{"id":19961,"date":"2019-07-30T12:23:45","date_gmt":"2019-07-30T16:23:45","guid":{"rendered":"https:\/\/www.elteni.com\/?p=16814"},"modified":"2019-07-30T12:23:45","modified_gmt":"2019-07-30T16:23:45","slug":"new-york-state-shield-stop-hacks-and-improve-electronic-data-security-act","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=19961","title":{"rendered":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT"},"content":{"rendered":"<p>New York State SHIELD (Stop Hacks and Improve Electronic Data Security) will go into Effect March 21, 2020. This gives businesses a little less than nine months to become familiar with it and prepare for it entails.<\/p>\n<p>What is the SHIELD Act? The Stop Hacks and Improve Electronic Data Security (SHIELD) Act redefines data security and data breach notification requirements for businesses. The goal of the Act is to ensure New York residents are better protected against data breaches of their personal information.<\/p>\n<p>In New York\u2019s original \u201cInformation Security Breach and Notification Act, which was effective December 7, 2005, residents had the right to know when a security breach resulted in the exposure of their private information. Private information was defined as \u201cany personal information concerning a natural person in combination with any one or more of the following data elements: social security number, driver\u2019s license number, account number, or credit or debit card number in combination with any required security code.\u201d<\/p>\n<p>The SHIELD Act expands the definition of \u201cprivate information\u201d which sets forth the data elements that, if breached, could trigger a notification requirement. Under the amended law, \u201cprivate information\u201d means either:<\/p>\n<ul>\n<li>personal information consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:<\/li>\n<li>social security number;<\/li>\n<li>driver\u2019s license number or non-driver identification card number;<\/li>\n<li>account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual\u2019s financial account; account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual\u2019s financial account without additional identifying information, security code, access code, or password; or<\/li>\n<li>biometric information, meaning data generated by electronic measurements of an individual\u2019s unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual\u2019s identity; OR<\/li>\n<li>a username or e-mail address in combination with a password or security question and answer that would permit access to an online account.<\/li>\n<\/ul>\n<p><strong>It should be noted that &#8220;Private\u00a0 information&#8221; does not include publicly available information which is lawfully made available to the\u00a0 general\u00a0 public\u00a0 from\u00a0 federal, state, or local government records.<\/strong><\/p>\n<p>In the Act a &#8220;Breach\u00a0 of\u00a0 the\u00a0 security of the system&#8221; shall mean unauthorized ACCESS TO OR acquisition OF, or ACCESS TO OR acquisition\u00a0 without\u00a0 valid authorization,\u00a0 of\u00a0 computerized\u00a0 data\u00a0 that compromises\u00a0 the security, confidentiality, or integrity of [personal]\u00a0 PRIVATE\u00a0 information\u00a0 maintained\u00a0\u00a0 by\u00a0 a\u00a0 business.\u00a0 Good\u00a0 faith\u00a0 ACCESS\u00a0 TO,\u00a0 OR\u00a0 acquisition\u00a0 of [personal], PRIVATE information by an employee or agent of the\u00a0 business for\u00a0 the purposes of the business is not a breach of the security of the system, provided that the private information is not used or subject to unauthorized disclosure.\u201d Simply put, if access was not granted to the data, it is considered a breach, however, if being used for valid business reasons, then its ok.<\/p>\n<p>So, who needs to comply with this? Any person or business that owns or license computerized data which includes private information of New York residents.<\/p>\n<p>There are some exemptions:<\/p>\n<ol>\n<li>If exposure of private information was inadvertent and is determined that it will not cause harm to the individual (by acting responsibly and being diligent in your assessment of this),<\/li>\n<li>Businesses regulated by other state and federal regulatory laws (GLBA, HIPAA, NY DFS). Though, they are still required to Notify the attorney general.<\/li>\n<\/ol>\n<p>Small businesses are subject to the reasonable safeguards requirement, however safeguards may be \u201cappropriate for the size and complexity of the small business, the nature and scope of the small business\u2019s activities, and the sensitivity of the personal information the small business collects from or about consumers.\u201d A small business is considered any business with fewer than fifty employees, less than $3 million in gross annual revenue in each of the last 3 years, or less than $5 million in year-end total assets\u2019<\/p>\n<p>Reasonable safeguards include:<\/p>\n<ul>\n<li>the implementation of a cybersecurity program<\/li>\n<li>ensure proper oversight of the cybersecurity program<\/li>\n<li>perform risk assessments<\/li>\n<li>conduct vulnerability assessments and penetration tests<\/li>\n<li>ensure your currents controls are effective<\/li>\n<li>perform data classification and inventory<\/li>\n<li>have a proper incident response framework<\/li>\n<li>proper removal and destruction of private data that is no longer needed<\/li>\n<li>evolve as the business and regulatory requirements change.<\/li>\n<\/ul>\n<p>Are there penalties? Yes, for data breach notification violations that are not intentional, the court may award damages for actual costs or losses incurred by the affected person, including substantial financial losses. For intentional or irresponsible breaches, the court may impose penalties of the greater of $5000 dollars or up to $20 per instance with a cap of $250,000. For reasonable safeguard requirement violations, the court may impose penalties of no more than $5,000 per violation.