Walk It Through: The Breach Letter

Within thirty days of discovery, three state offices told, and a penalty per failed notice.

A letter arrives saying a ticket seller's systems were breached.

Two things a person in this spot might do. Picking one shows what the law says about it.

One breach letter from one ticket seller. What counts as personal information, the forms notice may take, and the exception for encrypted data are not worked through here.

A practice walkthrough, not a prediction of how any real one will go. Legal information, not legal advice.

Words this turns on

Terms with a legal meaning that is narrower than the everyday one. Each links to the definition and the authority behind it.

Breach of the security of the systemWhat a business discloses to affected New York residents in the most expedient time possible and without unreasonable delay, and within thirty days after discovery. Whenever residents are notified, the state attorney general, the department of state and the division of state police are told too.