Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comAuthor: Scarinci Hollenbeck, LLC|August 21, 2019
In late July, New York Governor Andrew Cuomo signed two bills into law that will impose new privacy requirements on New York businesses. The “Stop Hacks and Improve Electronic Data Security” (SHIELD) Act imposes new obligations regarding how businesses handle private customer data and provide data breach notifications. The second bill (A.2374/S.3582) requires consumer credit reporting agencies to offer identity theft prevention and mitigation services in the case of a breach.
Key points of the SHIELD Act include: (a) broadening the scope of information covered under breach notification law, (b) broadening the definition of a data breach to include unauthorized access to information (not just the unauthorized acquisition of information), and (c) requiring businesses to provide reasonable data security.
The SHIELD requirements apply to “any person or business that owns or licenses computerized data which includes private information of a resident of New York.” Such people/businesses are required to “develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.” SHIELD will take effect in March 2020.
Two carve-outs for certain businesses:
SHIELD broadens the scope of information covered under New York’s existing data breach notification law, and updates notification requirements when there has been a breach of data. Three key changes include:
Failure to provide required reasonable data security would be a violation of section 349 of the General Business Law, and the attorney general could bring suit for noncompliance. Businesses could be fined $5,000 for each violation or up to $20 per instance of failed notification, with an aggregate maximum of $250,000. However, the SHIELD Act does not create a private right of action.
The second bill impacts credit reporting agencies and establishes the minimal amount of long-term protections that must be given to affected consumers. For any credit reporting agency that suffers a breach of information containing consumer Social Security numbers, that agency must then provide to affected consumers five years of identity theft prevention services and, if applicable, identity theft mitigation services. Credit reporting agencies must also inform consumers on credit freezes of a breach of data involving a Social Security number, and provide consumers with the right to freeze their credit at no cost. This law will take effect in September 2019 and applies to any breach of the security of a consumer credit reporting agency that occurred in the prior three years.
If you have any questions or if you would like to discuss the matter further, please contact me, Kristin Garris, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.
The Firm
201-896-4100 info@sh-law.comIn late July, New York Governor Andrew Cuomo signed two bills into law that will impose new privacy requirements on New York businesses. The “Stop Hacks and Improve Electronic Data Security” (SHIELD) Act imposes new obligations regarding how businesses handle private customer data and provide data breach notifications. The second bill (A.2374/S.3582) requires consumer credit reporting agencies to offer identity theft prevention and mitigation services in the case of a breach.
Key points of the SHIELD Act include: (a) broadening the scope of information covered under breach notification law, (b) broadening the definition of a data breach to include unauthorized access to information (not just the unauthorized acquisition of information), and (c) requiring businesses to provide reasonable data security.
The SHIELD requirements apply to “any person or business that owns or licenses computerized data which includes private information of a resident of New York.” Such people/businesses are required to “develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data.” SHIELD will take effect in March 2020.
Two carve-outs for certain businesses:
SHIELD broadens the scope of information covered under New York’s existing data breach notification law, and updates notification requirements when there has been a breach of data. Three key changes include:
Failure to provide required reasonable data security would be a violation of section 349 of the General Business Law, and the attorney general could bring suit for noncompliance. Businesses could be fined $5,000 for each violation or up to $20 per instance of failed notification, with an aggregate maximum of $250,000. However, the SHIELD Act does not create a private right of action.
The second bill impacts credit reporting agencies and establishes the minimal amount of long-term protections that must be given to affected consumers. For any credit reporting agency that suffers a breach of information containing consumer Social Security numbers, that agency must then provide to affected consumers five years of identity theft prevention services and, if applicable, identity theft mitigation services. Credit reporting agencies must also inform consumers on credit freezes of a breach of data involving a Social Security number, and provide consumers with the right to freeze their credit at no cost. This law will take effect in September 2019 and applies to any breach of the security of a consumer credit reporting agency that occurred in the prior three years.
If you have any questions or if you would like to discuss the matter further, please contact me, Kristin Garris, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.