New York Cybersecurity Requirements and the SHIELD Act
New York State’s new law, the SHIELD Act, strengthens data breach reporting requirements and requires “reasonable security”. Here is a brief summary of what the law is and what it means for businesses that are within New York, or hold personal information of New York residents.
The NYS SHIELD Act (“Stop Hacks and Improve Electronic Data Security Act”) was signed into law on July 25, 2019 by Governor Cuomo. It amends the New York State General Business Law (GBL) Article 39-F, Section 899-aa (titled: Notification; person without valid authorization has acquired private information), and creates Section 899-bb (Data security protections).
The SHIELD Act amendment of the GBL 899-aa notification requirements went into effect on October 23, 2019. This strengthened the data breach reporting requirements, closed loopholes, and provided important definitions of “personal information”, “private information”, and “ breach of the security of the system”. A breached organization must report to multiple New York state agencies (state attorney general, state department of state, and state police). Reporting requirements of other states might apply also.
The SHIELD Act imposed the new data security requirements of GBL 899-bb, which go into effect on March 21, 2020. This essentially requires “reasonable” cybersecurity and information security. This includes reasonable administrative, technical, and physical safeguards, and provides examples of what these safeguards (also known as “controls”) might be.
If your organization does not have a cybersecurity program, or is not familiar with any of these safeguards, it is time to get started with improving your cybersecurity. The new law is but one of many reasons to do this. Though the term “reasonable” may seem vague, it is a well used term in the legal system, recognizing that many factors go into good decision making.
The law (at first) seems to provide special treatment to small businesses, with a special definition and sub-section devoted to them, and with criteria to consider when evaluating what is “reasonable”. Perhaps this shows some legislative intent to minimize their burden. In reality, every business, whether small, medium, or large, needs to evaluate many factors, assess risk, and determine what is reasonable. Factors include threats, potential harms, data possessed, information technology systems, business size, and more.
Organizations that are already regulated and subject to cybersecurity requirements (such as the financial sector and health sector) are deemed to be in compliance with the SHIELD Act if they are fully compliant with that regulation. The statute calls such an organization a “compliant regulated entity”. Since the SHIELD Act’s cybersecurity requirements are relatively basic, such organizations may choose to affirmatively demonstrate compliance with it separately. It is worth mentioning that New York has a more complex cybersecurity requirement specific to the financial sector, Cybersecurity Requirements for Financial Services Companies, 23 NYCRR 500 (also known as Rule 500, within the New York Codes, Rules and Regulations). This regulation is issued and enforced by the New York State Department of Financial Services (DFS).
Cybersecurity regulations and laws are increasing. Organizations need to comply, but importantly need to protect themselves, their customers, and employees from cybercrime threats. Government should work to streamline reporting, recognize the reporting burdens of the fifty states, and ensure enforcement of these laws is fair and promotes accurate investigation and reporting of incidents.
This is a brief summary with simplifications, and tries to bring complex subject matter to the reader in an understandable and accessible manner. It is not legal advice nor consulting advice, and is not tailored to your circumstances.
If you or your organization needs help with cybersecurity or cybersecurity compliance, see my services page.
If you want to read more about cybersecurity, information security, cybercrime investigations, see my book and articles page.
New York’s new SHIELD Act full text is available at https://www.nysenate.gov/legislation/bills/2019/s5575
SHIELD Act provisions are found within the General Business Law (GBL) sections 899-aa and 899-bb, available at https://www.nysenate.gov/legislation/laws/GBS/899-AA and https://www.nysenate.gov/legislation/laws/GBS/899-BB
New York State Department of Financial Services (DFS) issued 23 NYCRR 500, Cybersecurity Requirements for Financial Services Companies, found at https://www.dfs.ny.gov/docs/legal/regulations/adoptions/dfsrf500txt.pdf
The Cybersecurity Article to Read Now by John Bandler, published by ACAMSToday.org, October 23, 2018.
Prepare for and plan against a cyberattack by John Bandler, published by the American Bar Association Journal, July 2018.
Written 1/14/2020. Last updated 1/15/2020.
Main article also available on Medium.com at https://medium.com/@johnbandler/new-york-cybersecurity-requirements-and-the-shield-act-2c3527c10244