[HISTORY: Adopted by the Town Board of the
Town of Horseheads 11-25-2020 by L.L. No. 4-2020. Amendments noted where
applicable.]
The Town of Horseheads Board of Trustees finds that identity
theft and security breaches are affecting local residents and others.
The New York State Legislature and Governor enacted legislation mandating
the establishment of a breach notification procedure to prevent injury
to residents and afford an opportunity for repair of damages resultant
from a breach.
As used in this chapter, the following terms shall have the
meanings indicated:
Shall have the same meanings as provided in State Technology
Law Section 208, as amended from time to time, excepting that where
the word "State" is used, it shall be interchanged with the word "Town"
as the context of this chapter will require.
The Town of Horseheads, NY.
Any Town board, bureau, division, committee, commission,
council, department, public authority, public benefit corporation,
office or other governmental entity performing a governmental or proprietary
function for the Town of Horseheads except the judiciary.
A.
Any Town entity that owns or licenses computerized data that includes private information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the system to any resident of New York State whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in § 149-5 of this chapter, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
B.
The Town entity shall consult with the State Office of Cyber Security
and Critical Information Coordination to determine the scope of the
breach and restoration measures.
C.
Notice to affected persons under this section is not required if
the exposure of private information was an inadvertent disclosure
by persons authorized to access private information, and the Town
entity reasonably determines such exposure will not likely result
in misuse of such information, or financial or emotional harm, to
the affected persons. Such a determination must be documented in writing
and maintained for at least five years. If the incidents affected
over 500 residents of New York, the Town shall provide the written
determination to the New York State Attorney General within 10 days
after the determination.
D.
If notice of the breach of the security of the system is made to affected persons pursuant to the breach notification requirements under any of the following laws, nothing in this section shall require any additional notice to those affected persons, but notice shall be provided to the New York State Attorney General, the Department of State and the Office of Information Technology Services pursuant to § 149-8 hereof and to consumer reporting agencies pursuant to § 149-8 hereof.
(1)
Regulations promulgated pursuant to Title V of the federal Gramm-Leach
Bliley Act (15 U.S.C. 6801 to 6809), as amended from time to time;
(2)
Regulations implementing the Health Insurance Portability and Accountability
Act of 1996 (45 CFR Parts 160 and 164), as amended from time to time,
and the Health Information Technology for Economic and Clinical Health
Act, as amended from time to time;
(3)
Part 500 of Title 23 of the official compilation of Codes, Rules
and Regulations of the State of New York, as amended from time to
time;
(4)
Any other data security rules and regulations of, and the statutes
administered by, any official department, division, commission or
agency of the federal or New York State government as such rules,
regulations or statutes are interpreted by such department, division,
commission or agency or by the federal or New York State courts.
Any Town entity that maintains computerized data that includes
private information which such entity does not own shall notify the
owner or licensee of the information of any breach of the security
of the system immediately following discovery, if the private information
was, or is reasonably believed to have been, acquired by a person
without valid authorization.
The notification required by this chapter may be delayed if
a law enforcement agency determines that such notification impedes
a criminal investigation. The notification required by this chapter
shall be made after such law enforcement agency determines that such
notification does not compromise such investigation.
The notice required by this chapter shall be directly provided
to the affected persons by one of the following methods:
A.
Written notice;
B.
Electronic notice, provided that the person to whom notice is required
has expressly consented to receiving said notice in electronic form
and a log of each such notification is kept by the Town entity who
notifies affected persons in such form; provided further, however,
that in no case shall any person or business require a person to consent
to accepting said notice in said form as a condition of establishing
any business relationship or engaging in any transaction;
C.
Telephone notification, provided that a log of each telephone notification
is kept by the Town entity which notifies the affected parties; or
D.
Substitute notice, if a Town entity demonstrates to the New York
State Attorney General that the cost of providing notice would exceed
$250,000, or that the affected class of subject persons to be notified
exceeds $500,000, or such entity does not have sufficient contact
information, substitute notice shall consist of all of the following:
Regardless of the method by which notice is provided, such notice
shall include contact information for the person or business making
the notification and a description of the categories of information
that were, or are reasonably believed to have been, accessed or acquired
by a person without valid authorization, including specification of
which of the elements of personal information and private information
were, or are reasonably believed to have been, so acquired.
A.
In the event that any New York residents are to be notified at one
time, the Town entity shall notify the New York State Attorney General,
the Consumer Protection Board, and the State Office of Cyber Security
and Critical Infrastructure Coordination as to the timing, content
and distribution of the notices and approximate number of affected
persons and provide a copy of the template of the notice sent to affected
persons. Such notice shall be made without delaying notice to affected
New York residents.
B.
In the event that more than 5,000 New York residents are to be notified
at one time, the person or business shall also notify consumer reporting
agencies as to the timing, content and distribution of the notices
and approximate number of affected persons. Such notice shall be made
without delaying notice to affected New York residents.
Any Town entity required to provide notification of a breach
of information that is not "private information" as defined herein,
to the Secretary of Health and Human Services pursuant to the Health
Insurance Portability and Accountability Act of 1996 or the Health
Information Technology for Economic and Clinical Health Act, as amended
from time to time, shall provide such notification to the New York
State Attorney General within five business days of notifying the
Secretary.
Any local law, ordinance, or resolution of the Town in conflict
herewith is hereby repealed to the extent of such conflict or inconsistency,
except that this chapter shall not affect or prevent the prosecution
or punishment of any person for any act done or committed in violation
of any local law, ordinance, regulation or resolution hereby repealed
prior to the effective date of this chapter. In particular, but not
by way of limitation, this chapter supersedes and repeals Chapter
56 of the Town Code as adopted by the Town Board in May of 2012 as
Local Law No. 4 of 2012.
In the event any clause, sentence, section or other part of
this chapter shall be declared to be invalid, such invalidity shall
not affect the remainder of this chapter.
