Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comFirm Insights
Author: Scarinci Hollenbeck, LLC
Date: March 4, 2020
The Firm
201-896-4100 info@sh-law.comNew York’s “Stop Hacks and Improve Electronic Data Security Handling Act,” better known as the SHIELD Act, takes effect on March 21, 2020. Businesses must review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act.
The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law and updates the notification requirements when there has been a breach of data. Notably, the new law’s data breach notification requirements apply to any person or entity with private information of a New York resident, not just to those that conduct business in New York State. That means New Jersey businesses, specifically, and all business, generally, with employees and/or customers in New York will also be subject to these new compliance obligations.
Under the SHIELD Act, “any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.” Small businesses, defined as those with less than 50 employees and under $3 million in gross revenue; or less than $5 million in assets, will be deemed compliant if they “implement and maintain reasonable safeguards that are appropriate to the size and complexity of the small business to protect the security, confidentiality and integrity of the private information.”
The bill also contains a carve-out for certain other businesses. It provides that “certified compliant entities,” defined as those already regulated by, and compliant with, existing or future regulations of any federal or New York State government entity (including NYS DFS regulations; regulations under Gramm-Leach-Bliley; Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations, or with International Organization for Standardization (ISO)/National Institute of Standards and Technology (NIST) cybersecurity standards, will receive safe harbor from enforcement actions under the SHIELD Act.
The SHIELD Act broadens the scope of information covered under New York’s existing data breach notification law, the NYS Information Security Breach and Notification Act. Existing regulations only applied to personally-identifying information that included social security numbers. Under the SHIELD Act, the definition of private information is expanded to include “any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.”
The statute’s data protection and data breach notification obligations apply to “private information” in combination with one, or more of the following data sets:
The definition of a data breach will also be expanded to include unauthorized access to private information. New York’s previous data breach law only covered the unauthorized acquisition of computerized data. Under the SHIELD Act, the definition of “breach of the security of the system” is expanded to include unauthorized “access” of computerized data that compromises the security, confidentiality, or integrity of private information, and it provides sample indicators of access. In determining whether information has been accessed, or is reasonably believed to have been accessed, by an unauthorized person or a person without valid authorization, such business may consider, among other factors, indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person.
Failure to provide required reasonable data security will be considered be a violation of section 349 of the General Business Law, thereby authorizing New York’s Attorney General to bring suit against any business for noncompliance. Businesses may be fined $5,000 for each violation or up to $20 per instance of failed notification, provided that the latter’s aggregate amount doesn’t exceed $250,000. The upside for businesses is that the SHIELD Act does not create a private right of action.
It is pertinent for businesses to review their information security programs to assess the private information they collect and implement data security requirements specified in the SHIELD Act. This is a time-consuming and complex process. The compliance date is looming and business are best served if they begin their review process sooner rather than later.
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
If you’re considering closing your business, it’s crucial to understand that simply shutting your doors does not end your legal obligations. Unless you formally dissolve your business, it continues to exist in the eyes of the law—leaving you exposed to ongoing liabilities such as taxes, compliance violations, and potential lawsuits. Dissolving a business can seem […]
Author: Christopher D. Warren
Contrary to what many people think, corporate restructuring isn’t all doom and gloom. Revamping a company’s organizational structure, corporate hierarchy, or operations procedures can help keep your business competitive. This is particularly true during challenging times. Corporate restructuring plays a critical role in modern business strategy. It helps companies adapt quickly to market changes. Following […]
Author: Dan Brecher
Cryptocurrency intimidates most people. The reason is straightforward. People fear what they do not understand. When confusion sets in, the common reaction is either to ignore the subject entirely or to mistrust it. For years, that is exactly how most of the public and even many in law enforcement treated cryptocurrency. However, such apprehension changed […]
Author: Bryce S. Robins
Using chattel paper to obtain a security interest in personal property is a powerful tool. It can ensure lenders have a legal claim on collateral ranging from inventory to intellectual property. To reduce risk and protect your legal rights, businesses and lenders should understand the legal framework. This framework governs the creation, sale, and enforcement […]
Author: Dan Brecher
For years, digital assets operated in a legal gray area, a frontier where innovation outpaced the reach of regulators and law enforcement. In this early “Wild West” phase of finance, crypto startups thrived under minimal oversight. That era, however, is coming to an end. The importance of crypto compliance has become paramount as cryptocurrency has […]
Author: Bryce S. Robins
Earlier this month, the U.S. Supreme Court issued a decision in Ames v. Ohio Department of Youth Services vitiating the so-called “background circumstances” test required by half of federal circuit courts.1 The background circumstances test required majority group plaintiffs pleading discrimination under Title VII of the Civil Rights Act to meet a heightened pleading standard […]
Author: Matthew F. Mimnaugh
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!