New York is emerging as the nation’s de facto top data security regulator.

Earlier this year, the state’s powerful Department of Financial Services implemented its tough cybersecurity regulation covering banks and insurance companies.  And shortly after disclosure of the Equifax breach, the agency – at the direction of New York Governor Andrew M. Cuomo – announced a proposed regulation that would require credit reporting agencies to comply with the DFS cybersecurity regulation.

Now, New York Attorney General Eric T. Schneiderman has introduced new legislation to ratchet up much broader efforts to protect consumer information.  The new bill – called “Stop Hacks and Improve Data Security Act” or “SHIELD” – would require companies to put in place “reasonable” administrative, technical and physical safeguards to protect consumer data that they collect and store.

With the exception of the state’s cybersecurity regulation, New York law does not require companies to meet specific data security requirements if personally identifiable information collected and stored does not include a Social Security number.  If the bill passes, that would change.

Here’s a quick summary of the bill:

▪ It covers any business that holds sensitive information of New Yorkers including those that operate outside of New York state;

▪ Businesses that already comply with certain existing data security regulations or laws such as New York’s cybersecurity regulation, the Health Insurance Portability and Accountability Act of 1996, or Gramm-Leach-Bliley Act, or the current International Organization of Standardization (ISO) or National Institute of Standards and Technology standards, are eligible for a safe harbor provision that would deem them compliant with the “reasonable” safeguards requirements of the bill;

▪ Small businesses would be subject to a more flexible approach; and

▪ Reporting triggers would change in two ways:

▪ The current “acquisition” of protected information would be broader and  include “access to” such information.

▪ Covered information would include usernames and password combinations, biometric data and healthcare data covered by HIPAA and not just Social Security numbers.

We will monitor the bill as it makes its way through Albany.