A new Privacy SHIELD: New Data Breach Notification Law Pending in New York State

Privacy law and breach notification may become proportionately stricter in the United States if a draft New York "Stop Hacks and Improve Electronic Data Security Act” (“SHIELD Act") is enacted.

Updating New York’s Data Breach Notification Law.  Today, virtually all U.S. states have a security breach notification law that is about 15 or so years old.  Mandatory security notifications are generally required only after there are at least 5,000 impacted consumers. If a “privacy shield” bill passed in New York’s Senate on June 5, 2019 is enacted, New York’s cybersecurity breach notification law, enacted in 2005, would be amended to require notifications for much small security breaches, even on an individual basis, with broadened coverage.

NY Privacy SHIELD.  Passed by the New York Senate on June 5, 2019, the New York SHIELD Act (Sen. 5575-A, 2019-2020 session, available at https://www.nysenate.gov/legislation/bills/2019/s5575/amendment/a ), would amend and add sections  to the New York General Business Law and the State Technology Law on data breach notification.

Expanded “Personal Information. The draft law would expand the scope of information subject to the current data breach notification law to include biometric information, email addresses and their corresponding passwords or security questions and answers, and protected health information as defined under HIPAA. It would cover “personal information," defined as “any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.”  Privacy rights would apply to personal information that is “private” by reason of consisting of one or more key identifiers consisting of unencrypted data elements (or even encrypted data elements if accessed or acquired).  Such key identifiers would include (1) social security numbers, (2) driver’s license or non-driver ID card, (3) financial account access information, (4) biometric information including facial recognition, voice recognition or other unique physical characteristic, (5) a user name or e-mail address with password or security question and answer for accessing an online account, and (6) unsecured protected health information under HIPAA. 

Employers and Employees: What is a Data Breach? The draft SHIELD law would broaden the definition of a data breach to include unauthorized access to private information.  This poses a major shift since it would make employers liable for the actions of their employees who lacked due authority to access personal information.   And it would now include those practicing ransomware.

Extraterritorial Scope.   Welcome to New York, virtually!  Like the EU GDPR and California’s Consumer Privacy Act of 2018 (“CCPA”), the draft New York law would have extraterritorial effect.  It would apply its notification requirement to any person or entity, regardless of their base of business,  with the private information of a New York resident, not just to those that conduct business in New York State.
   
What is a Data Security Breach Event under NY SHIELD?  The scope of breach notifications would depend on the number of affected New York residents and the severity of the risk.   Data controllers and data processors suffering a breach of personal information would need to give such notification if the database was breached, or “is reasonably believed to have been, accessed or acquired by a person without valid authorization.”

Varying Thresholds for Security Breach Notifications.  The New York SHIELD Act would apply to any person or business that owns or licenses computer data that includes private information.  It would create data security and breach notification requirements tailored to the size of the business.  Depending on the number of persons affected, different types of notifications would apply.

• 1 to 500 Individuals. The draft SHIELD would require disclosure of any security breach to each affected individual. 
  
  
• 500+ Individuals.If the breach affects more than 500 New York residents, the data controller would need to deliver a written determination to the New York State Attorney General within 10 days after the determination.   Further, the police, Office of Information Technology Services  and Department of State would need to be notified and consulted on the form, timing and content of any breach notification to New York residents. 
  
  
• 5,000 Individuals. Currently, New York has a security breach notification statute similar to those of all other states.   In other states similar statutes do not all require notification to individuals unless a breach involves more than 5,000 individuals.   As with other breach notification statutes, for breaches affecting more than five thousand New York residents, the notification would also be given to the “consumer reporting agencies” to exchange views on the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York residents.

