NY Shield Act

What is the NY shield act? Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”)

The SHIELD Act requires any person or business owning or licensing computerized data that includes the private information of a resident of New York (“covered business”) to implement and maintain reasonable safeguards to protect the security, confidentiality, and integrity of the private information.

Who does NY Shield apply to?
The SHIELD Act applies to organizations inside and outside of New York. For example, a restaurant in Brooklyn and an entrepreneur collecting emails from leads are both required to comply with the SHIELD Act. If the entrepreneur has just one lead from New York, they are legally bound by the Act.

What is the significance of this law?
The SHIELD Act, signed into law on July 25, 2019 by Governor Andrew Cuomo, amends New York’s 2005 Information Security Breach and Notification Act. The Shield Act significantly strengthens New York’s data security laws by expanding the types of private information that companies must provide consumer notice in the event of a breach, and requiring that companies develop, implement, and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information.

What types of security breaches are covered by this law?
Under the 2005 law, a security breach is defined as an unauthorized acquisition of computerized data which compromises the security, confidentiality or integrity of private information. The SHIELD Act expands the definition of a security breach to any “access” to computerized data that compromises the confidentiality, security, or integrity of private data.

Who must comply with shield?
Less than fifty employees. Less than three million dollars in gross annual revenue in each of the last three fiscal years. Less than five million dollars in year-end total assets, calculated in accordance with generally accepted accounting principles (GAAP)