Technology

signed · New York · Senate Jun 26, 2025

S 7672: Relates to municipal cybersecurity incidents or ransomware attacks

Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.

Topics ✓ TechnologySupports TechnologyBill mandates cybersecurity standards, incident reporting, and data protection for municipal systems, strengthening cybersecurity and data privacy protections.95% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

passed · New York · Assembly May 19, 2025

A 6769: Relates to municipal cybersecurity incidents or ransomware attacks

Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.

Topics ✓ TechnologySupports TechnologyBill mandates cybersecurity reporting, incident reviews, training, and data protection standards for municipal systems, directly strengthening cybersecurity protections per topic indicators.95% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

Track

signed · New York · Assembly Feb 14, 2025

A 428: Relates to online dating services

This bill (A 428) protects New York users of paid online dating services by setting clear consumer safeguards. It limits subscription contracts to $1,000 total (with exceptions for short-term plans), bans requiring forced add-on services (like grooming), and guarantees a minimum number of matches per month for paid plans over $25. Users gain the right to cancel without penalty if matches aren't delivered for two months, receive a refund (minus a small fee), and get their personal data deleted or returned upon cancellation. The law directly affects all paid online dating platforms operating in New York, ensuring transparency and reducing deceptive practices.

Topics ✓ TechnologySupports TechnologyMandates data deletion for users, directly protecting privacy in online services per bill's consumer safeguards.90% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

signed · New York · Assembly Feb 14, 2025

A 920: Adds medical and health insurance information within the definitions of personal identifying information; repealer

This bill amends New York's penal law and related statutes to explicitly include "medical information" and "health insurance information" in the legal definition of "personal identifying information." It defines medical information as details about an individual's medical history or treatment, and health insurance information as policy numbers, subscriber IDs, or claims history. These changes mean that identity theft involving such sensitive health data will now be covered under existing identity theft laws, which previously did not explicitly include these categories. The bill also removes outdated definitions from related laws to streamline the updated framework.

Topics ✓ HealthcareSupports HealthcareExpands legal protection for sensitive health data under identity theft laws, directly strengthening patient privacy rights in healthcare context.95% confidence ✓ TechnologySupports TechnologyExpands definition of personal identifying information to include medical/health data, strengthening privacy protections under penal law.95% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

signed · New York · Assembly Feb 14, 2025

A 426: Relates to procurement requirements for end point device security

Directs that state agencies require that procurement of end point devices be consistent with any relevant standards, guidelines, or guidance developed as part of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Topics ✓ TechnologySupports TechnologyMandates state agencies adopt NIST cybersecurity standards for device procurement, directly enhancing security protocols per topic description.95% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

signed · New York · Senate Feb 14, 2025

S 822: Relates to the disclosure of automated employment decision-making tools and maintaining an artificial intelligence inventory

Relates to the disclosure of automated employment decision-making tools; requires the office of information technology services to maintain an artificial intelligence inventory; provides that the use of artificial intelligence systems shall not affect the existing rights of employees pursuant to an existing collective bargaining agreement, or the existing representational relationships among employee organizations or the bargaining relationships between the employer and an employee organization.

Topics ✓ Labor & EmploymentSupports Labor & EmploymentPrevents AI systems from overriding existing collective bargaining rights and representational relationships, directly protecting workers' rights under current agreements.95% confidence ✓ TechnologySupports TechnologyRequires disclosure of AI employment tools and protects employee rights, aligning with data privacy regulation and consumer protection indicators.85% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology

signed · New York · Senate Feb 14, 2025

S 804: Relates to when and how notification of a data breach is to be provided to the department of financial services

S 804 amends New York's data breach notification law to clarify when and how financial institutions must notify the Department of Financial Services (DFS) after a breach affecting New York residents. It requires covered financial institutions (as defined by current DFS rules) to provide DFS with details about the breach - including timing, content, and number of affected people - without delaying direct notifications to consumers. The bill specifies that this notification to DFS is only mandatory for financial institutions, not all businesses, and must follow existing DFS reporting rules (23 NYCRR 500.17). The law, signed as Chapter 91 on February 14, 2025, streamlines reporting for regulated financial entities while maintaining direct consumer notification timelines.

Topics ✓ TechnologySupports TechnologyClarifies data breach notification requirements to enhance consumer data privacy protections by mandating timely reporting to DFS without delaying consumer notifications.95% confidence | Rep's Stance ✓ Voted Yes ✓ Supports Technology