{"id":11672,"date":"2019-10-23T10:30:19","date_gmt":"2019-10-23T14:30:19","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11672"},"modified":"2019-10-31T11:05:22","modified_gmt":"2019-10-31T15:05:22","slug":"new-york-shield-act-the-latest-amendment-to-ny-states-cybersecurity-law","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/new-york-shield-act-the-latest-amendment-to-ny-states-cybersecurity-law\/","title":{"rendered":"New York SHIELD Act: The Latest Amendment to NY State\u2019s Cybersecurity Law"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">New York is updating their cybersecurity laws \u2014 here&#8217;s how these changes impact your business (even if you&#8217;re not in NY)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The New York SHIELD Act. It sounds like it something straight out of a popular superhero movie franchise. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, although it may share the name of an elite defense organization from the blockbuster movie series, the recently passed New York SHIELD Security Act is very real and may impact businesses inside and outside the state. It\u2019s an expansion of the existing <a rel=\"noreferrer noopener\" aria-label=\"New York data security law (opens in a new tab)\" href=\"https:\/\/its.ny.gov\/breach-notification\" target=\"_blank\">New York data security law<\/a> and General Business Law (<a href=\"https:\/\/www.nysenate.gov\/legislation\/laws\/GBS\/899-AA\">GBS \u00a7899-AA)<\/a>, and marks the creation of <a href=\"https:\/\/www.nysenate.gov\/legislation\/laws\/GBS\/899-BB\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"\u00a7GBS 899-BB (opens in a new tab)\">\u00a7GBS 899-BB<\/a>, by adding to the section on breach notifications, updating definitions, and adding new cybersecurity requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we\u2019ll dive into what the New York SHIELD\nAct is, how it affects your business, and what you can do to be compliant with\nthis update to the New York cybersecurity law. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avengers, assem \u2014 I mean&#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">New York SHIELD Act: What It Is and How It Applies to Me<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What the SHIELD Acronym Stands For<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The &#8220;SHIELD&#8221; in the New York <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.nysenate.gov\/legislation\/bills\/2019\/s5575\" target=\"_blank\">SHIELD Security Act<\/a> (Senate Bill S5575B) stands for \u201cStop Hacks and Improve Electronic Data.\u201d <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I wonder how much time they spent coming up with the full\nname for the act that would match that acronym\u2026<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What SHIELD Is<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Judgement-Line-Icon-Judge-Gav-298919902.jpg\" alt=\"Graphic: Gavel representing New York SHIELD Law\" class=\"wp-image-11334\" width=\"255\" height=\"255\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Judgement-Line-Icon-Judge-Gav-298919902.jpg 870w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Judgement-Line-Icon-Judge-Gav-298919902-300x300.jpg 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Judgement-Line-Icon-Judge-Gav-298919902-768x768.jpg 768w\" sizes=\"auto, (max-width: 255px) 100vw, 255px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The SHIELD Act is an expansion of the state\u2019s existing data breach law. Although it isn\u2019t poised to protect New Yorkers from an alien invasion, it does aim to protect the state\u2019s residents from personal and private information exposure due to cyber hacks. It does this by making the organizations they work for or do business with responsible for the safety and security of their data. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Should the information be exposed through intentional or\nunintentional disclosure, the organization must provide notice to any affected\nindividuals via: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>written notice, <\/li><li>electronic notice, <\/li><li>phone notification, or <\/li><li>another notification method (such as email, a\npublic posting, or an announcement via statewide media).<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The disclosure about the breach must be made expediently and\n\u201cwithout reasonable delay.\u201d However, there is one very important caveat. Notice\nto affected individuals is considered \u201cnot required\u201d if: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u2026 the exposure of private information was an inadvertent disclosure by persons authorized to access private information, and the person or business reasonably determines such exposure will not likely result in misuse of such information, or financial harm to the affected persons or emotional harm in the case of unknown disclosure of online credentials\u2026 Such determination must be documented in writing and maintained for at least five years. If the incident affects over five hundred residents of New York, the person or business shall provide the written determination to the state attorney general within ten days after the determination.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">The Act Covers Two Types of Info<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">What kinds of info does the New York SHIELD Act specify need protection? This information includes: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Personal Information.<\/strong> This refers to \u201cany\ninformation concerning a natural person which, because of name, number,\npersonal mark, or other identifier, can be used to identity such natural\nperson.\u201d <\/li><li><strong>Private Information.<\/strong> This includes a\nvariety of information such as a person\u2019s Social Security number, driver\u2019s\nlicense or another ID card number, financial or account related information\n(such as credit cards), or biometric information that\u2019s not encrypted or is\nencrypted \u201cwith an encryption key that has also been accessed or acquired.\u201d It\nalso includes users\u2019 login info.