New York Passes Expansive New Cybersecurity Law

On July 25, 2019, New York Governor Andrew Cuomo signed into law the Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act" or the "Act"), which expands data breach notification obligations under New York law and for the first time imposes affirmative cybersecurity obligations on covered entities.

The Act makes five principal changes to existing New York law:

1. Expanding the law's jurisdiction to entities that maintain private information of New York residents, regardless of whether or not such entities actually conduct business within the State;
2. Broadening the scope of "private information" triggering notification obligations in the event of a breach, including to biometric data;