The Village of Horseheads Board of Trustees finds that identity
theft and security breaches are effecting local residents and others.
The New York State Legislature and Governor enacted legislation mandating
the establishment of a breach notification procedure to prevent injury
to residents and afford an opportunity for repair of damages resultant
from a breach.
As used in this chapter, the following terms shall have the
meanings indicated:
VILLAGE ENTITY
Any Village board, bureau, division, committee, commission,
council, department, public authority, public benefit corporation,
office or other governmental entity performing a governmental or proprietary
function for the Village of Horseheads except the judiciary.
VILLAGE
The Village of Horseheads, NY.
Any Village entity that maintains computerized data that includes
private information which such entity does not own shall notify the
owner or licensee of the information of any breach of the security
of the system immediately following discovery if the private information
was, or is reasonably believed to have been, acquired by a person
without valid authorization.
The notification required by this chapter may be delayed if
a law enforcement agency determines that such notification impedes
a criminal investigation. The notification required by this chapter
shall be made after such law enforcement agency determines that such
notification does not compromise such investigation.
The notice required by this chapter shall be directly provided
to the affected persons by one of the following methods:
B. Electronic notice, provided that the person to whom notice is required
has expressly consented to receiving said notice in electronic form
and a log of each such notification is kept by the Village entity
who notifies affected persons in such form; provided further, however,
that in no case shall any person or business require a person to consent
to accepting said notice in said form as a condition of establishing
any business relationship or engaging in any transaction;
C. Telephone notification, provided that a log of each telephone notification
is kept by the Village entity; or
D. Substitute notice, if a Village entity demonstrates to the New York
State Attorney General that the cost of providing notice would exceed
$250,000, or that the affected class of subject persons to be notified
exceeds $500,000, or such entity does not have sufficient contact
information, substitute notice shall consist of all of the following:
(1) E-mail notice when such Village entity has an e-mail address for
the subject persons;
(2) Conspicuous posting of the notice on such Village entity's website
page, if such entity maintains one; and
(3) Notification to major statewide media.
Regardless of the method by which notice is provided, such notice
shall include contact information for the person or business making
the notification and a description of the categories of information
that were, or are reasonably believed to have been, acquired by a
person without valid authorization, including specification of which
of the elements of personal information and private information were,
or are reasonably believed to have been, so acquired.