New York State recently amended its data breach notification law (Stop Hacks and Improve Electronic Data Security Act or “SHIELD Act”), introducing significant changes that impact how all employers who maintain “private information” must respond to and report data breaches. The amendments took effect immediately (December 21, 2024). These updates to New York’s data breach notification law emphasize the growing importance of data protection and preparedness for potential breaches.
Below are key changes and an outline of the necessary steps employers need to take to ensure compliance and protect their business and their employees’ sensitive information.
Key Changes
- Timing Requirement for Breach Notification. The law now requires businesses experiencing a data breach to notify affected individuals within 30 days of discovering the breach, except when the needs of law enforcement require delay.
Previously, no specific timeframe existed beyond “as soon as possible and without unreasonable delay.”
- Expanded Definition of “Private Information”. Effective March 25, 2025, two additional types of information will be included as “private information”:
- Medical Information: Any information about an individual’s medical history including physical and mental and treatment or diagnosis; and
- Health Insurance Information: Subscriber ID policy number or another unique identifier used by an insurer.
Previously, private information only included social security number, driver’s license or ID number, account numbers in combination with other security information that grants access to an individual’s account, biometric information and username or email address in combination with information that allows access to an online account.
- Expanded Notification to State Agencies. The New York Department of Financial Services (NYDFS) is now added to the list of agencies (including the Attorney General, Department of State, and State Police) that must be notified if New York residents are affected.
Impactions for Employers
- Increased Compliance Obligations: Employers should ensure they have implemented processes to meet the 30-day notification deadline for breaches, including but not limited to systems for detecting, assessing, and reporting breaches that are robust to avoid penalties for non-compliance.
- Employee Training: Train employees in the organization’s security practices and procedures.
- Enhanced Incident Response Planning: Employers should update their incident response plans to include timelines and procedures for notifying affected individuals and state agencies. Training employees in these requirements is critical for effective execution.
- Coordination with the NYDFS: Employers in regulated industries, especially financial services, must ensure they communicate with the newly included NYDFS.
- Legal and Financial Risk Mitigation: Failure to comply with these changes may lead to legal consequences and damage to an employer’s reputation. Proactive measures, such as monitoring regulatory updates and maintaining cybersecurity protocols, are essential.
Next Steps for Employers
To ensure compliance with these changes, employers should:
- Update Incident Response Plans: Review and revise incident response plans to align with the new 30-day notification requirement and the expanded list of agencies to be notified.
- Train Employees: Conduct training sessions for employees on the updated breach notification requirements, emphasizing the importance of adhering to the new timelines and procedures.
- Coordinate with the NYDFS: Establish clear communication channels with the NYDFS for regulated industries to ensure timely and accurate reporting of breaches.