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>New York State SHIELD (Stop Hacks and Improve Electronic Data Security) will go into Effect March 21, 2020. This gives businesses a little less than nine months to [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":19687,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[29,44,30,50,51,52,53,54,55],"class_list":["post-19961","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","tag-breach","tag-cyber","tag-cybersecurity","tag-incident-response","tag-law","tag-notification","tag-penetration-testing","tag-risk-assessment","tag-vulnerability-testing"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.elteni.com\/insights\/?p=19961\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights\" \/>\n<meta property=\"og:description\" content=\"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) will go into Effect March 21, 2020. This gives businesses a little less than nine months to [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.elteni.com\/insights\/?p=19961\" \/>\n<meta property=\"og:site_name\" content=\"Insights\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-30T16:23:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2500\" \/>\n\t<meta property=\"og:image:height\" content=\"1607\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Elteni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elteni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961\"},\"author\":{\"name\":\"Elteni\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"headline\":\"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT\",\"datePublished\":\"2019-07-30T16:23:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961\"},\"wordCount\":844,\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/3633.jpg\",\"keywords\":[\"Breach\",\"Cyber\",\"Cybersecurity\",\"Incident Response\",\"Law\",\"Notification\",\"Penetration Testing\",\"Risk Assessment\",\"Vulnerability Testing\"],\"articleSection\":[\"Cyber\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961\",\"name\":\"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/3633.jpg\",\"datePublished\":\"2019-07-30T16:23:45+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#primaryimage\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/3633.jpg\",\"contentUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/08\\\/3633.jpg\",\"width\":2500,\"height\":1607,\"caption\":\"SHIELD ACT\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19961#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.elteni.com\\\/insights\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/\",\"name\":\"Insights\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\",\"name\":\"Elteni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"caption\":\"Elteni\"},\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.elteni.com\/insights\/?p=19961","og_locale":"en_US","og_type":"article","og_title":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights","og_description":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) will go into Effect March 21, 2020. This gives businesses a little less than nine months to [&hellip;]","og_url":"https:\/\/www.elteni.com\/insights\/?p=19961","og_site_name":"Insights","article_published_time":"2019-07-30T16:23:45+00:00","og_image":[{"width":2500,"height":1607,"url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg","type":"image\/jpeg"}],"author":"Elteni","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Elteni","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.elteni.com\/insights\/?p=19961#article","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961"},"author":{"name":"Elteni","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"headline":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT","datePublished":"2019-07-30T16:23:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961"},"wordCount":844,"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg","keywords":["Breach","Cyber","Cybersecurity","Incident Response","Law","Notification","Penetration Testing","Risk Assessment","Vulnerability Testing"],"articleSection":["Cyber"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.elteni.com\/insights\/?p=19961","url":"https:\/\/www.elteni.com\/insights\/?p=19961","name":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT - Insights","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961#primaryimage"},"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg","datePublished":"2019-07-30T16:23:45+00:00","author":{"@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"breadcrumb":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19961#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.elteni.com\/insights\/?p=19961"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.elteni.com\/insights\/?p=19961#primaryimage","url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg","contentUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/08\/3633.jpg","width":2500,"height":1607,"caption":"SHIELD ACT"},{"@type":"BreadcrumbList","@id":"https:\/\/www.elteni.com\/insights\/?p=19961#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.elteni.com\/insights"},{"@type":"ListItem","position":2,"name":"New York State SHIELD (Stop Hacks and Improve Electronic Data Security) ACT"}]},{"@type":"WebSite","@id":"https:\/\/www.elteni.com\/insights\/#website","url":"https:\/\/www.elteni.com\/insights\/","name":"Insights","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.elteni.com\/insights\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075","name":"Elteni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"Elteni"},"url":"https:\/\/www.elteni.com\/insights\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19961"}],"version-history":[{"count":0,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19961\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/media\/19687"}],"wp:attachment":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19961"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}