New York State Doubles Down On Data Privacy, Sets High Bar For "Reasonable Safety Standards"

On July 25, 2019, New York governor Andrew Cuomo signed into law two bills aimed at increasing the obligations of entities handling computerized private data. The Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) expands the requirements for notifying affected parties in the event of a data breach and sets forth a demanding list of security measures that must be implemented to "maintain reasonable safeguards" to protect private information. Businesses handling the private data of New York residents should consider reviewing the SHIELD Act and existing policies and procedures to ensure compliance before the new privacy requirements go into effect.

The SHIELD Act amends New York's existing data breach notification law in the following ways: