REMINDER: NY SHIELD ACT BECAME FULLY EFFECTIVE ON MARCH 21
June 17, 2020
Below are the important provisions of this expensive state privacy law:
-
Notification Requirements: When a private entity suffers a data breach, it must notify the following groups: 1) The affected NY residents; 2) The NY Attorney General; 3) The NY Division of State Police; and 4) The Department of State’s Division of Consumer Protection.
-
“Private Information” includes biometric information, e-mail addresses and corresponding passwords or security questions and answers, and financial account numbers and security codes;
-
“Breach” now includes any unauthorized “access” to personal information; and
-
The Act applies to any “person or business,” whether conducting business in New York or not, that owns or licenses private information of a New York resident.
-
-
Proactive Measures: Any person or business in possession of New York residents’ private information must take proactive measures to protect such information by developing and implementing “…reasonable safeguards to protect the security, confidentiality and integrity of the private information.” This includes:
-
Designating an employee or employees to coordinate a data security program;
-
Training employees on data security practices and procedures;
-
Vetting service providers and instituting contractual requirements that safeguard the private information of New York residents; and
-
Securely destroying private information that is no longer needed.
-
-
Shield Act Penalties:
-
The Act doubles the penalty recoverable by the Attorney General for failing to make the proper notifications, from $10 to $20 per instance, while increasing the cap from $100,000 to $250,000.
-
Imposes a new civil penalty of up to $5,000 per violation of the new security program standards.
-
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com or 202-659-6622); Drew Derco (dderco@eckertseamans.com or 202-659-6665), or Andy Orr (aorr@eckertsemans.com or 202-659-6625).
Share This Post
Authors
