A bill (A610 / S2220) has been signed by Gov. Hochul and chaptered.

The bill prohibits agencies from charging a fee for records where an electronic copy is already available from a previous request made within the past six months except for the actual cost of a storage device or media if provided to the requester.

The following is from the bill memo.

SUMMARY OF PROVISIONS:
 
Section one of this bill would clarify that charging a fee for requests
under Article 6 of the Public Officers Law, constituting the Freedom of
Information Law (FOIL), shall be prohibited when an electronic copy for
such record already exists for the same request made within the previous
six months, except when a different fee is otherwise prescribed by stat-
ute or if the reproduction of such record is in the form of a storage
device, in which case the actual cost of that device or media may be
charged.

JUSTIFICATION:
 
In cases where a public record has been previously requested and exists
in the form of an electronic copy, the agency that furnished the record
can provide an electronic copy of that record upon subsequent request at
no additional cost to the agency. In those circumstances, agencies
should not be able to charge a fee for the original time taken to
produce the record. They may charge for the storage device or media
provided to comply with the request. This bill seeks to clarify such
changes made pursuant to Chapter 745 of the Laws of 2022.
    
    

https://dos.ny.gov/notary-public#remote-notarization-faqs

Remote Notarization FAQs

What is remote notarization?
“Remote notarization” is a form of notarization where the notary officiates the document remotely through audio-visual technology and other security protocols. Remote notarization can be performed by a notary public by traditional ink (e.g., pen) or electronic signature.

How is remote notarization performed?
To provide a remote notarization, the notary public must be physically located within the State of New York at the time of the notarization.  The notary must identify the remote signor (also known as the “principal”) of the document through any of the following three methods:

Commercial software is available to notaries public to perform identify proofing and credential analysis.

Regardless of the method used to confirm the identity of the signor, the notary must be able to see and interact, in real-time, with the remote signor of the document through audio-visual communication technology.  This technology must have security protocols in place to prevent unauthorized access.  The notary must make and keep an audio-visual recording of the remote notarization, and ensure that there is a back-up of the recording.

After the remote signor has executed the document, it must be transmitted to the notary public for officiating.  The notary must confirm that the document is the same as the one signed remotely in the notary public’s presence before applying the notary stamp and signature to the document.  The following statement must be added to the jurat “This remote notarial act involved the use of communication technology.”

What is credential analysis?
Credential analysis is a process where a third-party service validates a government-issued identification presented by an individual through a review of public and proprietary data sources.

What is identity proofing?
Identity proofing is a process or service through which a third party confirms the identity of a signor through review of personal information from public and proprietary data sources.

What is the difference between credential analysis and identify proofing?
Credential analysis validates the authenticity of the principal’s government-issued identification, and identity proofing validates the identity of the individual principal.

How long must a notary retain the audio-visual recording of each remote notarization performed?
A recording, containing both audio and video, of the remote notarization must be retained by the notary for at least ten (10) years. The notary must take reasonable steps to ensure a backup recording of the remote notarization exists and is secured from unauthorized use. The notary may authorize a third party to retain the recordings on behalf of the notary, provided that all recordings retained by a third party be made available to the Secretary of State upon request.

Is a notary journal required?
Yes, the notary public must keep a journal of all remote notarizations performed. Each journal entry must be made contemporaneously with the performance of the notarial act, and each entry must include the date and approximate time of the notarization, the name of the remote signor, the audio-visual technology used to perform the notarization, the number and type of documents officiated and notarial services provided, and the type of identification/credential presented by the remote signor of the document or documents.  The journal must be kept by the notary public for as long as they remain a notary and for an additional five years thereafter.

How much can a notary charge for remote notarization?
A notary public may charge $5.00 per act/signature. If the notary is not performing a remote notarization, the fee cannot exceed $2.00 per act.

Does the notary have to provide remote notary services?
No, if the notary does not have the appropriate technology or capability to provide such services, or does not wish to engage at all in remote notarization, a notary may decline to provide remote services. Additionally, a notary may and should refuse to provide remote notary services if the notary does not believe the person signing the document remotely has capacity to sign or if the notary does not believe the remote signor is signing the document voluntarily.

