Two proposed state laws could impact incident response and costs: New Jersey Assembly Bill 1852 and New York Senate Bill 3078. As the National Law Review reports:
New Jersey’s proposed bill narrows permissible notice methods to written notice or electronic notice. It removes the existing substitute-notice pathway that many companies rely on when notice costs are high or when contact information is incomplete.
New York’s proposal would require that, when the notifying person or business was the source of the breach, the notice must include an offer of appropriate identity theft prevention and mitigation services at no cost for at least 12 months, along with the information necessary for the individual to accept the offer.
Read more from JacksonLewis about both proposed bills at The National Law Review.