Delayed Disclosures.  The SHIELD law would allow delays in notification for legitimate needs of law enforcement and for measures necessary to determine the scope of the breach and restore the integrity of the system.   Rather than establish a presumption of a duty to disclose, the SHIELD act would allow non-disclosure of inadvertent disclosures to authorized persons, where the data controller reasonably determines that there will likely be no misuse, financial harm or emotional harm and the data controller documents the determination breach notification under certain other laws (GLB, HIPAA, 23 NYCRR Part 500 or other breach notification law), no duplicative notice would be required.

How must a Notice of Data Breach be Delivered to New York Residents?  Notices may be in writing, electronic or by telephone or, for big breaches when over 500,000 notifications must be sent or where notification would cost more than $250,000, a substitute notice online, on one’s website and by press release to major statewide media. Since this provision fits within the definition of computer fraud under the federal Computer Fraud and Abuse Act, the draft SHIELD law invites litigation against any employer that fails to define and enforce access rules for personal information.

Who is Liable for a Data Security Breach?  Unlike many other privacy laws, the data controller or data processor suffering a data breach may be held legally liable for all consequential financial losses occurring after the failure to notify, as well as all costs (attorneys’ fees).  Knowing and reckless violations may result in a civil penalty of the greater of $5,000 or up to $20 per instance of failed notification, up to $250,000. Action must be commenced within three years after  either when notification was sent to affected individuals or when the Attorney General  was notified, whichever comes first,  but in no case later than 6 years after the date of discovery  of the breach.  No limitation applies for cases of concealment of a breach.

Exemptions for Good Faith.  The draft law would provide protection from liability for certain entities that take steps to verify their safeguarding of private information.

Possible Trends.

• Administration of Privacy Laws in New York.  The SHIELD act would designate the New York Department of State as a key agency for coordination of breach notification efforts.  This agency also is responsible for registration of companies doing business in New York.  Like the U.S. Department of Commerce, the New York Department of State could keep a public list (à la Mikado) of errant data managers. 
  
  
• Trend towards More State Legislation?  The New York SHIELD law signals a further tightening of U.S. state privacy laws, triggered by the EU GDPR adopted May 25, 2016 and effective May 25, 2018, and the California Consumer Privacy Protection Act of 2018, effective January 1, 2020.  The New York cybersecurity breach notification law, enacted in 2005 and amended in 2013, would become effective 180 days after enactment.  Other states (such as Nevada, with a pending bill) can be expected to follow the process. 
  
  
• Continued Profiling of Customers (The One that Got Away: New York Privacy Act).  The passage of the draft SHIELD Act reflects continuing state legislative turmoil between consumers and retail merchants, B2B and B2C service providers.  The draft SHIELD law represents the abandonment, for now, of a much more drastic proposed law, the New York Privacy Act, which would have created a “fiduciary duty” for data custodians and covered virtually all elements of “personal information.”  The withdrawn New York Privacy Act would have defeated e-commerce tools for profiling and anticipating e-consumer’s purchasing decisions.  It would have imposed heavy obligations on all companies using or providing digital media, digital marketing, predictive marketing analytics and even robotic process automation that automatically profiles consumer data.   And it would have instigated litigations by consumers claiming rights under vague and subjective definitions.
  
  
• Trends in Corporate Governance; Information Governance; Risk Management.  This mild reinforcement of the data breach notification statute underscores the need for information governance at the Board of Directors level.   To manage risks and ensure organizational resiliency, Boards should include knowledgeable persons aware of the business, technology, legal and brand impact of data privacy and cyber security across borders.   And the Board needs the help of more technical and legally detailed personnel (or advisors) acting as Data Protection Officers (“DPO’s”) under the GDPR, Chief Privacy Officers  (“CPO’s”), Chief Information Security Officers (“CISO’s”) under New York’s Department of Financial Services, or any other title that commands full authority and responsibilities.

Protecting Company Intellectual Property: Simple Moves against In-house Theft of Trade Secrets and IP

Intellectual property (“IP”) is the elephant in the valuation of a company at sale or financing, but can be undervalued on the balance sheet.  Major enterprises have compliance officers, legal departments and major law firms and tech consultants to help secure their intellectual property?  What about small to mid-sized enterprises or small multinationals?  

