News

New York proposing law to protect consumers against data breaches

June 20, 2019

New York state legislators have approved a data protection bill, called the SHIELD Act, that would boost disclosure requirements and strengthen consumer protections.

The Stop Hacks and Improve Electronic Data Security Act broadens the definition of a data breach and puts additional responsibilities on companies that collect personal data, according to a press release from the office of Attorney General Leticia James. The bill now goes to Gov. Andrew Cuomo for consideration.

"Consumers deserve the peace of mind that their private information is secure," James said in the release. "That is why my office has been working hard this session to modernize outdated laws governing data breaches."

Under the bill, the definition of a breach includes information that an unauthorized person gains "access" to, and not just information that an unauthorized person "acquires." The legislation requires a company to comply if they have any information belonging to a New York resident, beyond just a company doing business in New York. The bill also expands the scope of the data notification law to require disclosure of biometric information, passwords, email addresses and security questions.

Earlier this month, the state AG reached a $65,000 settlement with online socks retailer Bombas following a data breach that affected nearly 40,000 customers. Bombas failed to notify breach victims for several years.