The New York SHIELD (Stop Hacks and Improve Electronic Data Security) Act

What are the SHIELD Act’s data breach notification requirements?

The data breach notification part of the Act, amending New York General Business Laws, Article 39F, Section 899-AA, takes effect on October 23, 2019. It builds on the existing data breach notification law by:

Expanding the definition of ‘private information’ so that it now includes:

• Personal information (“information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person”) combined with one or more of the following data elements:
  • Social Security number
  • Driver’s license number or non-driver identification card number
  • Account number, or credit or debit card number, in combination with any required security code, access code, password, or other information that would permit access to an individual’s financial account
  • Account number, or credit or debit card number, if it is possible the number could be used to access an individual’s financial account without additional identifying information, security code, access code, or password
  • Biometric information or other unique physical representation or digital representation of biometric data that are used to authenticate or ascertain the individual’s identity
• A username or email address in combination with a password or security question and answer that would permit access to an online account

Extending the definition of a breach to include unauthorized access to private information as well as unauthorized acquisition.

Increasing the scope of the statute to include any person or business – irrespective of whether they conduct business in New York state – that owns or licenses computerized data that includes the private information of a New York resident

New York state residents

New York state residents whose private information has been, or is reasonably believed to have been, accessed or acquired by a person without valid authorization must be notified as soon as possible and without unreasonable delay, using one or more of four methods:

1. Written notice
2. Electronic notice (unless the security of the email was breached)
3. Telephone
4. Substitute notice if more than 500,000 people were affected

Notification must include all of the following:

• Contact information for the person or business making the notification
• The telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identity theft prevention and protection information
• A description of the categories of information that were, or are reasonably believed to have been, accessed or acquired without valid authorization, including specifying which elements of personal information and private information were, or are reasonably believed to have been, accessed or acquired

Notification is not required for accidental disclosure by individuals who were authorized to access it if the business “reasonably determines such exposure will not likely result in misuse”, or financial or emotional harm.

Meeting your SHIELD Act obligations

Complying with the information security aspect of SHIELD can be best achieved with the international standard ISO 27001 and its code of practice ISO 27002, or with NIST SP 800-53.

ISO 27001 sets out the requirements for an ISMS (information security management system), an organization-wide approach to information security that encompasses people, processes, and technology, and can be aligned with the SHIELD Act, as well as a host of other laws, including the CCPA (California Consumer Privacy Act) and the EU’s GDPR (General Data Protection Regulation).

Independently audited certification to the Standard is accepted around the world as proof that an organization has implemented and maintains information security best practice.

If ISO 27001 certification is achieved, any cybersecurity breach would not be subject to prosecution by the attorney general under the SHIELD Act unless there is evidence of “willful misconduct, bad faith, or gross negligence” on the part of the business that processes the information.

Find out more about ISO 27001 and ISO 27002 >>