A Primer On The SHIELD Act: New York's Move To Adopt More Stringent Data Security Requirements, Part II

What would companies need to do to comply with the law?

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act imposes requirements in two areas: cybersecurity and data breach notification. The cybersecurity provisions of the proposed SHIELD Act would require companies to adopt "reasonable safe-guards to protect the security, confidentiality and integrity" of private information. The Act provides examples of appropriate administrative, technical, and physical safeguards, such as designating an employee to oversee the company's data security program; identifying "reasonably foreseeable" risks to data security; selecting vendors that can maintain appropriate safeguards; detecting, preventing and responding to attacks and system failures; and preventing unauthorized access to private information.