Do notaries have to register with the Secretary of State to provide remote notary services?
Any notary public commissioned by the NYS Department of State can act as a traditional or remote notary. No separate application or license is required, and the notary is not required to pay any additional fee to the Department of State or the County Clerk where the notary is currently commissioned.  On January 31, 2023 the rules for remote notarization will change.  One significant change is that as of January 31, 2023, any notary wishing to provide remote notarization, must register the capability to perform electronic notarizations with the NYS Department of State, Division of Licensing Services, and pay the requisite fee (which is to be determined and established in regulation) to act as an electronic notary.

Will remotely notarized documents be accepted by a county clerk or other government offices?
Yes, the new law states, in part, “[a] county clerk, city registrar, or other recording officer where applicable shall accept for recording a tangible copy of an electronic record and that is otherwise eligible to be recorded under the laws of this state if the record has been certified by a notary public or other individual authorized to perform a notarial act.” New York Executive Law § 135-c(12)(b). To be accepted, the notary would first have to certify the remotely notarized document.  New York Executive Law § 135-c(12)(a). Specific questions about filing such documents should be directed toward the filing office where the document will be submitted.

Released on April 13, 2020

https://www.dfs.ny.gov/industry_guidance/industry_letters/il20200413_covid19_cybersecurity_awareness

Re: Guidance to Department of Financial Services (“DFS”) Regulated Entities Regarding Cybersecurity Awareness During COVID-19 Pandemic

To: All New York State Regulated Entities

As we face an unprecedented threat from the novel coronavirus known as “COVID-19,” every organization’s highest priority must be health and safety.  The extraordinary steps necessary to combat the COVID-19 pandemic have also created new challenges as regulated entities work to continue operating and providing critical services.  Among these new risks is a significant increase in cybercrime, as criminals seek to exploit the situation.^[1]

The Department of Financial Services (“DFS”) has identified several areas of heightened cybersecurity risk as a result of this crisis.  As called for by DFS’s cybersecurity regulation, 23 NYCRR Part 500, regulated entities should assess the risks described below and address them appropriately.^[2]

We also remind all regulated entities that, under 23 NYCRR Section 500.17(a), covered Cybersecurity Events must be reported to DFS as promptly as possible and within 72 hours at the latest.  Prompt reporting will enable DFS to respond quickly to new threats as DFS works to protect consumers and the financial services industry in these difficult times.

Heightened Risks

1. Remote Working

   The abrupt shift to mass remote working forced by COVID-19 has created new security challenges, and attackers are exploiting these new vulnerabilities.^[3]  These heightened risks to regulated entities’ networks and Nonpublic Information^[4] include: 

   • Secure Connections.  Companies should make remote access as secure as possible under the circumstances.  This includes the use of Multi-Factor Authentication and secure VPN connections that will encrypt all data in transit.  See 23 NYCRR §§ 500.12 & 500.15.
   • Company-Issued Devices.  As new devices such as computers and phones are acquired or repurposed for remote working, regulated entities should ensure that they are properly secured.  This includes locking down the devices so applications cannot be added or deleted by the user, and installing appropriate security software, such as Endpoint Detection & Response and Mobile Device Management.
   • Bring Your Own Device (BYOD) Expansion.  Regulated entities that have expanded their BYOD policies to enable mass remote working should be aware of the security risks and consider mitigating steps.  Some personal devices are not properly secured or are already compromised.  If an expanded BYOD policy is necessary, compensating controls should therefore be considered.
   • Remote Working Communications.  Remote working has increased reliance on video and audio-conferencing applications, but these tools are increasingly targeted by cybercriminals.  Regulated entities should configure these tools to limit unauthorized access, and make sure that employees are given guidance on how to use them securely.
   • Data Loss Prevention.  Employees may be using unauthorized personal accounts and applications, such as email accounts, to remain productive while remote working.  Regulated entities should remind employees not to send Nonpublic Information to personal email accounts and devices.  Anticipating and solving productivity problems will reduce the temptation to use such devices.


