New York - Breach Notification

This playbook helps an analyst determine if the breached data meets the criteria for breach notification according to New York State law, and, if necessary, follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. **Sources:** https://ag.ny.gov/internet/data-breach https://www.dos.ny.gov/consumerprotection/pdf/infosecbreach03.pdf https://www.nysenate.gov/legislation/laws/GBS/899-AA

US - Breach Notification · 38 tasks · 7 inputs · 8 outputs

Inputs

  • ContactName — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • ContactEmailAddress — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • ContactTelNumber — In case of a breach, the contact details to send to the Attorney General and the affected residents.
  • CompanyName —
  • CompanyAddress — In case of a breach, the company details to display in the breach report.
  • CompanyCity — In case of a breach, the company details to display in the breach report.
  • CompanyCountry — In case of a breach, the company details to display in the breach report.

Outputs

  • PIICompromised — Set a flag indicating that PII has been compromised.
  • HealthInsuranceBreached — Set a flag indicating that the breach contains PII of health insurance information.
  • MedicalInformationBreached — Set a flag indicating that the breach contains PII of medical information.
  • FinancialInformationBreached — Set a flag indicating that the breach contains PII of financial information.
  • AccountInformationBreached — Set a flag indicating that the breach contains PII of account information.
  • UniqueIdentificationNumberBreached — Set a flag indicating that the breach contains PII of unique identification number.
  • UniqueBiometricDataBreached — Set a flag indicating that the breach contains PII of unique biometric data.
  • Analyst review.Answers.1 — Explain, in your words, the incident origin, what you have checked, and any information related to this incident.

Commands used

send-mail setIncident

Flowchart

yes No Yes yes No Yes No Yes Less than 5000 More than 5000 Start Start Notify DPO of suspected data breach Notify DPO of suspected d... DPO confirmed the breach DPO confirmed the breach Breach documentation process Breach documentation process Generate breach report - GenerateInvestigationSummaryReport Generate breach report GenerateInvestigationSummaryR... Done Done Upload and submit the report to New York attorney general Upload and submit the rep... DPO updates report DPO updates report Get new report from DPO Get new report from DPO Contact authorities Contact authorities Send report for DPO approval - send-mail Send report for DPO approval send-mail Get DPO Approval for the report Get DPO Approval for the ... Is PII compromised? Is PII compromised? PII Breach Notification required PII Breach Notification r... No breach has occurred No breach has occurred Analyst review Analyst review Does breach contain New York resident information? Does breach contain New Y... Notify management with the severity of data breach Notify management with th... Does law enforcement require delaying breach notification? Does law enforcement requ... Wait to hear back from law enforcement Wait to hear back from la... Checks number of affected data subjects Checks number of affected... Update incident with DPO answers - setIncident Update incident with DPO ... setIncident Set PII compromised flag - Set Set PII compromised flag Set Breach does not contain New York residents Breach does not contain N... Set PII wasn't compromised flag - Set Set PII wasn't compromise... Set Report consumer reporting agencies Report consumer reporting... Send report to consumer reporting agencies Send report to consumer r... Updates DPO notification status to in progress - setIncident Updates DPO notification ... setIncident Updates DPO notification status to done - setIncident Updates DPO notification ... setIncident Set breached confirmation flag - setIncident Set breached confirmation... setIncident PII Breach Confirm PII Breach Confirm Set breached not confirm flag - setIncident Set breached not confirm ... setIncident Updates management notification status to in progress - setIncident Updates management notifi... setIncident Updates management notification status to done - setIncident Updates management notifi... setIncident Updates Attorney General notification status to in progress - setIncident Updates Attorney General ... setIncident Updates Attorney General notification status to done - setIncident Updates Attorney General ... setIncident Update Reporting Agencies notification status to in progress - setIncident Update Reporting Agencies... setIncident Update Reporting Agencies notification status to done - setIncident Update Reporting Agencies... setIncident