There’s never a dull moment in privacy compliance. New York’s SHIELD Act officially went into effect on March 21, but while many companies may have greeted the deadline from a position of strength, some could be finding themselves in a much more uncertain enforcement landscape than the one they imagined when the law was passed in July 2019.
The SHIELD Act amends New York’s existing data breach notification law, expanding the definition of a breach to include not only unauthorized acquisition of protected digital information, but unauthorized access as well. It also broadens the type of information that companies have to protect to include “private information”—like Social Security or driver’s license numbers—as well as “personal information” or “any information concerning a natural person” that can be used to identify said natural person.
