Scarinci Hollenbeck, LLC, LLCScarinci Hollenbeck, LLC, LLC

Firm Insights

New York’s SHIELD Act Takes Effect on March 21 – Are You Ready?

Author: Scarinci Hollenbeck, LLC

Date: March 4, 2020

Key Contacts

Back

New York’s “Stop Hacks and Improve Electronic Data Security Handling Act,” better known as the SHIELD Act, takes effect on March 21, 2020…

New York’s “Stop Hacks and Improve Electronic Data Security Handling Act,” better known as the SHIELD Act, takes effect on March 21, 2020. Businesses must review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act.

New York’s SHIELD Act Takes Effect on March 21

The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law and updates the notification requirements when there has been a breach of data. Notably, the new law’s data breach notification requirements apply to any person or entity with private information of a New York resident, not just to those that conduct business in New York State. That means New Jersey businesses, specifically, and all business, generally, with employees and/or customers in New York will also be subject to these new compliance obligations.

SHIELD’s Mandatory Data Protection Measures

Under the SHIELD Act, “any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.”  Small businesses, defined as those with less than 50 employees and under $3 million in gross revenue; or less than $5 million in assets, will be deemed compliant if they “implement and maintain reasonable safeguards that are appropriate to the size and complexity of the small business to protect the security, confidentiality and integrity of the private information.”

The bill also contains a carve-out for certain other businesses. It provides that “certified compliant entities,” defined as those already regulated by, and compliant with, existing or future regulations of any federal or New York State government entity (including NYS DFS regulations; regulations under Gramm-Leach-Bliley; Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations, or with International Organization for Standardization (ISO)/National Institute of Standards and Technology (NIST) cybersecurity standards, will receive safe harbor from enforcement actions under the SHIELD Act.

Definition of Private Information

The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law, the NYS Information Security Breach and Notification Act. Existing regulations only applied to personally-identifying information that included social security numbers. Under the SHIELD Act, the definition of private information is expanded to include “any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.”

The statute’s data protection and data breach notification obligations apply to “private information” in combination with one, or more of the following data sets:

  • Social Security number;
  • Driver’s license number or non-driver identification card number;
  • Account number, credit or debit card number, in combination with a security code or without, if the numbers can be used alone to access the financial account of the individual.
  • Biometric information, meaning data generated by electronic measurements of an individual’s unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual’s identity; or
  • A username or e-mail address in combination with a password or security question and answer that would permit access to an online account.

Definition of Data Breach

The definition of a data breach will also be expanded to include unauthorized access to private information. New York’s previous data breach law only covered the unauthorized acquisition of computerized data. Under the SHIELD Act,  the definition of “breach of the security of the system” is expanded to include unauthorized “access” of computerized data that compromises the security, confidentiality, or integrity of private information, and it provides sample indicators of access. In determining whether information has been accessed, or is reasonably believed to have been accessed, by an unauthorized person or a person without valid authorization, such business may consider, among other factors, indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person.

Penalties for Violating the SHIELD Act

Failure to provide required reasonable data security will be considered be a violation of section 349 of the General Business Law, thereby authorizing New York’s Attorney General to bring suit against any business for noncompliance. Businesses may be fined $5,000 for each violation or up to $20 per instance of failed notification, provided that the latter’s aggregate amount doesn’t exceed $250,000.  The upside for businesses is that the SHIELD Act does not create a private right of action.

It is pertinent for businesses to review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act. This is a time-consuming and complex process.  The compliance date is looming and business are best served if they begin their review process sooner rather than later.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Scarinci Hollenbeck, LLC, LLC

Related Posts

See all
Dissolving Your Business: Essential Legal Steps to Protect Your Interests post image

Dissolving Your Business: Essential Legal Steps to Protect Your Interests

If you’re considering closing your business, it’s crucial to understand that simply shutting your doors does not end your legal obligations. Unless you formally dissolve your business, it continues to exist in the eyes of the law—leaving you exposed to ongoing liabilities such as taxes, compliance violations, and potential lawsuits. Dissolving a business can seem […]

Author: Christopher D. Warren

Link to post with title - "Dissolving Your Business: Essential Legal Steps to Protect Your Interests"
The Role of Corporate Restructuring in Mergers & Acquisitions post image

The Role of Corporate Restructuring in Mergers & Acquisitions

Contrary to what many people think, corporate restructuring isn’t all doom and gloom. Revamping a company’s organizational structure, corporate hierarchy, or operations procedures can help keep your business competitive. This is particularly true during challenging times. Corporate restructuring plays a critical role in modern business strategy. It helps companies adapt quickly to market changes. Following […]

Author: Dan Brecher

Link to post with title - "The Role of Corporate Restructuring in Mergers & Acquisitions"
Crypto Enforcement: A Former Prosecutor’s Warning to Criminals and the Public post image

Crypto Enforcement: A Former Prosecutor’s Warning to Criminals and the Public

Cryptocurrency intimidates most people. The reason is straightforward. People fear what they do not understand. When confusion sets in, the common reaction is either to ignore the subject entirely or to mistrust it. For years, that is exactly how most of the public and even many in law enforcement treated cryptocurrency. However, such apprehension changed […]

Author: Bryce S. Robins

Link to post with title - "Crypto Enforcement: A Former Prosecutor’s Warning to Criminals and the Public"
Understanding Chattel Paper: A Key Component in Secured Transactions post image

Understanding Chattel Paper: A Key Component in Secured Transactions

Using chattel paper to obtain a security interest in personal property is a powerful tool. It can ensure lenders have a legal claim on collateral ranging from inventory to intellectual property. To reduce risk and protect your legal rights, businesses and lenders should understand the legal framework. This framework governs the creation, sale, and enforcement […]

Author: Dan Brecher

Link to post with title - "Understanding Chattel Paper: A Key Component in Secured Transactions"
Crypto Compliance: A Comprehensive Guide post image

Crypto Compliance: A Comprehensive Guide

For years, digital assets operated in a legal gray area, a frontier where innovation outpaced the reach of regulators and law enforcement. In this early “Wild West” phase of finance, crypto startups thrived under minimal oversight. That era, however, is coming to an end. The importance of crypto compliance has become paramount as cryptocurrency has […]

Author: Bryce S. Robins

Link to post with title - "Crypto Compliance: A Comprehensive Guide"
Supreme Court and Title VII: Implications for Reverse Discrimination post image

Supreme Court and Title VII: Implications for Reverse Discrimination

Earlier this month, the U.S. Supreme Court issued a decision in Ames v. Ohio Department of Youth Services vitiating the so-called “background circumstances” test required by half of federal circuit courts.1 The background circumstances test required majority group plaintiffs pleading discrimination under Title VII of the Civil Rights Act to meet a heightened pleading standard […]

Author: Matthew F. Mimnaugh

Link to post with title - "Supreme Court and Title VII: Implications for Reverse Discrimination"

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Sign up to get the latest from our attorneys!

Explore What Matters Most to You.

Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.

Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.

Let`s get in touch!

* The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship. Confidential or time-sensitive information should not be sent through this form.

Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!