Understanding the New York SHIELD Act

What is the New York SHIELD Act? 

Detailed Description

The New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act is a significant piece of legislation designed to enhance cybersecurity protocols within the state of New York.

Enacted on July 25, 2019, and fully effective from March 21, 2020, this law broadens the scope of information covered under the privacy law, extends security requirements to any business handling New York residents' data, and updates the requirements for businesses that suffer a data breach.

The SHIELD Act mandates that any person or business owning or licensing computerized data which includes private information of a New York resident must implement and maintain reasonable safeguards to protect the security, confidentiality, and integrity of the private information.

The Act categorizes private information into several types, including personal identifiers combined with financial account numbers, biometric data, or health information among others.

Under the SHIELD Act, the definition of a data breach is expanded to include unauthorized access to private information, in addition to the existing standard of unauthorized acquisition. This means that simply accessing information without proper authorization is considered a breach, regardless of whether the data is copied, extracted, or used.

Common Questions

• What constitutes "reasonable" security measures under the SHIELD Act? The Act specifies administrative, technical, and physical safeguards, such as risk assessments, employee training, vendor contracts that ensure the security of information, and disposal procedures for private data.
• Who needs to comply with the SHIELD Act? Any business that owns or licenses computerized data that includes private information of New York residents, regardless of whether the business is located in New York.
• What are the penalties for non-compliance? Non-compliance can result in statutory penalties up to $250,000.

Examples

Case Study: Small Business Implementation

A small online retailer based in Ohio, which ships products to New York residents, had to comply with the SHIELD Act.

The retailer assessed its cybersecurity measures and realized it lacked sufficient employee training and proper data disposal procedures. By implementing regular cybersecurity training for its staff and secure data deletion practices, the retailer not only complied with the SHIELD Act but also improved its overall data security posture.

Security Recommendations

To comply with the New York SHIELD Act and ensure the protection of private information, businesses should consider the following security measures:

• Risk Assessment: Regularly conduct risk assessments to identify vulnerabilities in your information systems.
• Employee Training: Provide ongoing training to employees on the importance of data security and how to identify and respond to security threats.
• Access Controls: Implement strong access controls to ensure that only authorized personnel have access to sensitive information.
• Incident Response Plan: Develop and test an incident response plan to quickly respond to data breaches and mitigate their impact.

References

• New York State Senate Bill S5575
  
• New York Department of State: SHIELD Act Overview
  
• Federal Trade Commission: Data Security
  

By understanding and implementing the requirements of the New York SHIELD Act, businesses can not only comply with the law but also significantly enhance their cybersecurity measures, protecting both their interests and the private information of New York residents.

Frequently Asked Questions