Leadership.   First, appoint a person responsible for managing intellectual property.  This usually requires someone with a broad overview of the company’s business strategies, methodologies and competitive positioning.   In a smaller company, this could be the CEO or a deputy. 

Training and Managing Your Employees and Value Chain.   Every person in the company’s “value chain” should be trained in the basics of intellectual property.   These include (1) the differences between a trade secret and a patent, (2) the limited but potentially valuable scope of protection of copyrights, (3) the value of trademarks and related goodwill and how such value can be protected or lost, and (4) the rules defining who owns intellectual property in the absence of a contract.  The “value chain” includes the company’s employees and contractors, and employees of corporate contractors.  

Adopting and Highlighting Policies to Your Employees and Value Chain.    Written policies and procedures on IP protection can serve as references for education, swords against wrongdoers and shields against competitors and other adversaries.   Such policies can be included in employment contracts, employee handbooks, sales manuals (to guide sales personnel), template contracts, joint venture agreements, licenses, IP assignment agreements, website “Terms of Use” and other handy everyday documents.    Without good policies and procedures, the company’s shareholder value risks dilution.

Data Security.   The Healthcare industry lives under federal regulations governing logical, administrative, legal and technological barriers to unauthorized data access.   Your business should apply the wisdom of such practical protections.

Transition Management.    Change management refers to adaptive behaviors.   Transition management relates to a company’s procedures for transitioning relationships (onboarding or termination) with individual employees, contractors, suppliers and others in the value chain.   Checklists, coordination among IT and HR departments and Sales can help avoid or mitigate litigation costs.  Make sure your trade secrets and other IP do not leave the company when the individuals “in the know” leave the company.

IP Risk Prioritization.   Sure, every person in a business has some knowledge of trade secrets that could help a competitor.  But, as in George Orwell’s Animal Farm, certain people are more equal than others, by reason of having broader scope and deeper knowledge of trade secrets.  The Board needs to ensure surveillance and even forensic analysis in relation to high-risk positions such as heads of R&D, scientists, product developers and new business developers. 

Business Modeling in Outsourcing, Licensing and Joint Ventures.  In the early days of outsourcing, companies gladly gave up their employees to the external service provider without charging a headhunter fee or a training fee, and without getting the right to re-hire them, or to get some knowledge management tool to capture the company’s implicit knowledge so it can be restored upon termination of the outsourcing.   The same applied to joint ventures.   This was pretty astounding.   Over time, business models have evolved to incorporate knowledge management.   When outsourcing a process, think about how to keep some residual knowledge for effective management of service providers and integration of the supply chain.   See www.outsourcing-law.com for more.

Spoliation of Evidence.   If business owners and managers have learned anything in the last 10 years, it’s “e-discovery” and “spoliation of evidence.”   Policies and procedures should be adopted to ensure against insider theft of trade secrets and spoliation of evidence of theft.   There are software tools and IT procedures for network administration that can help manage this increasingly costly risk to IP owned by or licensed to the company.  When a high-profile IP person leaves, the company should conduct a quick forensic review.  Evidence lost when hard drives are overwritten can be irreplaceable.

Legal Audit.   When you suspect a loss of IP, call the lawyers.  An internal investigation supervised by lawyers is entitled to confidentiality protections in court under the attorney-client privilege and the attorney work-product doctrine.  Put the lawyer in charge as Maestro, and let the IT, HR, security, forensic analysts and other joint the orchestra.   Even if you don’t suspect any problems, attorneys with Maestro batons can elicit better-protected music for your IP.   And consider legal audits on a regular basis, not just before the time you sign up for an intellectual property rights insurance policy.

Are we feeling innovative yet?

