An Employer's Guide to the NYS SHIELD Act
The act is meant to improve employee and consumer protections against data leaks and cyberattacks by increasing legal requirements placed on employers and corporate entities. The act takes effect on March 21, 2020.
Introduction
On July 26, 2019, New York State Governor Andrew M. Cuomo signed into law the Stop Hacks and Improve Electronic Data Security (SHIELD) Act. The act is meant to improve employee and consumer protections against data leaks and cyberattacks by increasing legal requirements placed on employers and corporate entities.
These requirements involve data security management and detection programs as well as corporate responsibility to notify consumers in the event of a data breach.
The act will take effect on March 21, 2020. Consumers and employees will not have a private right of action in the event of a compliance breach, but penalties will be enforced by the attorney general’s office.
Who the Act Impacts
The NYS SHIELD Act imposes requirements and demands on any employer that:
- Operates in the state of New York.
- Has at least one employee in the state of New York.
- Operates outside the state of New York but maintains the private information of New York residents.
In this case, the definition of “private information” includes Social Security numbers, driver’s license numbers, debit and credit card numbers, financial and bank account numbers (with or without pin and security codes as long as access to an account could be gained), biometric information, usernames, email addresses, and passwords.
The act will largely impact human resource and information technology departments.
Helpful Articles
Mandates
The NYS SHIELD ACT requires employers and businesses that handle the private information of New York residents to implement safeguards—and while it doesn’t mandate specific safeguards, it does provide that a business will be “deemed in compliance with” the act after instituting a “data security program” with certain key elements. Key elements include:
- Designate an employee or employees to coordinate the data security program.
- Train and manage employees in security program practice procedures.
- Asses internal and external risks and implement controls to reduce those risks.
- Vet service providers and bind them contractually to safeguard private information.
- Securely destroy private information within a reasonable amount of time after it is no longer needed for business purposes.
The SHIELD act allows two types of businesses to complete the “reasonable safeguard” requirement without a data security program. Instead, these companies must only assure their safeguards are appropriate for the size and scope of their business needs and the sensitivity of the information they handle. Those business types are:
- Small businesses with less than 50 employees.
- Small businesses with less than $3 million in gross annual revenue.
Compliance
Other Acts that Put Businesses in Compliance
Some businesses may already be compliant with the NYS SHIELD Act if they already have complied with other cybersecurity regulatory acts. The following acts fulfill NYS SHIELD act regulatory compliance requirements:
- The Gramm-Leach Billey Act
- The Health Insurance Portability and Accountability Act Security Rule
- New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies
Expanded Breach Notification Requirements and Penalties
While the majority of the NYS SHIELD Act takes effect in May 2020, special expansions to existing breach notification requirements went into effect on Oct. 23, 2019. Human-resource departments should take special note of these new requirements and obligations.
Key Definitions
The Definition of “Private Information”
The SHIELD Act expands the definition of “private information” (which, when compromised, activates the requirement that employees and consumers be notified). Information now defined as private includes:
- Biometric information (which many employers use on time clocks).
- Email addresses and their associated passwords, security questions, and answers.
- Financial account numbers without a required security code, as long as someone could still access the account.
- Unsecured protected health information covered under HIPPA.
The Definition of “Breach”
The SHIELD Act expands the definition of “breach” to include not only the unauthorized acquisition of information but also unauthorized access to information. This is important because it is often difficult to ascertain what information was stolen when a hacked account was accessed.
Notification of Inadvertent Disclosure
The SHIELD Act adds an exception that allows human-resource departments to skip breach notifications if the breach is unlikely to result in the misuse of the information (for instance, if the information was accidentally posted on a private company message board but never viewed before it was deleted). There are specific rules that must be followed, however:
- The employer must document the determination and reasoning for the determination.
- The documentation must be filed and kept for at least five years.
- If the breach involves the private information of more than 500 New York residents, the employer must submit documentation to the attorney general in 10 days or less.
Expanded Penalties
The SHIELD Act also sets the attorney general’s recoverable penalty at $20 per the failed notification, with a maximum of $250,000. The original penalty was $10 per failed notification with a maximum of $100,000.
Bahar Uttam
I have been working with Lacy Smart and her team for the last few years. I have been impressed by her responsiveness, accuracy, and high level of providing client satisfaction. She and her team are a wonderful testament to the organization!
