Privacy & Information Security Law Blog

On March 21, 2020, the data security provisions of New York’s Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”) went into effect. The SHIELD Act requires any person or business owning or licensing computerized data that includes the private information of a resident of New York (“covered business”) to implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information.

“Private information” means either:

• A user name or e-mail address in combination with a password or security question and answer that would permit access to an online account; or
• Personal information (i.e., any information concerning a natural person which, because of name, number, personal mark or other identifier, can be used to identify such natural person) consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired: (1) Social Security number; (2) driver’s license number or non-driver identification card number; (3) account number, credit or debit card number, in combination with any required security code, access code, password or other information would permit access to an individual’s financial account; (4) account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual’s financial account without additional identifying information, security code, access code, or password; or (5) biometric information.

The term does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

A covered business will be deemed to be in compliance with the SHIELD Act’s data security requirement if the business implements a data security program that includes reasonable administrative, technical and physical safeguards, such as:

• Reasonable administrative safeguards: (1) designating one or more employees to coordinate the security program; (2) identifying reasonably foreseeable internal and external risks; (3) assessing the sufficiency of safeguards in place to control the identified risks; (4) training and managing employees in the security program practices and procedures; (5) selecting service providers capable of maintaining appropriate safeguards, and requiring those safeguards by contract; and (6) adjusting the security program in light of business changes or new circumstances.
• Reasonable technical safeguards: (1) assessing risks in network and software design; (2) assessing risks in information processing, transmission and storage; (3) detecting, preventing and responding to attacks or system failures; and (4) regularly testing and monitoring the effectiveness of key controls, systems and procedures.
• Reasonable physical safeguards: (1) assessing risks of information storage and disposal; (2) detecting, preventing and responding to intrusions; (3) protecting against unauthorized access to or use of private information during or after the collection, transportation and destruction or disposal of the information; and (4) disposing of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.

If a covered business is considered a “small business,” the data security program it maintains is compliant if the program contains reasonable administrative, technical and physical safeguards that are appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information the small business collects from or about consumers. “Small business” is defined to mean “any person or business with (1) fewer than 50 employees; (2) less than three million dollars in gross annual revenue in each of the last three fiscal years; or (3) less than five million dollars in year-end total assets, calculated in accordance with generally accepted accounting principles.”

A covered business also may be deemed to be in compliance with the SHIELD Act’s data security requirements if the business is subject to and in compliance with any of the following data security requirements: (1) regulations promulgated pursuant to Title V of the federal Gramm-Leach-Bliley Act; (2) regulations implementing the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act; (3) the 23 NYCRR 500 cybersecurity regulations; or (4) “any other data security rules and regulations of, and the statutes administered by, any official department, division, commission or agency of the federal or New York state government… .”

Violations of the SHIELD Act are considered deceptive acts or practices and may be enforced by the New York Attorney General. Covered businesses may be liable for a civil penalty of up to $5,000 dollars per violation.

As we previously reported, the SHIELD Act also contains amendments that expanded the then-existing breach notification rules. The amendments to the New York breach notification law went into effect on October 23, 2019.