SUMMER 2020 TODAY’S GENER AL COUNSEL
Cybersecurity
New York Latest State to Enact Cybersecurity Law By Joseph J. Lazzarotti
20
N
ew York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act puts the Empire State among a growing number of states that have enacted broadly applicable cybersecurity mandates. Potentially reaching persons and businesses outside of New York, the SHIELD Act, effective March 21, 2020, seeks to protect New York residents from rampant identity theft and similar crimes. The new law obligates persons and
businesses that own personal information to safeguard it, and strengthens the state’s existing data breach notification law. As compliance obligations reach beyond IT and technology, legal departments have a critical role to play. The SHIELD Act’s obligations apply to any person or business that owns or licenses computerized data that includes private information of a resident of New York. Thus, persons and businesses located outside of New York
that maintain private information of New York residents will need to think carefully about whether they have SHIELD Act obligations. The SHIELD Act also applies to small businesses, although the nature and extent of their efforts can be proportionate based on certain factors, such as the size and complexity of the business. Small businesses under the SHIELD Act include any person or business with fewer than 50 employees; less than three
