NY S08169

Expands the definition of "data breach" to include "unauthorized utilization" of computerized data, in addition to unauthorized acquisition

Broadens the definition of "state entity" to explicitly include all cities, counties, municipalities, villages, towns, and other local agencies, not just state-level entities

Adds a new definition for "cybersecurity incident" covering events that jeopardize the integrity, confidentiality, or availability of computers, information systems, networks, or virtual infrastructure

Requires state entities that own, license, or maintain computerized data with private information to disclose breaches to affected New York residents and consult with the Office of Information Technology Services to determine breach scope

Mandates the Office of Information Technology Services deliver a report on breach scope and security improvement recommendations within 90 days of breach notice

Takes effect 90 days after becoming law