New Update to the New York Data Security Requirements

Earlier this week, the New York Legislature passed the Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”). This bill is intended to build upon the existing data breach notification law and add new requirement for data custodians in the private and public sectors to institute reasonable measures to safeguard sensitive consumer data of New York residents. The SHIELD Act is meant to amend and broaden the existing breach notification law that was enacted in 2005. This law is intended to affect any person or business that collects private information of any New York resident. It will expand the types of data that is considered private information. It will impose a new requirement for persons or businesses collecting private information to implement reasonable security measures to protect and/or dispose of data. It will revise the 2005 law’s data breach disclosure provisions. Finally, it will remove the current requirement that the data collector has to conduct business in New York before being subject to the law.