[HISTORY: Adopted by the Town Board of the
Town of Aurora 11-23-2020 by L.L. No. 2-2020. Amendments noted where
applicable.]
Pursuant to the provisions of § 208 of the State Technology
Law, the Town Board of the Town of Aurora recognizes the requirement
to establish a notification policy for cyber security breach. Section
208(8) defines the requirement to notify an individual when there
has been, or is reasonably believed to have been, a compromise of
that individual's private information, in compliance with this
Code.
As used in this chapter, the following terms have the meanings
indicated:
The unauthorized acquisition of unencrypted computerized
data with private information and encrypted data with private information.
Personal information consisting of any information in combination
with any one or more of the following data elements, when either the
personal information or the data element is not encrypted or encrypted
with an encryption key that has also been acquired:
A.
Social security number;
B.
Driver's license number or non-driver identification card number;
C.
Account number, credit or debit card number, in combination with
any required security code, access code, or password which would permit
access to an individual's financial account;
D.
Account number, or credit or debit card number, if circumstances
exist wherein such number could be used to access an individual's
financial account without additional identifying information, security
code, access code, or password;
E.
Biometric information, meaning data generated by electronic measurements
of an individual's unique physical characteristics, such as fingerprint,
voice print, or retina or iris image, or other unique physical representation
or digital representation which is used to authenticate or ascertain
the individual's identity;
(1)
A username or email address in combination with a password or security
question and answer that would permit access to an online account.
(2)
BREACH OF THE SECURITY OF THE SYSTEM
CONSUMER REPORTING AGENCY
UNENCRYPTED DATA
"Private information" does not include publicly available information
that is lawfully made available to the general public from federal,
state, or local government records.
The unauthorized acquisition or acquisition without valid
authorization of computerized data which compromises the security,
confidentiality, or integrity of personal information maintained by
the Town. Good faith acquisition of personal information by an employee
or agent of the Town for the purposes of the Town is not a breach
of the security of the system, provided that the private information
is not used or subject to unauthorized disclosure.
Any person which, for monetary fees, dues, or on a cooperative
nonprofit basis, regularly engages, in whole or in part, in the practice
of assembling or evaluating consumer credit information or other information
on consumers for the purpose of furnishing consumer reports to third
parties, and which uses any means or facility of interstate commerce
for the purpose of preparing or furnishing consumer reports.
If encrypted data is compromised along with the corresponding
encryption key, the data shall be considered unencrypted and thus
fall under the notification requirements.
A.
If the Town owns or licenses computerized data that includes private
information, it shall disclose any breach of the security of the system
following discovery or notification of the breach in the security
of the system to any resident of the State of New York whose private
information was, or is reasonably believed to have been, acquired
by a person without valid authorization. The disclosure shall be made
in the most expedient time possible to the Town Supervisor and without
unreasonable delay, consistent with the legitimate needs of law enforcement,
or any measures necessary to determine the scope of the breach and
restore the reasonable integrity of the data system.
B.
If the employees of Town suspect a breach of the security of the
system has occurred, it shall consult with the New York State Office
of Cyber Security and Critical Infrastructure Coordination (CSIC)
or other agency to determine the scope of the breach and restoration
measures. The involved individual shall be notified when it has been
determined that there has been, or reasonably believed to have been,
a compromise of private information or unauthorized disclosure.
C.
In determining whether information has been acquired, or is reasonably
believed to have been acquired, by an unauthorized person or a person
without valid authorization, the Town may consider the following factors,
among others:
(1)
Indications that the information is in the physical possession and
control of an unauthorized person, such as a lost or stolen computer
or other device containing information; or
(2)
Indications that the information has been downloaded or copied; or
(3)
Indications that security measures, such as firewalls, have been
breached; or
(4)
Indications that the information was used by an unauthorized person,
such as fraudulent accounts opened or instances of identity theft
reported.
D.
The Town shall notify all individuals whose private information was
acquired, or reasonably believed to have been acquired during the
breach of the security of the system. Such notification shall be by
one of the following methods:
(1)
Written notice;
(2)
Electronic notice, provided that the person to whom notice is required
has expressly consented to receiving said notice in electronic form
and a log of each such notification is kept by the Town who notifies
affected persons in such form;
(3)
Telephone notification, provided that a log of each such notification
is kept by the Town which notifies affected persons; or
(4)
Substitute notice, if the Town demonstrates to the State Attorney
General that the cost of providing notice would exceed $250,000, or
that the affected class of subject persons to be notified exceeds
5,000, or the Town does not have sufficient contact information, substitute
notice shall consist of all of the following:
(a)
Email notice when the Town has an email address for the subject
persons;
(b)
Conspicuous posting of the notice on the Town's website
page; and
(c)
Notification to major statewide media and the East Aurora Advertiser
or other local newspaper.
(d)
Preference will be given to the fastest method to provide notification
to the recipient among those listed above.
(e)
Notification may be delayed if a law enforcement agency determines
that the notification impedes a criminal investigation. In such case,
notification will be delayed only as long as needed to determine that
notification no longer compromises any investigation.
E.
The Town shall immediately notify the Town Clerk of the breach of
the security of the system, who shall within 24 hours notify the insurer
covering cybersecurity liability.
F.
The Town shall promptly notify the New York State Attorney General,
the New York State Consumer Protection Board, and the New York State
Office of Cyber Security and Critical Infrastructure Coordination
(CSIC) or other agency responsible for the cybersecurity of municipalities
as to the timing, content, and distribution of the notices and approximate
number of persons affected.
G.
If the breach of the security of the system has affected more than
5,000 persons, the Town shall notify consumer reporting agencies as
to the timing, content, and distribution of the notices and the approximate
number of affected individuals.
H.
Notification may be delayed if a law enforcement agency determines
that the notification impedes a criminal investigation. In such case,
notification will be delayed only as long as needed to determine that
notification no longer compromises any investigation.
I.
Regardless of the method by which notice of a breach of the security
of the system is provided, such notice shall include contact information
for the Town making the notification and a description of the categories
of information that were, or are reasonably believed to have been,
acquired by a person without valid authorization, including specification
of which of the elements of personal information and private information
were, or are, reasonably believed to have been so acquired.
In addition to any penalties contained in any other provision
of law, any person who shall knowingly and intentionally violate any
of the provisions of this Code may be fined, suspended or removed
from office or employment, as the case may be, in the manner provided
by law.
This chapter shall take effect immediately upon filing with
the New York Secretary of State.
