New York breach law goes live

New York has joined the growing list of U.S. states requiring that companies notify their customers whenever private information has been compromised. On Wednesday, the state's Information Security Breach and Notification Act went into effect. The law, which is similar to California's SB-1386 notification law, requires businesses and state agencies to inform New York residents "whose unencrpyted personal information may have been acquired by an unauthorized person."

New York's Notification Act is one of a growing number of legislative and regulatory efforts that are forcing executives to pay more attention to security. Now, like in California, if your information is compromised, or if you have reason to believe it may have been compromised, you have to report it. There's a real risk to brand name and to your public reputation.

According to a recent survey of security breach victims in the U.S., 20 percent of respondents said they had terminated their relationship with the company in charge of the data. Another 40 percent said they would consider doing so, according to the study, which was conducted this year by Ponemon Institute LLC.

Since California's notification law was passed, it has brought dozens of information security breaches to light and put computer security and privacy in the public spotlight. The first company to disclose a security breach under the California law, information vendor ChoicePoint Inc., recently took a US$6 million charge for legal expenses and fees related to the theft of personal information belonging to 145,000 consumers that had been stored in its database.

CATEGORIES: 1first, 1legal, 1privacy, 1id theft, 1compliance