ARTICLE
29 August 2019

New York SHIELD Act Expands Breach Notice Requirements Starting In October

SM
Sheppard Mullin Richter & Hampton

Contributor

Sheppard Mullin is a full service Global 100 firm with over 1,000 attorneys in 16 offices located in the United States, Europe and Asia. Since 1927, companies have turned to Sheppard Mullin to handle corporate and technology matters, high stakes litigation and complex financial transactions. In the US, the firm’s clients include more than half of the Fortune 100.
As we recently reported, New York's new SHIELD Act contains data security provisions. It also contains a number of key changes to New York's
United States Privacy

As we recently reported, New York's new SHIELD Act contains data security provisions. It also contains a number of key changes to New York's existing breach notification obligations. These changes will become effective October 23, 2019.

As amended, the scope of private information which, if breached, may trigger notification obligations to individuals will be broadened. Added to the existing definition of private information will be biometric information, username in combination with a password or security question and answer that permits access to an online account, and an account number or credit or debit card numbers without additional identifying information if the number can be used to access an individual's financial account. The amendment similarly broadens the definition of a breach, which will now include "access" alone to triggering information (as opposed to the prior definition which limited a breach to "acquisition of" triggering information). In determining whether unauthorized access has occurred, the SHIELD Act now explains that businesses may consider "indications that the information was viewed, communicated with, used or altered."

Companies who determine that misuse or financial harm is unlikely do not need to notify, but must document that determination and maintain it for at least 5 years. However, if the incident involves over 500 New York residents, the company will have to submit that determination in writing to the attorney general within ten days after making such a determination. The law also contains some minor additional modifications, like including in any consumer notice the phone number and website of the relevant state and federal agencies that provide information on security breach response and identity theft prevention and protection information.

Putting it Into Practice: Companies that maintain a nationwide breach notice plan will want to take into account these updates to the NY notice requirements, including the expanded scope of triggering information and the definition of a "breach."

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More