New York’s SHIELD Act Takes Effect on March 21 – Are You Ready?

New York’s “Stop Hacks and Improve Electronic Data Security Handling Act,” better known as the SHIELD Act, takes effect on March 21, 2020…

New York’s “Stop Hacks and Improve Electronic Data Security Handling Act,” better known as the SHIELD Act, takes effect on March 21, 2020. Businesses must review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act.

The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law and updates the notification requirements when there has been a breach of data. Notably, the new law’s data breach notification requirements apply to any person or entity with private information of a New York resident, not just to those that conduct business in New York State. That means New Jersey businesses, specifically, and all business, generally, with employees and/or customers in New York will also be subject to these new compliance obligations.

SHIELD’s Mandatory Data Protection Measures

Under the SHIELD Act, “any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.”  Small businesses, defined as those with less than 50 employees and under $3 million in gross revenue; or less than $5 million in assets, will be deemed compliant if they “implement and maintain reasonable safeguards that are appropriate to the size and complexity of the small business to protect the security, confidentiality and integrity of the private information.”

The bill also contains a carve-out for certain other businesses. It provides that “certified compliant entities,” defined as those already regulated by, and compliant with, existing or future regulations of any federal or New York State government entity (including NYS DFS regulations; regulations under Gramm-Leach-Bliley; Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations, or with International Organization for Standardization (ISO)/National Institute of Standards and Technology (NIST) cybersecurity standards, will receive safe harbor from enforcement actions under the SHIELD Act.

Definition of Private Information

The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law, the NYS Information Security Breach and Notification Act. Existing regulations only applied to personally-identifying information that included social security numbers. Under the SHIELD Act, the definition of private information is expanded to include “any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.”

The statute’s data protection and data breach notification obligations apply to “private information” in combination with one, or more of the following data sets:

• Social Security number;
• Driver’s license number or non-driver identification card number;
• Account number, credit or debit card number, in combination with a security code or without, if the numbers can be used alone to access the financial account of the individual.
• Biometric information, meaning data generated by electronic measurements of an individual’s unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual’s identity; or
• A username or e-mail address in combination with a password or security question and answer that would permit access to an online account.

Definition of Data Breach

The definition of a data breach will also be expanded to include unauthorized access to private information. New York’s previous data breach law only covered the unauthorized acquisition of computerized data. Under the SHIELD Act,  the definition of “breach of the security of the system” is expanded to include unauthorized “access” of computerized data that compromises the security, confidentiality, or integrity of private information, and it provides sample indicators of access. In determining whether information has been accessed, or is reasonably believed to have been accessed, by an unauthorized person or a person without valid authorization, such business may consider, among other factors, indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person.

Penalties for Violating the SHIELD Act

Failure to provide required reasonable data security will be considered be a violation of section 349 of the General Business Law, thereby authorizing New York’s Attorney General to bring suit against any business for noncompliance. Businesses may be fined $5,000 for each violation or up to $20 per instance of failed notification, provided that the latter’s aggregate amount doesn’t exceed $250,000.  The upside for businesses is that the SHIELD Act does not create a private right of action.

It is pertinent for businesses to review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act. This is a time-consuming and complex process.  The compliance date is looming and business are best served if they begin their review process sooner rather than later.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.