Law / United States / 
New York
Stop Hacks and Improve Electronic Data Security (SHIELD) Act, Attorney General enforcement
N.Y. Gen. Bus. Law §§ 899-aa(6), 899-bb(2)(d)-(2)(e)
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect SHIELD Act violations, for both the breach notification duty and the data security program duty, to be enforced exclusively by the New York Attorney General, never by a private plaintiff.
- Expect the Attorney General to seek an injunction and, for a failure to notify, actual costs, plus for a knowing or reckless violation a civil penalty of the greater of $5,000 or $20 per instance of failed notification, capped at $250,000.
- Expect a data-security-program violation to be treated as a violation of General Business Law section 349, letting the Attorney General seek an injunction and civil penalties on that separate basis.
These lines are LexLint's reading of the law's text. Also read by: Office of the New York Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://ag.ny.gov/resources/organizations/data-breach-reporting/shield-act
- Guidance body
- Office of the New York Attorney General
- Open questions
- Does section 899-bb(2)(d), which deems a failure to keep reasonable safeguards a violation of General Business Law section 349, let a consumer sue under section 349(h) for that failure even though section 899-bb(2)(e) says 'Nothing in this section shall create a private right of action'?
What it makes you log
Logging duty
The cited enforcement provisions let the Attorney General sue to enjoin a violation of the article, treat a failure to keep reasonable safeguards as a violation of General Business Law section 349, and bar a private right of action. They impose no duty to keep a log or record, name no audit and give no party a right to a record. The record duties sit in section 899-aa(2)(a) (a written determination kept five years) and 899-aa(5) (a log of electronic and telephone notices), which this row does not cite, and the territorial reach (private information of a resident of New York) sits in section 899-bb(2)(a), which it does not cite either.
- Kind
- None
- As of
What this law does
The Attorney General may bring an action to enjoin and restrain a violation of SHIELD's breach-notification duty, and a court may award actual costs for a failure to notify and, for a knowing or reckless violation, a civil penalty of the greater of $5,000 or up to $20 per instance of failed notification, capped at $250,000; a three-year limitations period runs from Attorney General discovery or notice, extendable to six years if the breach was concealed.
A violation of the separate data-security-program duty is deemed a violation of General Business Law section 349, letting the Attorney General bring an action to enjoin it and obtain civil penalties on that basis.
Section 899-bb expressly bars a private right of action for the safeguards duty, and section 899-aa carries no comparable express bar in its own text, but its enforcement subdivision is written entirely in terms of Attorney General authority, with no private-suit provision found anywhere in that section. Neither half of SHIELD arms a private plaintiff.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .