FOLLOW US

New York Attorney General Eric Schneiderman introduced a new bill to provide protection for New Yorkers against data breaches.

The initiative comes following the Equifax massive data breach that compromised the personal information of 145.5 million U.S. consumers. The security breach also put at risk the personal data of 15.2 million U.K. consumers and up to 100,000 Canadians.

The Equifax data breach impacted more than 8 million New Yorkers. His office launched an investigation into the hacking incident and ordered the company to address several issues.

In a statement, AG Schneiderman noted a 60% increase in data breaches affecting New Yorkers. Last year alone, his office receives 1,300 data breach notifications.

According to Schneiderman, “It’s clear that New York’s data security laws are weak and outdated. It’s time for Albany to act” to ensure that New Yorkers will no longer become victims of criminal hackers and weak data security measures.

SHIELD ACT will make New York a leader in data security

This week, the attorney general introduced Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) as a program bill. State Senator David Carlucci and Assemblyman Brian Kavanagh sponsored the legislation.

On Thursday, AG Schneiderman explained that SHIELD Act will close major gaps in the security laws of New York. It will make the State a leader in data security because it requires robust protections for personal data.

On the other hand, Senator Carlucci, said “Recent data breaches have put New Yorkers at risk. We are woefully unprepared to protect against cyberattacks, putting America's economy in peril. While the federal government drags their feet, we must act to protect New Yorkers. The SHIELD Act will serve as a blueprint for NY and the rest of the nation to follow to keep Americans safe.”

Meanwhile, Assemblyman Kavanagh said the legislation is important because it requires business to take appropriate steps to protect data. He emphasized, “In this technological age, we cannot allow companies to be careless with our personal information.”

SHIELD Act requirements

Under the SHIELD Act, companies will have legal responsibility to adopt reasonable administrative, technical, and physical safeguards for sensitive data.

Businesses holding New Yorker’s sensitive data must comply with the standards set by the legislation. The standards apply to any entity doing business in New York or not. The attorney general said the standards are “sensible, and commensurate with the sensitivity of the data retained and the size and complexity of the business.”

Additionally, the SHIELD Act will also expand the type of data that trigger reporting requirements. The triggers include username and password combinations, biometric data, and HIPAA-covered health plan.

Furthermore, the legislation will provide strong incentives to companies with the highest standards of data security measures. Companies must obtain independent certification indicating they meet the highest data security standards. As incentive, companies will receive safe harbor from state enforcement action.