SHIELD Act

The SHIELD Act (Stop Hacks and Improve Electronic Data Security) did two things. It broadened New York's breach notification law, so more kinds of information and more kinds of incidents trigger notice, and it created a duty for any business holding New York residents' private information to keep reasonable safeguards.

It reaches businesses anywhere, not only those operating in New York, if they hold private information about New York residents.

• Any person or business that owns or licenses computerized private information of a New York resident, wherever located.
• Private information includes the traditional identifiers (Social Security number, driver's license number, account or card number with its code) and adds biometric information, an account or card number that can be used without a code, and a username or email address with the password or security question needed to access the account.
• A breach includes unauthorized access, not only acquisition.
• Small businesses (below set employee, revenue or asset levels) must still keep safeguards, scaled to their size and the sensitivity of the data.

Affected New York residents must be notified of a breach. There is no private right of action; the Attorney General enforces.

The Attorney General can seek injunctions and civil penalties. For failures to notify, penalties are set per failed notification up to a statutory cap; for failures to keep reasonable safeguards, the Attorney General can seek civil penalties per violation under 899-bb.

1. Find where you hold New York residents' private information, including account credentials.
2. Document your safeguards against the administrative, technical and physical examples in 899-bb.
3. Designate an employee to coordinate the security program.
4. Add the 30-day limit and the New York regulator notices to your breach playbook.
5. If you are regulated under GLBA, HIPAA or NYDFS Part 500, keep evidence of that compliance; it counts as compliance with the safeguards requirement.