2. Increased Phishing and Fraud

   There has been a significant increase in online fraud and phishing attempts related to COVID-19.  For example, the FBI has reported that criminals are using fake emails that pretend to be from the Centers for Disease Control and Prevention (“CDC”), ask for charitable contributions, or offer COVID-19 relief such as government checks.^[5]
   
   

3. Regulated entities should remind their employees to be alert for phishing and fraud emails, and revisit phishing training and testing at the earliest practical opportunity.  Now that face-to-face work is curtailed, authentication protocols may need to be updated – especially for key actions, like security exceptions and wire transfers.



4. Third-Party Risk

   The challenges created by the COVID-19 pandemic have also affected third-party vendors, and regulated entities should re-evaluate the risks to critical vendors.  See 23 NYCRR § 500.11.  Regulated entities should coordinate with critical vendors to determine how they are adequately addressing the new risks.

Conclusion

The COVID-19 pandemic has disrupted normal operations in the financial services industry and beyond, and cyber criminals are exploiting the crisis. Despite the extraordinary challenges, regulated entities should remain vigilant.  By following good cybersecurity practices, entities can identify, mitigate, and manage the risks.

^[1] See DHS Cybersecurity and Infrastructure Security Agency (“CISA”), COVID-19 Exploited by Malicious Cyber Actors (April 8, 2020).

^[2] Heightened cyber risk should also be addressed in the COVID-19 operational preparedness plans called for by DFS guidance issued on March 10, 2020.  See Guidance to New York State Regulated Institutions and Request for Assurance of Operational Preparedness Relating to the Outbreak of the Novel Coronavirus.

^[3] See FBI, Cyber Actors Take Advantage of COVID-19 Pandemic to Exploit Increased Use of Virtual Environments (April 1, 2020); U.S. Secret Service, Secret Service Issues COVID-19 (Coronavirus) Phishing Alert (March 9, 2020).

^[4] 23 NYCRR § 500.01(g).

^[5] See FBI, FBI Sees Rise In Fraud Schemes Related to the Coronavirus (COVID-19) Pandemic (March 20, 2020).

The cybersecurity regulation has the first of many interim deadlines arriving on Aug. 28, 2017.

We have posted a file called the "Cybersecurity Limited Exemption Timeline" (access restricted to signed-in members only).

If you need help with the regulation, please contact the consultants listed on our cybersecurity compliance page. These firms have agreed to provide discounted services to NYSLTA Members.

Hey, why not subscribe to this newsblog and get an email notification whenever a new item is posted?

Here's how   Guide - How to Subscribe to News and Reports.

.

On November 14, 2016 I signed and sent a letter to DFS Deputy Superintendent Cassandra Lentchner.

In September, the DFS issued a proposed regulation for all "covered entities" under DFS purview, which includes all underwriters and licensed title agents. The regulation, designed for the enormous global financial institutions regulated by DFS, imposed drastic changes to security procedures, compliance, business operations, reporting and company governance.

The general assessment is this regulation is a positive development for both consumer and financial services protection. The specifics of the regulation proved in some instances to be overly burdensome and ill suited for the kind of business title companies conduct.

The letter was the result of more than a month of work by a specially appointed joint working group of volunteers drawn from the Government Regulations Committee and the Technology Committee.  This project was headed by Jean Partridge, who also was the primary author of the document. She was advised and supported by Bill Collins, Victor Pajonas, Chris Davis and Vincent Danzi.

The letter is attached to this blog post and it resides in the Government Regulations File Library, on this web site [RESOURCES>DOCUMENT & FILE LIBRARIES].

The joint working group worked cooperatively with counterparts at FNTG, Old Republic, Stewart Title, First American, and ALTA. There was cross-industry collaboration with trade associations representing property & casualty agents in NY and DC- based financial institution trade associations. As always, our Albany lobbyists, Scott Wexler and Kate Corkery provided advice and perspective.

For a regulation that has the potential for profound impact on title agents - and by profound I mean expensive - the awareness and engagement from the membership was imperceptible.I announced this regulation and posted the proposed in an email blast.  I provided an email address for comments. One member commented. NYSLTA is fortunate to have such skilled and dedicated members, such as the handful of people who produced this letter.

This Association will continue to seek engagement with DFS on your behalf. The challenges ahead are countless. Your contribution of time and your expertise are much needed and always welcome.

RGT