This policy is consistent with the State Technology Law § 208,
as added by Chapters 442 and 491 of the Laws of 2005. This policy
requires notification to affected New York residents and nonresidents.
New York State values the protection of private information of individuals.
The Incorporated Village of East Hills is required to notify an individual
when there has been or is reasonably believed to have been a compromise
of the individual's private information in compliance with the
Information Security Breach and Notification Act and this policy.
For the purpose of this article, the terms used are defined
as follows:
CONSUMER REPORTING AGENCY
Any person who, for monetary fees, dues or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice
of assembling or evaluating consumer credit information or other information
on consumers for the purpose of furnishing consumer reports to third
parties, and which uses any means or facility of interstate commerce
for the purpose of preparing or furnishing consumer reports. The State
Attorney General is responsible for compiling a list of consumer reporting
agencies and furnishing the list upon request to the municipality.
DATA
Any information created, stored (in temporary or permanent
form), filed, produced or reproduced, regardless of the form or media.
"Data" may include, but is not limited to, personally identifying
information, reports, files, folders, memoranda, statements, examinations,
transcripts, images, communications, electronic or hard copy.
INFORMATION
The representation of facts, concepts or instructions in
a formalized manner suitable for communication, interpretation or
processing by human or automated means.
PERSONAL INFORMATION
Any information concerning a natural person which, because
of name, number, personal mark or other identifier, can be used to
identify such natural person.
PRIVATE INFORMATION
A.
Personal information in combination with any one or more of
the following data elements, when either the personal information
or the data element is not encrypted or encrypted with an encryption
key that has also been acquired:
(2)
Driver's license number or nondriver identification card
number; or
(3)
Account number, credit or debit card number, in combination
with any required security code, access code, or password which would
permit access to an individual's financial account.
B.
"Private information" does not include publicly available information
that is lawfully made available to the general public from federal,
state or local government records.
THIRD PARTY
Any nonmunicipal employee, such as a contractor, vendor,
consultant, intern, other municipality, etc.
The municipality, after consulting with the State's Office
of Cyber Security and Critical Infrastructure Coordination (CSCIC)
to determine the scope of the breach and restoration measures, must
notify an individual when it has been determined that there has been
or is reasonably believed to have been a compromise of the individual's
private information through unauthorized disclosure.
A. A compromise of private information means the unauthorized acquisition
of unencrypted computerized data with private information.
B. If encrypted data is compromised along with the corresponding encryption
key, the data is considered unencrypted and thus falls under the notification
requirements.
C. Notification may be delayed if a law enforcement agency determines
that the notification impedes a criminal investigation. In such case,
notification will be delayed only as long as needed to determine that
notification no longer compromises any investigation.
The municipality will notify the affected individual directly
by one of the following methods:
B. Electronic notice, provided that the person to whom notice is required
has expressly consented to receiving notice in electronic form and
a log of each notification is kept by the municipality that notifies
affected persons in such form;
C. Telephone notification, provided that a log of each notification
is kept by the municipality that notifies affected persons; or
D. Substitute notice, if the municipality demonstrates to the State
Attorney General that cost of providing notice would exceed $250,000
or that the affected class of persons to be notified exceeds 500,000,
or the municipality does not have sufficient contact information.
The following constitute sufficient substitute notice:
A. E-mail notice when the municipality has an e-mail address for the
subject persons;
B. Conspicuous posting of the notice on the municipality's website
page, if the municipality maintains one; and
C. Notification to major statewide media.