New York is emerging as the nation’s de facto top data security regulator.
Earlier this year, the state’s powerful Department of Financial Services implemented its tough cybersecurity regulation covering banks and insurance companies. And shortly after disclosure of the Equifax breach, the agency – at the direction of New York Governor Andrew M. Cuomo – announced a proposed regulation that would require credit reporting agencies to comply with the DFS cybersecurity regulation.
Now, New York Attorney General Eric T. Schneiderman has introduced legislation to ratchet up much broader efforts to protect consumer information. The bill – called “Stop Hacks and Improve Data Security Act” or “SHIELD” – would require companies to put in place “reasonable” administrative, technical and physical safeguards to protect consumer data that they collect and store.
With the exception of the state’s cybersecurity regulation, New York law does not require companies to meet specific data security requirements if personally identifiable information collected and stored does not include a Social Security number. If the bill passes, that would change.
Here’s a quick summary of the bill:
We will monitor the bill as it makes its way through Albany.
represents Patterson Belknap Webb & Tyler LLP, a law firm in New York that has a Privacy and Data Security Practice. Read more Patterson Belknap blogs here.
