Author Craig A. NewmanNew York is emerging as the nation’s de facto top data security regulator.Earlier this year, the state’s powerful Department of Financial Services implemented its tough cybersecurity regulation covering banks and insurance companies. And shortly after disclosure of the Equifax breach, the agency – at the direction of New York Governor Andrew M. Cuomo – announced a proposed regulation that would require credit reporting agencies to comply with the DFS cybersecurity regulation.Now, New York Attorney General Eric T. Schneiderman has introduced legislation to ratchet up much broader efforts to protect consumer information. The bill – called “Stop Hacks and Improve Data Security Act” or “SHIELD” – would require companies to put in place “reasonable” administrative, technical and physical safeguards to protect consumer data that they collect and store.
With the exception of the state’s cybersecurity regulation, New York law does not require companies to meet specific data security requirements if personally identifiable information collected and stored does not include a Social Security number. If the bill passes, that would change.Here’s a quick summary of the bill:
It covers any business that holds sensitive information of New Yorkers including those that operate outside of New York state;
Small businesses would be subject to a more flexible approach; and
Reporting triggers would change in two ways:
The current “acquisition” of protected information would be broader and include “access to” such information.
Covered information would include usernames and password combinations, biometric data and healthcare data covered by HIPAA and not just Social Security numbers.
We will monitor the bill as it makes its way through Albany.
Today's market news involves Abnormal Security, Identiv, CrowdStrike, Metro State University, Socura, Adaptive Shield and the Department of Homeland Security.
