Additional NY SHIELD Act Provisions Become Effective in March 2020
March 5, 2020
On July 25, 2019, New York Governor Andrew Cuomo signed the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), expanding the scope of New York’s prior data breach notification law. As we have previously reported the SHIELD Act: (1) enhances breach notification requirements, and (2) introduces new proactive data security requirements. While the breach notification procedures took effect in October 2019, the new proactive data security requirements will take effect on March 21, 2020.
The SHIELD Act applies to any person or business that owns or licenses computerized data that includes the private information of a New York resident. This applies regardless of whether the person or business has a physical presence in New York State or does business there, which includes any foreign airlines who maintain computerized data for New York residents. These new data security protections will require companies to take proactive measures by implementing “reasonable safeguards to protect the security, confidentiality and integrity of [New York residents’] private information.” Among other things, each company subject to the SHIELD Act must implement a written data security program containing specific elements designed to protect residents’ private information. These elements include:
- Designating an employee or employees to coordinate and oversee a data security program;
- Training employees on data security practices and procedures;
- Assessing internal and external risks;
- Vetting service providers and instituting contractual requirements that safeguard the private information of New York residents; and
- Securely destroying private information that is no longer needed.
The Act extends the period of time in which the New York Attorney General may bring an action from two years to three. In addition, the SHIELD Act: (a) doubles the penalty recoverable by the New York Attorney General for failing to make the proper notifications, from $10 to $20 per instance; (b) increases the cap on notification violations from $100,000 to $250,000; and (c) imposes a new civil penalty of up to $5,000 per violation of the new security program standards.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com or 202-659-6622); Drew Derco (dderco@eckertseamans.com or 202-659-6665), or Andy Orr (aorr@eckertsemans.com or 202-659-6625).