[HISTORY: Adopted by the Common Council of
the City of Ithaca 4-5-2006 by Ord. No. 2006-9. Amendments noted where
applicable.]
GENERAL REFERENCES
Public access to records — See Ch. 256.
This chapter shall be known and may be cited
as the "Cyber Security Citizens' Notification Policy."
The policy set forth in this Chapter is intended
to be consistent with the State Technology Law, § 208, as
added by Chapters 442 and 491 of the Laws of 2005. This policy requires
notification to affected New York residents and nonresidents. The
City of Ithaca and New York State value the protection of private
information of individuals. The City of Ithaca is required to notify
an individual when there has been or is reasonably believed to have
been a compromise of the individual's private information, in compliance
with the applicable provisions of the State Technology Law and this
policy.
As used in this chapter, the following terms
shall have the meanings indicated:
The unauthorized acquisition of unencrypted computerized
data containing private information from records maintained by the
City of Ithaca.
Any person or entity which, for monetary fees, dues, or on
a cooperative nonprofit basis, regularly engages in whole or in part
in the practice of assembling or evaluating consumer credit information
or other information on consumers for the purpose of furnishing consumer
reports to third parties, and which uses any means or facility of
interstate commerce for the purpose of preparing or furnishing consumer
reports. (The State Attorney General is responsible for compiling
a list of consumer reporting agencies and furnishing the list upon
request to the City of Ithaca.)
Any information created, stored (in temporary or permanent
form), filed, produced or reproduced, regardless of the form or media.
Data may include, but is not limited to personally identifying information,
reports, files, folders, memoranda, statements, examinations, transcripts,
images, communications, and electronic or hard copy.
The representation of facts, concepts, or instructions in
a formalized manner suitable for communication, interpretation, or
processing by human or automated means.
Any information concerning a natural person which, because
of name, number, personal mark or other identifier, can be used to
identify such natural person.
Personal information in combination with any
one or more of the following data elements, when either the personal
information or the data element is not encrypted or encrypted with
an encryption key that has also been acquired:
Private information does not include publicly
available information that is lawfully made available to the general
public from federal, state, or local government records.
Any nonmunicipal employee such as a contractor, vendor, consultant,
intern, other municipality, etc.
A.
The City of Ithaca, after consulting with the State's
Office of Cyber Security and Critical Infrastructure Coordination
(hereinafter "CSCIC") to determine the scope of the breach and restoration
measures, shall notify an individual, as quickly as is practicable,
when it has been determined that there has been, or is reasonably
believed to have been, a compromise of that individual's private information
through unauthorized disclosure.
B.
If encrypted data is compromised along with the corresponding
encryption key, the data is considered unencrypted and thus falls
under the aforementioned notification requirements.
C.
The notification required hereunder may be delayed
if a law enforcement agency determines that the notification impedes
a criminal investigation. In such case, notification will be delayed
only as long as needed until it has been determined that such notification
no longer compromises any such investigation.
D.
The City of Ithaca shall notify the affected individual(s)
by one of the following methods:
(1)
Written notice delivered to the individual or mailed
or delivered to the individual's address of record;
(2)
Electronic notice, provided that the person to whom
notice is required has expressly consented to receiving notice in
electronic form and a log of each such notification is kept by the
City of Ithaca, in such form;
(3)
Telephone notification, provided that a log of each
such notification is kept by the City of Ithaca; or
(4)
Substitute notice, if the City of Ithaca demonstrates
to the State Attorney General that the cost of providing notice would
exceed $250,000, or that the affected class of persons to be notified
exceeds 500,000, or that the City of Ithaca does not have sufficient
contact information for the affected person(s). The following, together,
constitute sufficient substitute notice:
E.
The City of Ithaca shall notify the CSCIC as to the
timing, content and distribution of the notices and approximate number
of affected persons.
F.
The City of Ithaca shall notify the State Attorney
General and the State Consumer Protection Board, whenever notification
to a New York resident is necessary, as to the timing, content and
distribution of the notices and approximate number of affected persons.
G.
Regardless of the method by which notice is provided,
the notice must include contact information for the City of Ithaca
and a description of the categories of information that were, or are
reasonably believed to have been, acquired by a person without valid
authorization, including specification of which of the elements of
personal information and private information were, or are reasonably
believed to have been, so acquired.
H.
This policy also applies to information maintained
on behalf of the City of Ithaca by a third party.
I.
When more than 5,000 New York residents must be notified
at one time, then in that case the City of Ithaca shall notify the
consumer reporting agencies as to the timing, content and distribution
of the notices and the approximate number of affected individuals.
This notice shall be made without delaying notice to the affected
individual(s).
[Amended 11-3-2021 by Ord. No. 2021-09]
The City Manager shall ensure that a written,
city-wide protocol is established, which protocol shall stipulate
how the notification requirements in this policy are to be implemented.
