1. State Coverage Depends on the Information and Unauthorized Conduct
General Business Law (GBL) § 899-aa covers breaches of computerized private information about state residents. It can apply even when the business holding that information operates elsewhere.
Private Information Has a Specific Statutory Meaning
The law distinguishes identifying details, called "personal information," from "private information" that triggers notification. The latter includes identifying information paired with Social Security numbers, driver's license numbers, qualifying financial account details, biometrics, or medical or health insurance information. Online credentials that permit account access can also qualify.
Encryption does not exempt data when an unauthorized person also obtains the key. Businesses reviewing broader privacy and data protection duties should identify which records satisfy this statutory definition.
Unauthorized Access Can Trigger Notice without Proven Theft
Section 899-aa covers unauthorized access as well as acquisition. Access logs or evidence that someone viewed or altered records can matter without a confirmed download. Copying, possession, or fraudulent use can indicate acquisition.
Good-faith employee access for business purposes is excluded if the information is neither misused nor disclosed without authorization. Investigators should document what the person accessed and why.
The SHIELD Act Adds Preventive Security Duties
GBL § 899-bb separately requires reasonable administrative, technical, and physical safeguards, including employee training, vendor oversight, monitoring, and secure disposal. Qualifying small businesses may use proportionate safeguards.
Compliance with specified regulatory security requirements can satisfy § 899-bb, but does not automatically remove breach notification duties. A data privacy compliance program should address both.
2. Notification Duties Depend on the Recipient and Deadline
One incident may require notices to residents, owners, regulators, and consumer reporting agencies. Each recipient can have a different legal trigger and deadline.
Owners and Service Providers Have Different Responsibilities
Under § 899-aa(2), owners and licensees must notify affected residents without unreasonable delay and generally within 30 days after discovery. The duty includes reasonably suspected unauthorized access or acquisition.
Service providers maintaining another entity's covered information must notify the owner or licensee immediately, and no later than 30 days after discovery. That notice does not replace resident notification.
Regulators and Credit Reporting Agencies May Also Need Notice
When residents require notice, § 899-aa(8) also requires reports to the Attorney General, Department of State, and Division of State Police. NYDFS-covered entities have additional reporting duties. More than 5,000 simultaneous resident notices also trigger reporting to consumer reporting agencies.
Resident notices must identify the business, describe affected information categories, and provide required government resources. Written, consent-based electronic, telephone, and substitute notices have different conditions. Agency filings must not delay resident notices.
Exceptions Require Evidence and Written Records
A law enforcement agency may authorize delay when disclosure would impede a criminal investigation. Notification resumes when the agency determines disclosure no longer compromises it.
An exception covers certain inadvertent disclosures by authorized people when specified harms are unlikely. Businesses must document that determination and retain it for at least five years. If more than 500 residents are affected, they must submit it to the Attorney General within 10 days. An undocumented assumption that the incident caused no harm does not satisfy this exception.
3. Industry Rules Can Add Federal and NYDFS Reporting Duties
Industry-specific rules can impose separate deadlines. Healthcare and financial businesses should check the regulated entity, incident threshold, recipient, and date starting each reporting clock.
NYDFS Has a Separate 72-Hour Incident Standard
Under 23 NYCRR § 500.17(a), covered financial entities must report qualifying cybersecurity incidents to NYDFS promptly, no later than 72 hours after determining an incident occurred. Triggers include certain regulatory notices, material operational threats, and ransomware deployments.
This is not a universal 72-hour deadline. Qualifying incidents at affiliates or service providers can also trigger reporting for covered entities.
HIPAA and FTC Rules Use Different Tests
HIPAA generally requires covered entities to notify individuals of breaches of unsecured protected health information without unreasonable delay, within 60 days. HHS reports for breaches affecting 500 or more individuals are generally due within 60 days; smaller breaches may be reported within 60 days after the calendar year ends. Business associates notify covered entities.
The FTC Safeguards Rule, 16 C.F.R. § 314.4(j), requires covered financial institutions to report qualifying events involving at least 500 consumers' unencrypted information within 30 days after discovery. Unlike financial regulation, HIPAA regulatory affairs concern healthcare information.
Federal Notices Do Not Necessarily Replace State Reports
Section 899-aa(2)(b) recognizes qualifying individual notices under specified regulatory schemes, but state agency and consumer reporting agency filings may remain due. Section 899-aa(9) additionally requires certain HIPAA-regulated entities to notify the Attorney General within five business days after notifying HHS, even for some information outside the state definition.
A breach notice alone does not prove wrongdoing or create a damages claim. The Attorney General may investigate violations; private data breach disputes require separate legal grounds. Section 899-bb does not independently create a private right of action.
4. Regulatory Enforcement and Individual Claims Follow Different Standards
Failure to comply with breach notification or data security requirements can result in government enforcement. However, regulatory violations and private lawsuits involve different legal standards, and a reported breach does not automatically establish liability.
The Attorney General May Seek Statutory Remedies
Under GBL § 899-aa(6), the Attorney General may seek injunctive relief for notification violations. Courts may also award actual losses to affected individuals and impose civil penalties for knowing or reckless violations.
GBL § 899-bb separately authorizes enforcement of reasonable security requirements through applicable consumer protection provisions. Investigations may examine notification records, security safeguards, and how an organization responded after discovering unauthorized access.
Individual Claims Require Independent Legal Grounds
Receiving a breach notification does not automatically entitle an individual to compensation. Section 899-bb expressly does not create a private right of action.
Affected individuals may have claims under other applicable laws, depending on the company's conduct, the information involved, and the harm suffered. These questions require separate analysis beyond statutory notification compliance.
16 Oct, 2026
