data security inquiries to Experian and TransUnion<\/a>, the two other major credit reporting agencies.<\/p>\nBureau of Internet and Technology\u00a0Deputy Bureau Chief\u00a0Clark Russell\u00a0gave the following testimony:<\/p>\n
Good morning Chair Carlucci, Ranking Member Comrie and distinguished members of the Senate Consumer Protection Committee. My name is Clark Russell and I am the Deputy Bureau Chief of the Bureau of Internet and Technology at the New York State Attorney General\u2019s office. The Bureau of Internet and Technology is responsible for protecting consumers and families from existing as well as new and developing online threats. Thank you for the opportunity to provide testimony regarding the challenges we are facing protecting consumers from identity theft.\u00a0<\/i><\/p>\n
The Equifax data breach is an unprecedented event. More than 140 million Americans, which is more than half of the adults in this country, including over 8 million New Yorkers, had their most sensitive personal information stolen, placing them all at risk of identity theft and hindering their ability to buy a home, start a business, or get a job. Although I cannot discuss any details today, our office has opened an investigation into exactly what happened. And from the moment we learned of the breach, we have been pressing Equifax on a number of issues \u2013 including a delay in notifying consumers of the breach; a forced arbitration clause in their free credit monitoring contracts that they have since removed and their failure to provide Spanish-language customer service to consumers affected by the breach. Following conversations with our office, Equifax has addressed all of those issues and has just agreed to provide consumers the ability to lock and unlock their credit file for life. We have also raised data security questions with the two other major credit bureaus: TransUnion and Experian. We will use all of the tools at our disposal to get to the bottom of the Equifax breach, and ensure that all three credit bureaus take effective steps to protect the sensitive information they possess.\u00a0<\/i><\/p>\n
While the Equifax breach is unique in the scale and severity of the information theft, in many ways it is merely an escalation of a disturbing trend that the Attorney General\u2019s Bureau of Internet and Technology has observed over the past several years. Under General Business Law \u00a7 899-aa, companies are required to notify consumers and our office of a data breach. As we addressed in a report issued earlier this year, in 2016 the office received 1,300 data breach notices \u2013 up 60% from the year before. The main causes of data breaches are hacking, which accounted for 40% of reported data security breaches in 2016, and employee negligence, which accounted for 37% of reported breaches. In recent years, we have received data breach notifications from Home Depot, reporting 56 million credit card numbers disclosed; Target, reporting 40 million credit card numbers disclosed; and Anthem, reporting over 78 million records disclosed including social security numbers.<\/i><\/p>\n
Unfortunately, when a breach occurs, consumers often have limited options. Credit monitoring helps consumers identify suspicious transactions, but it only alerts the consumer after someone has already stolen her identity. Credit freezes stop wrongdoers from opening a line of credit in a consumer\u2019s name, but a thief can still file for government benefits in the consumer\u2019s name or file a fraudulent tax return.<\/i><\/p>\n
We all need to do more. Businesses should only collect the information they need to conduct their business, and securely delete and destroy it when it is no longer needed.\u00a0 They should design and implement an information security plan. They should designate a person responsible for the plan and educate and train their employees.\u00a0 Finally, they should continually review their plan and revise it as new threats emerge or their business changes.<\/i><\/p>\n
Consumers need to stay vigilant. They should create strong passwords for online accounts, and use different passwords for different accounts. They should carefully monitor credit card statements and contact their bank immediately if they see a suspicious transaction. In addition, to avoid computer viruses and online scams, they should avoid opening suspicious email or clicking on suspicious hyperlinks.<\/i><\/p>\n
The Legislature has an important role to play in protecting consumers from threats as well. New York\u2019s data security laws are in dire need of updating. That is why, for several years, Attorney General Schneiderman has been pushing for a major overhaul of New York\u2019s data security law. At a minimum, the law must be updated to require companies to have \u201creasonable\u201d security measures, modernize the definition of \u201cprivate information,\u201d and provide a safe harbor for companies that adopt model data security. I will discuss each of these components in more detail.<\/i><\/p>\n
The law should require that all entities that collect or store private information have \u201creasonable\u201d security measures. It may be surprising to learn that there is no statutory law requiring a company to maintain \u201creasonable data security,\u201d except if it collects Social Security Numbers, or if the company in \u00a0health care or the financial industry and governed by a specific regulatory framework. The law only requires that a company provide notice to consumers and the New York Attorney General\u2019s office if there is a breach of \u201cprivate information,\u201d which is generally defined as a person\u2019s name in combination with a Social Security number, driver\u2019s license, or account or credit card number. \u00a0<\/i><\/p>\n
The \u201creasonable\u201d standard is a common legal standard that would take into account the size of the company, the type of information it keeps, and other facts in deciding whether the entity had acted reasonably. A mom-and-pop grocery store should have far different \u201creasonable\u201d security measures than a multinational credit reporting agency, for instance. For a small business or one that does not collect sensitive personal information, reasonable security measures might only mean purchasing an antivirus program. For larger businesses or those that collect personal information, reasonable security measures might include physical safeguards, such as locks to protect physical areas where information is stored, as well as administrative safeguards, such as assigning responsibility for data security to a particular employee.<\/i><\/p>\n
In addition, the definition of \u201cprivate information\u201d in existing law needs to be modernized. For example, it might be shocking to learn that if you maintain a Google Gmail account, and Google gets hacked resulting in the theft of your username and password, Google is not statutorily required to tell you. If a biometric authenticator, such as a fingerprint or a facial scan used to unlock an iPhone, is disclosed to a hacker, Apple is not statutorily required to tell you. This needs to change.<\/i><\/p>\n
Finally, while the law needs to be updated to protect consumers, we also need to make sure that the law does not unduly burden companies. The law should provide a safe harbor to companies already subject to federal or other New York State data security regulations, and in compliance with those rules, so they will not need to worry about overlapping or conflicting regulations. Similarly, companies that are certified for complying with leading industry data security guidelines should be presumed to have reasonable data security.<\/i><\/p>\n
Thank you. I am happy to answer your questions.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
Equifax Breach Affected Over 143 Million Americans – Including Over 8 Million New Yorkers Bureau Of Internet And Technology Discusses AG\u2019s Response At NY State Senate Consumer Protection Hearing\u00a0 Attorney General Eric T. Schneiderman\u2019s office testified about the massive Equifax data breach at\u00a0the New York State Senate Consumer Protection Committee Hearing on Identity Theft. The […]<\/p>\n","protected":false},"author":2,"featured_media":70131,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[23810,8],"tags":[],"class_list":["post-85421","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wellbeing","category-top-story"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack-related-posts":[],"jetpack_shortlink":"https:\/\/wp.me\/p43meu-mdL","jetpack_featured_media_url":"https:\/\/i0.wp.com\/madisoncountycourier.com\/wp-content\/uploads\/2016\/06\/Attorny_General_Eric_T_Schneiderman.jpg?fit=260%2C221&ssl=1","_links":{"self":[{"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/posts\/85421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=85421"}],"version-history":[{"count":0,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/posts\/85421\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=\/wp\/v2\/media\/70131"}],"wp:attachment":[{"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=85421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=85421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/madisoncountycourier.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=85421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/i0.wp.com\/madisoncountycourier.com\/wp-content\/uploads\/2016\/06\/Attorny_General_Eric_T_Schneiderman.jpg?resize=260%2C221\")
Equifax Breach Affected Over 143 Million Americans – Including Over 8 Million New Yorkers<\/i><\/p>\n