Share on LinkedInShare on LinkedIn

ARTICLE · 22 DECEMBER 2022

New York Regulator Says Even One Access Control Failure Can Invalidate Years Of Compliance Certifications

Frankfurt Kurnit Klein & Selz PC
Frankfurt Kurnit Klein & Selz PC
Contributor
Frankfurt Kurnit Klein & Selz PC

Frankfurt Kurnit Klein & Selz PC

Founded more than 40 years ago as a boutique law firm servicing the entertainment and arts...

View firm profile
Explore more from Frankfurt Kurnit Klein & Selz PC

The New York Department of Financial Services ("NYDFS") recently entered into a Consent Order with EyeMed Vision Care LLC over violations of the agency's Cybersecurity Requirements.

United StatesTechnology

The New York Department of Financial Services ("NYDFS") recently entered into a Consent Order (the "Consent Order") with EyeMed Vision Care LLC ("EyeMed") over violations of the agency's Cybersecurity Requirements (23 NY CRR Part 500) ("Part 500"). NYDFS alleged that EyeMed's actions contributed to "exposure of hundreds of thousands of consumers' sensitive, non-public, personal health data, including data concerning minors." Under the Consent Order, EyeMed was required to pay $4.5 million, one of the highest penalties ever assessed by NYDFS for Part 500 violations. The Consent Order arguably expands current regulatory requirements for NYDFS-covered entities. Given the widespread recognition of NYDFS as a leader in cybersecurity regulation -- including adoption by the FTC of NYDFS-based requirements in revisions to the Gramm-Leach-Bliley Act Safeguards Rule – the Consent Order may serve as a precedent for other privacy and data security regulators. Here's

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

www.fkks.com

This post first appeared in Frankfurt Kurnit's Focus on the Data blog (www.focusonthedata.com). It provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.

Originally published by the New York Legal Ethics Reporter

www.fkks.com

This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.

www.fkks.com

This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.

See more popular content from