New York Senate Bill S03078

New York 2025-2026 Regular Session

• Introduced: 1/23/25
• Refer: 1/23/25
• Refer: 1/7/26
• Engrossed: 3/10/26
• Refer: 3/10/26

Caption

Provides that if the person or business providing the notification was the source of the breach, an offer to provide appropriate identity theft prevention and mitigation services, shall be provided at no cost to the affected person for not less than 12 months, along with all information necessary to take advantage of the offer to any person whose information was or may have been breached if the breach exposed or may have exposed personal information.

Summary

Bill S03078 amends the general business law to enhance consumer protections in the event of a data breach. Specifically, it mandates that if a business or individual is responsible for a data breach, they must offer identity theft prevention and mitigation services at no cost to the affected individuals for a minimum of twelve months. Additionally, the bill requires that notifications regarding breaches include detailed contact information, relevant agency resources, and a description of the types of personal information that may have been compromised.

Impact

This bill strengthens existing consumer protection laws in New York by ensuring that individuals whose personal information is compromised in a data breach receive timely support and resources. It modifies the notification requirements for businesses, potentially increasing accountability and transparency in how breaches are communicated to affected parties. The bill's provisions may lead to increased operational costs for businesses due to the requirement of providing free identity theft services.

Sentiment

The sentiment around Bill S03078 appears to be largely positive, as evidenced by the unanimous support in the Senate Consumer Protection Committee and a strong majority in the final Senate floor vote. The discussions suggest a recognition of the importance of protecting consumer data and providing necessary support in the wake of breaches.

Contention

While there seems to be broad support for the bill, potential points of contention may arise regarding the financial implications for businesses required to offer free identity theft services. Some stakeholders may argue that the costs associated with compliance could be burdensome, particularly for smaller businesses. However, specific dissenting opinions were not noted in the available discussions or voting records.