NYS AG announces SHIELD Act legislation for data breaches protection

The law aims to boost disclosure requirements and to strengthen consumer protections in the case of a data breach. The Stop Hacks and Improve Electronic Data Security Act (SHIELD) puts additional responsibilities on companies that collect personal data.

Under the newly passed bill, the definition of a breach includes information that an unauthorised person gains ‘access’ to, and not just information that an unauthorised person ‘acquires.’ Also, it requires a company to comply if they have any information belonging to a New York resident, beyond just a company doing business in New York. The bill expands the scope of the data notification law to require disclosure of biometric information, passwords, email addresses, and security questions.