New York State Passes Bill To Expand Data Breach Notification Requirements

The New York State legislature passed the "Stop Hacks and Improve Electronic Data Security Act" (the "SHIELD Act") to enhance cybersecurity protections for New York residents by expanding the state's existing data breach notification requirements.

The legislation:

• widens the definition of "private information" to include biometric data, a username or email address, and a password, or security questions and answers that would permit access to an online account;

• expands the definition of "data breach" to include unauthorized access to private information on a data system, even if such private information is not stolen;

• extends the breach notification requirement to include any person or entity that owns or licenses computerized data that includes private information, even in the absence of a New York business enterprise;