This chapter is consistent with the State Technology Law § 208,
as added by Chapters 442 and 491 of the Laws of 2005. This chapter
requires notification to affected New York residents and nonresidents.
New York State values the protection of private information of individuals.
The Village of Bloomfield is required to notify an individual when
there has been, or is reasonably believed to have been, a compromise
of the individual's private information, in compliance with the Information
Security Breach and Notification Policy.
The Village of Bloomfield, after consulting with the state's
Office of Cyber Security and Critical Infrastructure Coordination
(CSCIC) to determine the scope of the breach and restoration measures,
must notify an individual when it has been determined that there has
been, or is reasonably believed to have been, a compromise of the
individual's private information through unauthorized disclosure.
As used in this chapter, the following terms shall have the
meanings indicated:
CONSUMER REPORTING AGENCY
Any person which, for monetary fees, dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice
of assembling or evaluating consumer credit information or other information
on consumers for the purpose of furnishing consumer reports to third
parties and which uses any means or facility of interstate commerce
for the purpose of preparing or furnishing consumer reports. The State
Attorney General is responsible for compiling a list of consumer reporting
agencies and furnishing the list upon request to the municipality.
DATA
Any information created, stored (in temporary or permanent
form), filed, produced or reproduced, regardless of the form or media.
Data may include, but is not limited to, personally identifying information,
reports, files, folders, memoranda, statements, examinations, transcripts,
images, communications, electronic or hard copy.
INFORMATION
The representation of facts, concepts, or instructions in
a formalized manner suitable for communication, interpretation, or
processing by human or automated means.
PERSONAL INFORMATION
Any information concerning a natural person which, because
of name, number, personal mark or other identifier, can be used to
identify such natural person.
PRIVATE INFORMATION
A.
Personal information in combination with any one or more of
the following data elements, when either the personal information
or the data element is not encrypted or encrypted with an encryption
key that has also been acquired:
(1)
Social security number; or driver's license number or nondriver
identification card number; or
(2)
Account number, credit or debit card number, in combination
with any required security code, access code, or password which would
permit access to an individual's financial account.
B.
"Private information" does not include publicly available information
that is lawfully made available to the general public from federal,
state, or local government records.
THIRD PARTY
Any nonmunicipal employee such as a contractor, vendor, consultant,
intern, other municipality, etc.