New York Governor George Pataki on Wednesday signed a bill that requires businesses and state government agencies to notify consumers if sensitive data is nabbed in a security breach. This places New York on the list of states such as California that have adopted similar rules--while many other states and the federal government are considering them.

New York's new law, A.4254, applies only to sensitive information such as Social Security numbers, driver's license numbers, or credit card numbers that are not encrypted. It requires written notice, electronic notice if the account holder "expressly" consented to it, or notification through the media if the cost would exceed $250,000.
New York law requires notification after data breaches | CNET