New York State Governor Signs Bills Expanding Data Breach Notification Requirements

On Friday, July 26, 2019, New York Governor Andrew Cuomo signed two bills into law designed to enhance cybersecurity protections for New York residents. The legislation updates New York's data breach notification law.

The "Stop Hacks and Improve Electronic Data Security Act" (the "SHIELD Act") was created to enhance cybersecurity protections for New York residents by expanding the state's existing data breach notification requirements. Specifically, the legislation:

• widens the definition of "private information" to include biometric data, a username or email address and a password, or security questions and answers that would permit access to an online account;
• expands the definition of "data breach" to include unauthorized access to private information on a data system, even if such private information is not stolen;