New York could soon pass its own GDPR

The law could become one of the strictest in the country, one attorney said, because it prescribes specific security rules.

New Yorkers could soon have clearer insight into when, where and how their data has been compromised under the terms of a bill expected to pass this week in the state’s legislature.

The state’s lawmakers are debating whether to approve a bill that would update the state’s data breach notification law to cover more personal information and force firms to disclose ransomware infections, among other measures.

The Stop Hacks and Improve Electronic Data Security Handling (SHIELD) Act also would cover any business that holds sensitive data of New York residents, rather than only firms that do business in the state. It’s an important detail cribbed from the European Union’s General Data Protection Regulation (GDPR), which compels organizations to report breaches affecting EU citizens, no matter where the hacked company is located, to regulators within 72 hours.

The SHIELD Act requires notification to affected individuals “without unreasonable delay,” a time period that typically means 30 days, according to state Sen. Kevin Thomas, who re-introduced the bill after a failed attempt to do so in 2017.

“I want to capture as many businesses as possible,” he said Wednesday. “To just limit it to people who do business here doesn’t really suffice.”

Notification can come in the form of media reports if the breach costs more than $250,000, Thomas told CyberScoop. If passed, the law could go into effect next year.

The state senate’s consumer protection committee is scheduled to debate and likely pass the bill on Thursday, Thomas said. From there, he predicted it will be passed by the entire state legislature and become law following signature from Gov. Andrew Cuomo, who has called for such regulation in the past.

Meanwhile, New York Attorney General Letitia James signaled her willingness to enforce data security law by opening an investigation last month into Facebook’s data collection practices.

The SHIELD Act goes further than most state data breach legislation because it also pulls from the state’s Department of Financial Services’ cybersecurity regulation. Most state laws require businesses to have “reasonable” security programs, vague legalese that typically satisfies business and consumer advocacy groups. New York’s SHIELD Act is more specific, prescribing risk assessments, the appointment of an employee to oversee a data protection program, employee training and other requirements.

“If this passes it will be one of the strictest laws in the country,” said Kenneth Rashbaum, a partner specializing in cybersecurity at the New York law firm Barton, adding that Colorado and Massachusetts have similar rules.

“I would be very surprised if anything here is not aggressively pursued. This one is going to be interesting,” Rashbaum said.

You can read the full bill below.

[documentcloud url=”http://www.documentcloud.org/documents/6061358-NY-SHIELD-ACT.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure