[HISTORY: Adopted by the Town Board of the Town of Farmington 5-9-2006.
Amendments noted where applicable.]
This policy is consistent with the State Technology Law, § 208,
as added by Chapters 442 and 491 of the laws of 2005. Section 208 requires
all state entities to notify an individual when there has been, or is reasonably
believed to have been, a compromise of the individual's private information,
in compliance with the Information Security Breach and Notification Act and
this policy.
As used in this chapter, the following terms shall have the meanings
indicated:
The unauthorized acquisition of unencrypted computerized data with
private information.
Personal information in combination with any one or more of the following
data elements, when either the personal information or the data element is
not encrypted or encrypted with an encryption key that has also been acquired:
"Private information" does not include publicly available information
that is lawfully made available to the general public from federal, state,
or local government records.
If encrypted data is compromised along with the corresponding encryption
key, the data shall be considered unencrypted and thus fall under the notification
requirements.
The Town, after consulting with the state office of cyber security and
critical infrastructure coordination to determine the scope of the breach
and restoration measures, shall notify an individual when it has been determined
that there has been, or is reasonably believed to have been, a compromise
of private information through unauthorized disclosure.
Notification may be delayed if a law enforcement agency determines that
the notification impedes a criminal investigation. In such case, notification
will be delayed only as long as needed to determine that notification no longer
compromises any investigation.
The Town will notify the affected individual. Such notice shall be directly
provided to the affected persons by one of the following methods:
A.
Written notice;
B.
Electronic notice, provided that the person to whom notice
is required has expressly consented to receiving said notice in electronic
form and a log of each such notification is kept by the Town who notifies
affected persons in such form;
C.
Telephone notification provided that a log of each such
notification is kept by the Town who notifies affected persons; or
D.
Substitute notice, if the Town demonstrates to the State
Attorney General that the cost of providing notice would exceed $250,000,
or that the affected class of subject persons to be notified exceeds $5,000,
or the Town does not have sufficient contact information. Substitute notice
shall consist of all of the following:
Regardless of the method by which notice is provided, such notice shall
include contact information for the Town making the notification and a description
of the categories of information that were, or are reasonably believed to
have been, acquired by a person without valid authorization, including specification
of which of the elements of personal information and private information were,
or are, reasonably believed to have been so acquired.
In the event that any New York residents are to be notified, the Town
shall notify the State Attorney General, the Consumer Protection Board and
the State Office of Cyber Security and Critical Infrastructure Coordination
as to the timing, content and distribution of the notices and approximate
number of affected persons. Such notice shall be made without delaying notice
to affected New York residents.
This policy also applies to information maintained on behalf of the
Town by a third party.
When more than 5,000 New York residents are to be notified at one time,
then the Town shall notify the consumer reporting agencies, as that term is
defined in the State Technologies Law, § 208, as to the timing,
content and distribution of the notices and the approximate number of affected
individuals. This notice, however, will be made without delaying notice to
the individuals.
