N.Y. State Technology Law § 209 – Notification of data breach or network security breach; shared data

1. The office shall, within twenty-four hours following the discovery of a data breach or network security breach or receiving notice of a data breach or network security breach, notify the chief information officer, and where appropriate, the chief information security officer, of any state entity with which it shares data, provides networked services or shares a network connection whose data, services or connection is or may have been the subject of such breach whether or not such data was, or is reasonably believed to have been, acquired or used by an unauthorized person.
2. The office shall, in addition to the provisions of subdivision one of this section, notify the chief information officer, and where appropriate, the chief information security officer, of such state entity with which it shares data, provides networked services or shares a network connection and whose data is or may have been the subject of such breach, of its plan for remediation of the breach and future protection of such data and network.
3. For purposes of this section:
1. (a) "Data breach" shall mean an intentional or unintentional incident where data is disclosed, released, stolen, or taken without the knowledge or authorization of the data's owner or steward.
2. (b) "Network security breach" shall mean an intentional or unintentional incident where an unauthorized party has gained access to an organization's network without the knowledge or authorization of the network owner or steward.
3. (c) "State entity" shall mean any state board, bureau, division, committee, commission, council, department, public authority, public benefit corporation, office or other governmental entity performing a governmental or proprietary function for the state of New York, including the state legislature and the judiciary.