Law / United States / 
New York
Stop Hacks and Improve Electronic Data Security (SHIELD) Act, breach notification duty
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach of the security of your system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach.
- Notify the New York Attorney General, the Department of State, and the Division of State Police of the breach, and notify each nationwide consumer reporting agency if you are notifying more than 5,000 New York residents at once.
- If you are a covered entity as defined in 23 NYCRR 500.1, also notify the New York Department of Financial Services of the breach in compliance with 23 NYCRR 500.17 (Section 899-aa(8)(a)).
- If you maintain computerized data that includes private information you do not own, notify the owner or licensee of any breach of the security of the system immediately, and in any event within 30 days following discovery, if the information was or is reasonably believed to have been accessed or acquired without valid authorization (Section 899-aa(3)).
- If you are a covered entity that must notify the Secretary of Health and Human Services of a breach under Health Insurance Portability and Accountability Act (HIPAA) or the HITECH Act, notify the New York Attorney General within 5 business days of notifying the Secretary (Section 899-aa(9)).
- If you decide not to notify affected persons because an exposure was an inadvertent disclosure by persons authorized to access private information that will not likely result in misuse or harm, and the incident affects over 500 New York residents, submit your written determination to the New York Attorney General within 10 days after the determination (Section 899-aa(2)(a)).
- Do not assume New York law clears a faceprint or voiceprint you extract from a recording to authenticate or ascertain identity. SHIELD's biometric-information trigger carries no recording-derived exclusion, so an extracted identifier plausibly falls within it if a later breach exposes it, though this reading is untested in New York case law or Attorney General guidance.
- Do not treat a New York City ordinance as displaced by this section's preemption clause. SHIELD's preemption is scoped to breach notification; the separate NYC Biometric Identifier Information Law regulates capture consent and retention, a different subject.
These lines are LexLint's reading of the law's text. Also read by: Office of the New York Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://ag.ny.gov/resources/organizations/data-breach-reporting/shield-act
- Guidance body
- Office of the New York Attorney General
- Open questions
- Does the thirty-day limit in N.Y. Gen. Bus. Law section 899-aa(2) run from the day a business first learns of unauthorized access or from the day it determines that the data accessed included 'private information', given that the statute says only 'after the breach has been discovered' and the Attorney General's SHIELD Act page states only the 'most expedient time possible' standard?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Five years is a minimum for the written determination that an exposure will not likely result in misuse or harm; the section states no period for the notification log in subdivision 5 and no end date for the determination.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A business that decides not to notify affected persons because an exposure was an inadvertent disclosure by authorized persons that will not likely result in misuse or harm must document that determination in writing and maintain it for at least five years, and where over five hundred New York residents are affected must give the written determination to the Attorney General within ten days. Separately, the electronic-notice and telephone-notice methods are open only if a log of each such notification is kept by the person or business that notifies; the section states no period and no fields for that log. The notices to the Attorney General, the Department of State, the Division of State Police, the Department of Financial Services and consumer reporting agencies in subdivisions 8 and 9 are filings, not a kept record. Section 899-bb carries the separate data security program and is not part of this row.
- Kind
- Explicit
- As of
- Provision
- N.Y. Gen. Bus. Law § 899-aa(2)(a); § 899-aa(5)(b)-(c)
- Trigger
- security_incident
What this law does
Any person or business that owns or licenses computerized data including private information must disclose a breach of the security of the system to each affected New York resident in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered.
Notice to the Attorney General, the Department of State, and the Division of State Police is required for every disclosure, and notice to nationwide consumer reporting agencies is required when more than 5,000 New York residents are notified at once. Notice to the Department of Financial Services is also required, but only where the person or business is a covered entity as defined in 23 NYCRR 500.1, and it must be given in compliance with 23 NYCRR 500.17.
'Private information' is personal information combined with an unencrypted data element such as a Social Security number, driver's license number, financial account number, biometric information, or medical or health insurance information; biometric information here carries no exclusion for data derived from a photograph, video, or audio recording, unlike a comprehensive-regime state's biometric definition, though this plain-text reading has not been tested in New York case law or Attorney General guidance.
This section's local-law preemption clause is scoped to breach notification and does not displace New York City's separate biometric-privacy ordinance, which regulates capture consent and retention, a different subject.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .