Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison & Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison & Foerster. If you are not already a client of Morrison & Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

New York is the latest state to expand its breach notification law with the Stop Hacks and Improve Electronic Data Security (SHIELD) Act, signed into law by Governor Andrew Cuomo on July 25, 2019. A number of the key changes that the law ushers—including broadening the definitions of both personal information (PI) and data breach, expanding the scope of covered entities subject to breach notification requirements, and imposing data security standards—are reminiscent of similar provisions in other states’ breach laws.

New York State Enacts More Stringent Breach Notification Law

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

New York is the latest state to expand its breach notification law with the Stop Hacks and Improve Electronic Data Security (SHIELD) Act, signed into law by Governor Andrew Cuomo on July 25, 2019. A number of the key changes that the law ushers—including broadening the definitions of both personal information (PI) and data breach, expanding the scope of covered entities subject to breach notification requirements, and imposing data security standards—are reminiscent of similar provisions in other states’ breach laws. Amidst a historically disparate patchwork of state laws, these commonalities may signal coalescence around prevailing security and breach notification standards and a gradual shift toward increased uniformity.Most significantly, the SHIELD Act amends existing law to:<ul><li>Like Massachusetts, impose data security requirements. 
<ul><li>Covered entities must develop, implement, and maintain reasonable administrative, technical, and physical safeguards to protect and dispose of PI. </li><li>A small business—one with fewer than 50 employees, less than $3 million in annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets—will be deemed compliant if its data security program is appropriate in light of the size and complexity of the business, the nature and scope of its activities, and the sensitivity of the PI it collects.</li></ul></li></ul><ul><li>Like California, expand the definition of PI that triggers breach notification obligations.<ul><li>This includes biometric information, and user names or email addresses in combination with passwords or security questions and answers.</li></ul></li></ul><ul><li>Like Connecticut, expand the definition of a data breach to include unauthorized access to or acquisition of private information. 
<ul><li>In assessing whether personal information has been accessed, an entity may consider “indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person.”</li></ul></li></ul><ul><li>Like Illinois, apply the breach notification requirement to any person or entity that owns or licenses computerized PI of a state resident, not just to those conducting business in the state.  </li></ul><ul><li>Update notification procedures that entities must follow when there has been a breach involving PI. 
<ul><li>In addition to previously required contents, notices to affected individuals must now include the telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identity theft prevention and protection information.</li><li>In the event that any New York residents are to be notified of a breach, an entity must now notify the Office of Information Technology Services (in addition to the state attorney general and Department of State) and must now furnish a copy of the template of the notice that was sent to affected individuals.</li></ul></li></ul><ul><li>Provide for exceptions to breach notification requirements. 
<ul><li>Risk of Harm Exception: Notice is not required in the case of inadvertent disclosures of PI that are unlikely to result in misuse of the data or financial or emotional harm to the affected individual. However: 
<ul><li>Such a determination must be documented in writing and maintained for a period of at least five years; and</li><li>If the security incident affects more than 500 New York residents, the written determination must be provided to the New York Attorney General within ten days of the determination. </li></ul></li><li>Redundant Notice Exception: Separate notice is not required when notice has already been provided pursuant to certain other federal or state laws, including HIPAA, Gramm-Leach-Bliley Act (GLBA), and the Health Information Technology for Economic and Clinical Health Act (HITECH).</li></ul></li></ul><ul><li>Increase the civil penalties that the attorney general may impose in an enforcement action, to the greater of $5,000 or $20 per instance of failed notification, not to exceed $250,000.</li></ul>The law’s data security provisions take effect on March 21, 2020 (240 days after enactment), while the remainder of its provisions take effect on October 23, 2019 (90 days after enactment).Governor Cuomo signed another bill, A.5635B/S.5575B, which requires credit reporting agencies (CRAs) to offer identity theft prevention and, if applicable, mitigation services following a breach of its security system that exposes consumers’ Social Security numbers. Under the law, which takes effect on September 23, 2019 (60 days from enactment), CRAs are required to provide these services to affected consumers free of charge for a period not to exceed five years.