Darwinian Survival through Disaster Recovery and Information Governance

It seems like stock prices fall pretty quickly after a data security breach.   Just ask TJ Maxx, Target, Nieman-Marcus or Sears.   The big boys probably have their business continuity plans (BCP’s) and information governance rules.   What about you?  What’s it all about, Alfie (the CEO, CIO, GC or Webmaster or Board member)?

My dalliance with BCP and “disaster recovery’ (“DR”) started 15 years ago, when I was negotiating long-term outsourcing contracts for enterprise customers.   No BCP/DR, no deal.

Fast forward to 2014.   Now just about everyone understands BCP/DR, requires it in their cloud computing agreements and maybe even in their strategic supplier agreements for manufacture of consumer packaged goods, or whatever.  So it’s time to reinvent and look at “information governance” as a subset of BCP/DR strategy.   And everyone MUST do something about “information governance” because you can get sued, pay a lot of money and lose customers.   Did I mention you (if you are a senior officer) might get fired? 

With your job on the line, where’s the crib sheet for mastering “information governance” and building your own job security plan (“JSP”)?

First step, sound the alarm and look for a BCP.  A business continuity plan acts like the Internet: multiple nodes, multiple points of failure, resiliency.  You plan your own company’s exit (and stresses leading to exit).

Second step, focus on an information governance strategy as a mini-BCP, directed at information technology, telecom and data security, brand management and liability management (to cut your losses on “stray” or “hacked” data).  Throw in a privacy policy too, with a compliance officer to run the deal.

Here’s the plan:

• Face the music.  You won’t hear Beethoven, Mozart or Handel being mentioned with Gramm-Leach-Bliley, Obama(Care), or the less eponymous laws like HIPAA, HITECH or regulations on banking, financial services or insurance (“BFSI”).  Frame your frameworks.
• Do some yoga.  A little flexibility, a little strength and resilience will help your company deal with surprise encounters of the info management kind.
• Round up your data, Cowboy!/Cowgirl!.  Identify sources, uses, flows, warehousing, processing and transmittal of data.
• Put your data collection on a diet.  Imagine a Web without intrusive cookies (as the EU regulators are considering due to easy identification of individuals with geolocalization tools).  Collect and keep personal data (and data leading to individual identification) only if you “need” it.   Otherwise, it’s digital baggage that, if hacked, will cause legal and branding hassles.
• Orchestrate your musicians. 
• Identify “records custodians.” 
• Designate an “information governance team” for all managers who will have inputs into information management and technologies.
• Designate an “incident response team” and allocate roles, responsibilities and strategies for each team member.   Include HR, IT, marketing, legal, purchasing, compliance, finance and
• Get political.
• Identify all of the company’s constituencies who may be impacted by an “incident.”  Consider suppliers, licensors, licensees, customers, joint venture partners, regulators, public relations, reporters, shareholders, directors, officers, employees, lenders, courts, litigants, and anyone else affected by your business.  
• For “B corporations,” consider your social and environmental mission and constituencies.
• Unchain your paranoia.  Assess vulnerabilities and mitigate risks.
• Virtualize and diversify your supply chain (through to your customer delivery service too).  Identify and plan for “disaster” scenarios and the impact on operations, legal compliance, customer loyalty and the company’s value chain.
• Treat data like gems and rare anti-venom snake serum.  For legal issues, the plan should address preservation of legal records and evidence, engagement of forensic analysts and timely statutory notifications of security breach incidents.
• Party hearty, but only after you successfully do your mock “disaster” (“incident”).  The “incident response team” must practice the “table top exercise” drill of data recovery, data security breach notifications and remedial public relations.
• Be democratic.  Get everyone involved, trained and conscious.
• Adapt.  Evaluate and continuously monitor the data security practices and compliance of your internal and external tech providers.  Revise your policies to adapt to new threats and scenarios.  Get a trip to the Galapagos Islands and see what adaptive survival looks like.

Sometimes looking at digital life in analog form makes good sense. Stay healthy.