New York recently enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which significantly expands New York’s breach notification statute. The SHIELD Act imposes broad obligations upon any business, regardless of whether it has a presence in New York, that maintains private information of New York residents.
“Private information” under the SHIELD Act includes:
-
social security numbers;
-
driver license numbers;
-
credit or debit card numbers;
-
financial account numbers;
-
biometric information;
-
a username or email address with an associated password or security question and answer that would permit online account access.
The SHIELD Act requires that businesses implement safeguards to protect private information. These safeguards must include:
-
designating one or more employees to oversee the business’s information security program;
-
training employees on information security policies procedures;
-
assessing information security risks and implementing controls to reduce those risks;
-
vetting outside service providers to ensure private information is safeguarded; and
-
destroying private information within a reasonable time after it is no longer needed.
The SHIELD Act also expands notification obligations in the event of a data breach involving private information and increases penalties for violating the breach notification requirements.
The information security provisions of the SHIELD Act take effect on March 21, 2020, with the other provisions (such as the breach notification obligations) becoming effective October 23, 2019.
Any business that maintains any private information of a New York resident is covered by the SHIELD Act. This is particularly significant for employers in New York, and = employers that have employees that reside in New York, as employers typically maintain a significant amount of private information about their employees, such as social security numbers and financial account numbers. Businesses will now be obligated to take affirmative steps to protect that information.
If you have questions about your business’s information security practices and obligations, please contact us at (201) 345-5412 / (646) 503-5358 or through our online scheduling calendar to set up a complimentary consultation.