Companies that collect or process personal information about New York residents have likely heard of New York’s Stop Hacks and Improve Electronic Data Security Act—the “SHIELD Act”—and those actually subject to its requirements may already be familiar with the data breach notification provisions that took effect in October 2019. However, companies may not yet have fully considered the new SHIELD Act’s data security requirements or how to achieve compliance with them. Those new data security requirements take effect on March 21, 2020, so it’s important to know the details and have a plan to move forward as that date approaches. As an aside, compliance with the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, New York’s Title 23 NYCRR Part 500, or other federal and state data security rules and regulations serves to fulfill the SHIELD Act’s security requirements. Accordingly, if an organization otherwise subject to the SHIELD Act is already in compliance with the GLBA, for instance, no additional measures are needed to comply with the SHIELD Act’s security requirements.
The SHIELD Act’s Security Provisions
The first thing to know is that the SHIELD Act’s security provisions apply to any business that owns or licenses New York residents’ “private information” in computerized form. Per those provisions, covered businesses must develop, implement, and maintain reasonable security measures to protect private information, and the SHIELD Act specifically requires administrative, technical, and physical safeguards with “reasonable” measures being necessary in each category. The requirement for reasonable measures, combined with an analysis of the specific examples the law provides, suggests that businesses must conduct assessments of what information they have, how they use it, and tailor their safeguards to the level of risk that their processing activities present. Importantly, these safeguards must evolve with any changes to the kind of information that is collected, how it is used, or any structural changes to the business or its network. Accordingly, businesses affected by the SHIELD Act should conduct assessments of their program any time there are changes to the business that could render existing safeguards ineffective or inadequate.
It’s interesting to note that the SHIELD Act calls out physical security, even though the Act applies to businesses that own or license “computerized” personal information. As such, this should serve as a reminder that risk assessments and security controls must account for the physical security of information, even if it is stored and accessed digitally.
How Can Companies Show Compliance?
As noted, the SHIELD Act requires implementation of reasonable administrative, technical, and physical security measures. But the question remains of how companies can demonstrate implementation of these measures when a regulator comes knocking. The law provides little specific guidance on how to demonstrate compliance. However, based on the statute’s language and lessons learned from similar laws, companies should make sure to accurately document all compliance-related activities. More specifically, companies should consider the following:
-
Assigning and Documenting Responsibility - Such steps should be taken for the security program as a whole and for each process that may be required as part of any specific security measures. Within the administrative safeguard parameters, the SHIELD Act suggests designating an employee to coordinate the security program, but companies should also consider assigning responsibility to specific key measures that may be implemented as part of the program. For example, if risk assessments are required before implementing new business processes—or changing existing processes—consider assigning responsibility for the risk assessment to the appropriate individual, such as the process owner. Assignment of responsibility should be documented in policies and procedures and when specific tasks related to these safeguards are completed (i.e. recorded in a risk assessment).
-
Conducting and Documenting Risk Assessments - Companies should absolutely document their risk assessments for business processes that affect private information. Furthermore, because the law specifically calls out administrative, technical, and physical safeguards, risk assessments should consider the risks and controls particularly for each of those domains. These risk assessments should be retained for as long as the affected process is implemented, and for a period thereafter to account for the applicable statute of limitations.
-
Implementing a Training Program and Recording Participation - Create a training program that is tailored to your organization. Training should be required upon hire and at regular intervals thereafter (i.e. annually), and completion of the training requirement should be documented for each employee.
-
Conducting External Assessments - Businesses should also consider engaging objective third parties to conduct evaluations—such as penetration testing and vulnerability assessments—at regular intervals, as they can provide additional assurances that implemented measures are actually working while also identifying areas for potential improvement.
The above measures are by no means a comprehensive list of the components necessary to comply with the SHIELD Act’s security requirements. However, as companies build and update their security programs with the SHIELD Act in mind, knowledge of the specifics and a clear path forward with steps could help significantly in preparing for the upcoming March go-live date.