastie

 --> 
 --> 

 --> 

• 
 Assembly Members 

• 
 Legislative Info 

• 
 Public Hearings 

• 
 Speaker's Press 

• 
 Assembly Reports 

• 
 Committees & More 

• Bill Search Home
• Laws
• Legislative Calendar
• Public Hearing Schedule
• Assembly Calendars
• Assembly Committee Agenda 

 Javascript must be enabled to properly view this page. 

 Bill No.: 

• Summary 
• Actions 
• Committee&nbspVotes 
• Floor&nbspVotes 
• Memo 
• Text 
• LFIN 
• Chamber&nbspVideo/Transcript 
S08169 Summary:

BILL NOS08169 

&nbsp

SAME ASSAME AS A08614

&nbsp

SPONSORBYNOE

&nbsp

COSPNSR

&nbsp

MLTSPNSR

&nbsp

Amd §208, St Tech L

&nbsp

Requires all state entities, including local governments, to notify affected individuals in the event of a data breach where information is compromised; defines "cybersecurity incident".

Go to top S08169 Actions:

BILL NOS08169 

&nbsp

05/16/2025REFERRED TO INTERNET AND TECHNOLOGY

05/29/2025REPORTED AND COMMITTED TO FINANCE

06/04/2025COMMITTEE DISCHARGED AND COMMITTED TO RULES

06/04/2025ORDERED TO THIRD READING CAL.1569

06/10/2025PASSED SENATE

06/10/2025DELIVERED TO ASSEMBLY

06/10/2025referred to governmental operations

01/07/2026died in assembly

01/07/2026returned to senate

01/07/2026REFERRED TO INTERNET AND TECHNOLOGY

05/21/20261ST REPORT CAL.1323

05/26/20262ND REPORT CAL.

05/27/2026ADVANCED TO THIRD READING 

06/01/2026PASSED SENATE

06/01/2026DELIVERED TO ASSEMBLY

06/01/2026referred to governmental operations

Go to topS08169 Committee&nbspVotes:

Go to topS08169 Floor&nbspVotes:

There are no Assembly votes for this bill in this legislative session.

Go to topS08169 Text:

 STATE OF NEW YORK
 ________________________________________________________________________

 8169

 2025-2026 Regular Sessions

 IN SENATE

 May 16, 2025
 ___________

 Introduced by Sen. BYNOE -- read twice and ordered printed, and when
 printed to be committed to the Committee on Internet and Technology

 AN ACT to amend the state technology law, in relation to prompt notifi-
 cation to affected individuals in the event of a data breach within
 certain state entities

 The People of the State of New York, represented in Senate and Assem-
 bly, do enact as follows:

 1 Section 1. Paragraphs (b) and (c) of subdivision 1 of section 208 of
 2 the state technology law, paragraph (b) of subdivision 1 as amended by
 3 chapter 491 of the laws of 2005 and paragraph (c) of subdivision 1 as
 4 added by chapter 442 of the laws of 2005, are amended and a new para-
 5 graph (e) is added to read as follows:
 6 (b) "Breach of the security of the system" shall mean unauthorized
 7 acquisition [or], acquisition without valid authorization, or unauthor-
 8 ized utilization of computerized data which compromises the security,
 9 confidentiality, or integrity of personal information maintained by a
 10 state entity. Good faith acquisition of personal information by an
 11 employee or agent of a state entity for the purposes of the agency is
 12 not a breach of the security of the system, provided that the private
 13 information is not used or subject to unauthorized disclosure.
 14 In determining whether information has been acquired or utilized, or
 15 is reasonably believed to have been acquired or utilized, by an unau-
 16 thorized person [or a], person without valid authorization or unauthor-
 17 ized entity, such state entity may consider the following factors, among
 18 others:
 19 (1) indications that the information is in the physical possession and
 20 control of an unauthorized person, such as a lost or stolen computer or
 21 other device containing information; or
 22 (2) indications that the information has been downloaded or copied; or

 EXPLANATION--Matter in italics (underscored) is new; matter in brackets
 [ ] is old law to be omitted.
 LBD13104-03-5

 S. 8169 2

 1 (3) indications that the information was used by an unauthorized
 2 person, such as fraudulent accounts opened or instances of identity
 3 theft reported[.]; or
 4 (4) indications that a cybersecurity incident, as defined in paragraph
 5 (e) of this subdivision, as occurred.
 6 (c) "State entity" shall mean any state board, bureau, division,
 7 committee, commission, council, department, public authority, public
 8 benefit corporation, office or other governmental entity performing a
 9 governmental or proprietary function for the state of New York, except[:
 10 (1)] the judiciary; [and
 11 (2)] but shall include all cities, counties, municipalities, villages,
 12 towns, and other local agencies.
 13 (e) "Cybersecurity incident" shall mean an event occurring on or
 14 conducted through a computer network that actually or imminently jeop-
 15 ardizes the integrity, confidentiality, or availability of computers,
 16 information or communications systems or networks, p