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Does the New York SHIELD Security Act Affect You?<\/h2>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Policeman-Yelling-Stop-Retro-17344970-1024x1003.png\" alt=\"Graphic: Whom the New York SHIELD Law applies to\" class=\"wp-image-11277\" width=\"183\" height=\"179\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Policeman-Yelling-Stop-Retro-17344970-1024x1003.png 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Policeman-Yelling-Stop-Retro-17344970-300x294.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/bigstock-Policeman-Yelling-Stop-Retro-17344970-768x752.png 768w\" sizes=\"auto, (max-width: 183px) 100vw, 183px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The Act applies to \u201cany person or business which [&#8230;] owns or licenses computerized data which includes private information.\u201d This means that if your business or organization has employees or customers who live in New York, this legislation may apply to you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If 5,000 or more New York residents are notified of such a\nbreach simultaneously, the organization also needs to report the \u201ctiming,\ncontent and distribution of the notices and approximate number of affected\npersons\u201d to consumer reporting agencies that the state attorney general\ndetermines pertinent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the event of a data breach, for example, companies whose customers or employees include New York residents must inform the state attorney general about the intentional or non-intentional info disclosure. However, the New York SHIELD Act specifies that companies that collect health-related data must take this a step further by reporting such breaches to federal authorities as well as the attorney general.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important Deadlines:<\/strong> The Act requires the recording\nof data breaches starting on Oct. 23, 2019, but the deadline for adopting\nreasonable security measures isn\u2019t until March 21, 2020. For organizations that\ndid not follow the New York Department of Financial Services (NYDFS)\nregulations previously, they must increase their protections by the March 21\ndeadline to avoid regulatory scrutiny. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means that if the NYDFS laws didn\u2019t affect your\nbusiness before but does now, you\u2019d better get your act in gear sooner rather\nthan later to ensure compliance. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the New York Data Security Act Specifies:<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to the New York SHIELD Act: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>This bill broadens the scope of information covered under the notification law and updates the notification requirements when there has been a breach of data. It also broadens the definition of a data breach to include an unauthorized person gaining access to information. It also requires reasonable data security, provides standards tailored to the size of a business, and provides protections from liability for certain entities.\u201d<\/em> <\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">The new act of the cybersecurity law defines boundaries, security\nrequirements, enforcement, and consequences for employers who fail to follow\nthese standards and best practices. It also serves as an amendment of the\ngeneral business law and the state\u2019s technology law concerning notifications of\nsecurity breaches. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The text provides updated definitions for multiple terms,\nincluding \u201cpersonal information,\u201d \u201cprivate information,\u201d \u201cbreach of the\nsecurity of the system,\u201d and \u201cbiometric data.\u201d This is important as many\ncompanies are using biometric technology and data for employee authentication\nand time-management tasks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All of this is great news for consumers \u2014 except for one important caveat: The Act doesn\u2019t create a private right of action for affected residents. Much like the <a href=\"https:\/\/www.thesslstore.com\/blog\/10-data-privacy-and-encryption-laws-every-business-needs-to-know\/\">California Consumer Privacy Act<\/a> (CCPA), enforcement of the New York SHIELD Act is provided by the state attorney general\u2019s office. This means that if someone is financially or personally affected by the disclosure of their information, it\u2019s up to the state\u2019s attorney general to bring action in their name and on behalf of the state\u2019s population.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But what are the risks for businesses who are not compliant\nwith the new SHIELD Act?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Consequences of Noncompliance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Although the New York data security act isn\u2019t enforced by\nindividuals in robotic suits or colorful, star-spangled uniforms, it\u2019s still\ntrying to stand as an imposing force. If you\u2019re a small to midsize business\nthat handles New York residents\u2019 data, you especially need to take it seriously\n\u2014 or else it can cost you dearly. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If an organization doesn\u2019t comply with the regulation by\nnotifying their employees or customers of any disclosures, the new legislation\nstates that preliminary relief may be granted (under Article 63 of the civil\npractice law and rules) to the victim. If any New York resident who is entitled\nto notification of an information disclosure doesn\u2019t receive one but suffers\nlosses or damages as a result of the disclosure, the court can award damages\nfor actual costs or financial losses they incur. Furthermore: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>Whenever the court shall determine in such action that a person or business violated this article&nbsp; knowingly or recklessly,&nbsp; the court may impose a civil penalty of the greater of five thousand dollars or up to [ten] TWENTY dollars per instance of failed notification, provided that the latter amount shall not exceed [one] TWO hundred fifty thousand dollars.