New York breach notification law goes into effect

New York has joined the growing list of U.S. states requiring that companies notify their customers whenever private information has been compromised. On Wednesday, the state's (http://assembly.state.ny.us/leg/?bn=A04254) Information Security Breach

and Notification Act went into effect, according to a spokeswoman for the state's attorney general, Eliot Spitzer.

The law, which is similar to California's SB-1386 notification law, requires businesses and state agencies to inform New York residents "whose unencrpyted personal information may have been acquired by an unauthorized person," according to the text of the legislation.

New York's Notification Act is one of a growing number of legislative and regulatory efforts that are forcing executives to pay more attention to security, said Dan Aiken, the compliance director with New York's Hospital for Special Surgery "Now, like in California, if your information is compromised, or if you have reason to believe it may have been compromised, you have to report it," he said, speaking at the Infosecurity conference in New York Wednesday. "There's a real risk to brand name, to your public reputation."

According to a recent survey of security breach victims in the U.S., 20 percent of respondents said they had terminated their relationship with the company in charge of the data. Another 40 percent said they would consider doing so, according to the study, which was conducted this year by Ponemon Institute LLC, a privacy think tank in Tucson, Arizona.

Since California's notification law was passed, it has brought dozens of information security breaches to light (http://www.privacyrights.org/ar/ChronDataBreaches.htm) and put computer security and privacy in the public spotlight. The first company to disclose a security breach under the California law, information vendor ChoicePoint Inc., recently took a US$6 million charge for legal expenses and fees related to the theft of personal information belonging to 145,000 consumers that had been stored in its database.

The California law has had a far-reaching effect, said Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit advocacy organization. "Ever since the ChoicePoint breach happened... companies have essentially taken the California law and adopted it as a best practice," she said.

Ponemon estimates that just over 30 percent of U.S. companies have now adopted such a policy.

While it is unclear how much of an effect the New York law will have, given the level of disclosure already required by the 20 other states, Givens believes that it will be good for consumers.

The law will also put pressure on the federal government to adopt similar notification legislation, Givens said. Observers expect some form of federal legislation to be passed next year.

One security vendor agreed that the New York law was important.

"New York is one of the most populous states in the country," said Marv Goldschmitt, vice president of business development with Tizor Systems, a vendor of data monitoring appliances. "It matters significantly. Eliot Spitzer is a loud voice of consumer and public consciousness, so it's clearly a statement that will be heard."