On the heels of a number of well-publicized data security breaches, a White House data breach proposal, and California’s recent changes to its data breach notification statute, New York Attorney General Eric Schneiderman has announced that he will propose legislation to strengthen New York’s data breach notification law.   The legislation had not been made public as of the date of publication, but the Attorney General has stated publicly that he anticipates it will include the following elements:

• “Private Information” Definition.  The legislation would expand the definition of “private information” that, if breached, requires notice to New York residents.  According to the Attorney General, “private information” should be defined to “include both the combination of an email address and password and an email address in combination with a security question and answer,” as well as “medical information, including biometric information, and health insurance information.”  It is worth noting that the White House proposal unveiled earlier this week also would cover these data elements, and there are some existing state laws that already cover these data elements.  For example, California’s recent amendments to its data breach statute require notice of certain breaches involving “[a] user name or email address, in combination with a password or security question that would permit access to an online account.”  In addition, several states, including California and Texas, have breach notification statutes that cover certain types of medical information.

• “Reasonable” Data Security Requirement.  Consistent with the approach that a number of other states (including, most recently, California) have taken, the legislation would impose an affirmative obligation on companies to reasonably safeguard “private information,” including through appropriate administrative, technical, and physical safeguards.  Massachusetts and Nevada are among the states that have imposed more prescriptive data security obligations.

• Safe Harbor.  Schneiderman’s press release provides that “New York should offer a safe harbor if a company adopts a heightened form of security. . . . Once [an entity implements a data security plan that meets the standard], an entity would be required to attain a certification and, upon doing so, would be granted the benefit of a safe harbor that could include an elimination of liability altogether.”   It is not clear based on the Attorney General’s press release, but we presume that this safe harbor would pertain to the obligation to maintain reasonable data security safeguards and not from other obligations.  In addition, Schneiderman’s proposal would legislate that entities that obtain independent third-party audits and certifications annually showing compliance with New York’s reasonable data security requirements should receive for use in litigation a rebuttable presumption of having reasonable data security.

• Sharing of Forensic Reports.  Finally, the Attorney General contemplates that New York should incentivize companies to share forensic reports with law enforcement officials by legislating that such disclosure does not “affect any privilege or [other] protection.”  As we described in a separate post earlier this week, President Obama has announced his own proposal to encourage sharing of cyber threat information between the public and private sector.

The New York Attorney General cannot introduce a bill on his own, but news outlets have reported that Schneiderman anticipates attracting both Democratic and Republican sponsors for the legislation.