Cassie Lentchner: New York's ‘Shield Act' Breaks New Ground On Cybersecurity Policy

The privacy and data security law being implemented in New York may be overshadowed by regulations in California and the European Union, but should be recognized as one of the most significant cybersecurity statutes to date, said Pillsbury special counsel Cassie Lentchner, a former chief compliance officer for the New York State Department of Financial Services.

“The [General Data Protection Regulation] and [California Consumer Privacy Act] are important laws and they give important privacy rights to consumers, but they don't specifically require companies to create a cybersecurity program,” as the New York law does, Lentchner said.

The reach of the Shield Act is extensive, applying to any company with data on a New York resident rather than only to companies that do business in the state, the standard set in an earlier law. The measure was signed on July 25 and will be implemented in two parts.