New York AG Backs 'Modern' Data Breach Protection Act Passed by State Legislature
The act's measure applies the state's data-breach notification requirement to any person or entity with a state resident's private information, instead of applying it only to those conducting business in the state. The bill now moves to Gov. Andrew Cuomo's desk.
June 19, 2019 at 11:48 AM
3 minute read
The original version of this story was published on New York Law Journal
State lawmakers have passed legislation that would “modernize” and update consumer data protections and expand New York Attorney General Letitia James' oversight of data breaches affecting New Yorkers, according to a news release issued by James “applauding” the act's passage.
Called the “Stop Hacks and Improve Electronic Data Security Act,” or SHIELD Act, the bill now moves to Gov. Andrew Cuomo's desk for his decision on whether to sign it into law.
The legislation, first introduced by the Attorney General's Office in 2017 after the Equifax Inc. data breach compromised some 145.5 million Americans' personal information, includes a number of measures aimed at enhancing protections for New Yorkers, including applying the state's data breach notification requirement to any person or entity with a state resident's private information, instead of applying it only to those conducting business in the state, James' office said.
In addition, the act broadens the definition of a data breach to include unauthorized persons who gain access to private information, rather than using the current “acquired standard,” the news release said. The legislation also expands the scope of information subject to the state's notification law to include biometric information, email addresses and corresponding passwords, or security questions and answers.
“[M]y office has been working hard this session to modernize our outdated laws governing data breaches,” James said in the news release. “This bill is an important step forward providing greater protection for consumer's private information and holding companies accountable for securing that data.”
The news release noted that under current law, entities that collect private information must give notice to the Attorney General's Office when there is a data breach, as the office is the lone enforcer of the state's data breach law found in General Business Law 899-aa.
James' office then said that “given the evolution of how individuals use and disseminate private information, the Office of the Attorney General submitted the SHIELD Act as an agency program bill in order to update the current statute to keep pace.”
The act was first introduced under former Attorney General Eric Schneiderman following the massive Equifax breach, which reportedly compromised the personal information of more than 8 million New Yorkers.
James' office further noted that if the legislation is made into law, New York would join an “increasing number of states that require reasonable data security protections, while being careful to avoid excessive costs to small business and without imposing duplicate obligations under federal or state data security regulations.”
The act's data security requirements are “tailored to the size of a business,” the release said.
“The SHIELD Act will put strong safeguards in place to curb data breaches and identity theft,” said Justin Brookman, director of privacy and technology policy for Consumer Reports, in James' news release.
He added, “This is a big win in the fight to improve data security for the people of New York, and it helps build momentum for reforms nationwide.”
The legislative sponsors for the bill were state Sen. Kevin Thomas and Assemblymen Michael DenDekke, the news release said.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllJAMS Launches Initiative to Leverage AI Technology in Dispute Resolution
To Woo Law Firms, Legal Training Platforms Are Combining Hands-On and Online Learning
The American Arbitration Association Unveils Gen AI-Powered Panelist Search Tool
UnitedLex Appoints GC Renee Meisel as New CEO, Replacing James Schellhase After Short Tenure
Trending Stories
Who Got The Work
Dechert partners Andrew J. Levander, Angela M. Liu and Neil A. Steiner have stepped in to defend Arbor Realty Trust and certain executives in a pending securities class action. The complaint, filed July 31 in New York Eastern District Court by Levi & Korsinsky, contends that the defendants concealed a 'toxic' mobile home portfolio, vastly overstated collateral in regards to the company's loans and failed to disclose an investigation of the company by the FBI. The case, assigned to U.S. District Judge Pamela K. Chen, is 1:24-cv-05347, Martin v. Arbor Realty Trust, Inc. et al.
Who Got The Work
Arthur G. Jakoby, Ryan Feeney and Maxim M.L. Nowak from Herrick Feinstein have stepped in to defend Charles Dilluvio and Seacor Capital in a pending securities lawsuit. The complaint, filed Sept. 30 in New York Southern District Court by the Securities and Exchange Commission, accuses the defendants of using consulting agreements, attorney opinion letters and other mechanisms to skirt regulations limiting stock sales by affiliate companies and allowing the defendants to unlawfully profit from sales of Enzolytics stock. The case, assigned to U.S. District Judge Andrew L. Carter Jr., is 1:24-cv-07362, Securities and Exchange Commission v. Zhabilov et al.
Who Got The Work
Clark Hill members Vincent Roskovensky and Kevin B. Watson have entered appearances for Architectural Steel and Associated Products in a pending environmental lawsuit. The complaint, filed Aug. 27 in Pennsylvania Eastern District Court by Brodsky & Smith on behalf of Hung Trinh, accuses the defendant of discharging polluted stormwater from its steel facility without a permit in violation of the Clean Water Act. The case, assigned to U.S. District Judge Gerald J. Pappert, is 2:24-cv-04490, Trinh v. Architectural Steel And Associated Products, Inc.
Who Got The Work
Michael R. Yellin of Cole Schotz has entered an appearance for S2 d/b/a the Shoe Surgeon, Dominic Chambrone a/k/a Dominic Ciambrone and other defendants in a pending trademark infringement lawsuit. The case, filed July 15 in New York Southern District Court by DLA Piper on behalf of Nike, seeks to enjoin Ciambrone and the other defendants in their attempts to build an 'entire multifaceted' retail empire through their unauthorized use of Nike’s trademark rights. The case, assigned to U.S. District Judge Naomi Reice Buchwald, is 1:24-cv-05307, Nike Inc. v. S2, Inc. et al.
Who Got The Work
Sullivan & Cromwell partner Adam S. Paris has entered an appearance for Orthofix Medical in a pending securities class action arising from a proposed acquisition of SeaSpine by Orthofix. The suit, filed Sept. 6 in California Southern District Court, by Girard Sharp and the Hall Firm, contends that the offering materials and related oral communications contained untrue statements of material fact. According to the complaint, the defendants made a series of misrepresentations about Orthofix’s disclosure controls and internal controls over financial reporting and ethical compliance. The case, assigned to U.S. District Judge Linda Lopez, is 3:24-cv-01593, O'Hara v. Orthofix Medical Inc. et al.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250