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Penalties of $5,000 may not be a big deal. But considering\nthat it can be up to $250,000, now we\u2019re talking some serious dough for small\nbusinesses.&nbsp; While this won\u2019t make much\nof a dent in the coffers of an enterprise, it can cause a small or midsize organization\nto close its doors.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How You Can Make Your Business Compliant with the SHIELD Security Act<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To comply with the new act, businesses of all sizes need to\nassess their existing IT infrastructure, resources, devices, policies, and\naccess controls. For example, to ensure your organization is compliant and to\nreduce the risk of data exposure: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Check for Vulnerabilities.<\/strong> Review and\ntest your network, devices, and other IT systems for any internal and external\nvulnerabilities. This can include performing cyber risk assessments and\npenetration tests. Perform your due diligence to mitigate risks ahead of time. &nbsp;<\/li><li><strong>Review and Implement Access Control.<\/strong>\nRegularly review and update your list of employees to determine who has access\nto what, and whether each person\u2019s level of access is necessary based on their\njob and responsibilities. Minimize the number of users with access to personal\nand private data to only those who need it. This can include the use of\npolicies of least privilege (POLP).<\/li><li><strong>Review and Update Your Existing Policies and\nProcedures.<\/strong> To ensure that your organization is prepared to respond to a\ndata breach, be sure to review and update your existing incident response (IR)\nand disaster recovery (DR) plans. If your organization doesn\u2019t have any such\nplans, now\u2019s the time to create them!<\/li><li><strong>Implement Cyber Training for Employees.<\/strong>\nEnsure that all of your employees \u2014 everyone from the CEO on down to the\njanitorial staff \u2014 are operating with cyber security best practices in mind.\nTraining also can provide them with knowledge about how to safely identify and\nrespond to potential threats such as phishing emails. <\/li><li><strong>Review How You Store and Dispose of Private\nInformation.<\/strong> This SHIELD New York data security law dictates that when\nyou\u2019re done using personal and private data, you can\u2019t just get rid of it any\nol\u2019 way. It specifies that businesses must assess risks relating to information\nprocessing, transmission and storage. It also states that you need to dispose\nof private information \u201cwithin a reasonable amount of time after it is no\nlonger needed for business purposes by erasing electronic media so that the\ninformation cannot be read or reconstructed.\u201d<\/li><li><strong>Implement Encryption.<\/strong> When dealing with sensitive\nprivate and personal information, it\u2019s generally a best practice (and a smart\nbusiness move in general) to use encryption to help keep that info secure. Use\nSSL\/TLS certificates to protect data in transit on your website or mail server.\nS\/MIME certificates add the benefit of encrypting data at rest to secure data when\nit sits on your server. Another great encryption method includes database\nencryption. These tools can help you to ensure that only the people who are <em>supposed<\/em>\nto see information have access to it. <\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">TL;DR: What Does All of This Mean?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In a nutshell, the New York SHIELD Act specifies that companies that handle, store, or use New York residents\u2019 personal and private information are required to implement specific data security measures and to report any breaches within a timely manner (or risk facing enforcement from the state\u2019s attorney general). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The New York SHIELD Act dictates that organizations with\nexisting security protections will need to improve their assessment standards\nand tools. Employers and companies who lack any type of security systems and\ntesting practices will be required to adopt a new security infrastructure. Any\norganizations that fail to do so could face civil penalties that cost up to\n$250,000. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, there are things you can do to protect your\norganization, employees, and customers:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Run cyber risk assessments and pen tests to\nidentify vulnerabilities.<\/li><li>Maintain up-to-date employee access lists.<\/li><li>Review and update any existing policies and\nprocedures; create new ones as necessary.<\/li><li>Make cyber awareness training mandatory for all\nemployees. <\/li><li>Assess risks in information processing and use\nproper data storage and disposal techniques.&nbsp;\n<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"> We hope that this article provided you with useful insights about the New York SHIELD Act that you can use to make important decisions for your business and best serve your customers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> <em>As always, leave any questions or thoughts in the comments! <\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New York is updating their cybersecurity laws \u2014 here&#8217;s how these changes impact your business (even if you&#8217;re not in NY) The New York SHIELD Act. It sounds like it&#8230;<\/p>\n","protected":false},"author":17,"featured_media":11674,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200],"tags":[10177,8030,11309,267],"class_list":["post-11672","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","tag-cybersecurity","tag-data-privacy","tag-laws","tag-privacy","post-with-tags"],"views":15310,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/MarvelSHIELD-lr.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=11672"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11672\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11674"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=11672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=11672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=11672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}