Bonnie Deneef
I have worked with a few different payroll providers during my career. Complete Payroll is absolutely, by far, the most proficient and customer service-oriented provider I have been privileged to work with. Lindsay Ezard goes above and beyond to assist me with any question I may have. Thank You Lindsay!
Cathy Pace
Finger Lakes Wrestling Club Inc
We were referred to Complete Payroll years ago by a board member and haven't looked back since. When I first started working with them, I knew nothing about payroll. My first rep Lacey, and now JoAnn, are great to work with. Working with Complete Payroll has just been a wonderful all-around experience for me.
Christina Wagar
Dr. Christopher Mozrall
Complete Payroll is a great payroll company, and we love Lacey! She always has the answers to my questions without hesitation. There is very little (if any) wait time to get a call back.
Colleen Koll
The first suggestion I made after I joined Shear Ego was that if they were not yet using Complete Payroll, they should be. We continue to be impressed and happy with the quality and friendliness of service, and the excellent newsletters and up-to-date information on all things payroll and HR.
Debbie Klymkow
We moved to Complete Payroll about 3 years ago. It was seamless and working with Lacy Smart on Mondays is a breeze.
Dick Eakins
Norco Farms
Complete Payroll fits my budget, I never get bounced around between customer service reps, and it's very easy to enter my payroll. I simply take a photo of my payroll sheet and email it to my rep. There's never a problem! With them, it's business done, and business done right.
Don Cunningham
Complete Payroll Processing provided an easy transition from internal payroll processing. With payroll as their core competency, CP has the expertise to help mitigate errors and ease the burden of annual updates. Comprehensive reporting gives all the details needed and an organization can operate with an added piece of mind knowing that the payroll service is taken care of.
Eileen Reeves
After nearly 10 years, we are receiving the same or better service than when we started. The ability to reach our dedicated customer service representative in a timely manner is huge when there are deadlines in play. Requests for unique reports and integration with our other vendors has been handled without hesitation. We truly feel a partnership with Complete Payroll.
Emily Wyse
I just love Lindsay! She does an awesome job! She is very responsive and I like that she teaches me how to find things rather than just doing it for me.
Howard Clarke
H Clarke Services
We have been with Complete Payroll for quite awhile now and plan on staying. Thanks!
Watch Howard's Testimonial
John Worth
We have been well served by Complete Payroll. When we have needed support, it was given both in payroll and other employee matters, like handbooks.
Kelly Stephenson
We have been using Complete Payroll for over five years and have found them to be responsive, professional, friendly, and cost effective. Customer service is best judged when something goes wrong. Complete Payroll is always there immediately to help fix the issue. Complete Payroll is a payroll partner, not just a payroll service.
Paul Cronk
I've been very pleased with the service and responsiveness of my CSR, and CP's continued dedication to provide us with all the tools we need to have a successful payroll and HR experience. You are always available when I have a question and always make sure that any problems that arise are worked through to my satisfaction.
Teresa Jackson
We have been customers for many years. Evolution Software is easy to use but, more importantly, Cindy is an email away and her knowledgeable, efficient, and quick to replies to our questions are appreciated. We're very happy with Complete Payroll.
Tina Canali
Complete Payroll is always there if we have a problem or need something special! Their response time is AWESOME!
Denni Harbaugh
My CSR, Andi Dimmick, is The Bomb! She's always friendly, cheery, and with all her clients, makes me feel like she has carved time out for ME. Her customer service is AWESOME, and the personal touch means so much!
Elvira Aletta
Everyone I talk to at CP is friendly and tries to help. If they don't have a ready answer, that's OK. They take the time to find one. Website is user friendly, too. The actual operation of payroll is dependable and reliable.
Peter Varlan
Things go quite smoothly and I have a very good rep: Megan!
Cindy Van Buren
Great customer support and service!
Lisa Lyons
Attica Auto Supply Inc
Friendly, answered all my questions, and never felt hurried.
Bonnie DeNeef
LeeAnn was just wonderful to work with.
Jackie Agusta
Lee Anne is a wonderful trainer. Concise and clear. A pleasure!!
Jennifer Pauly
The program has met our needs! Actually exceeded them!
Sue Budd
Great products, great people and no problems!
Gail Stowe
Stowe Potato Sales
Love working with Complete Payroll, especially with Joann Gaedeke. She is amazing! Very thorough and accurate; takes the pressure from me! Love it!
Nancy Miller
N&G Broadway Inc
Very friendly staff, and you are always on top of the services you offer.
Chris Smith
I appreciate updates that Complete Payroll provides. Site is easy to navigate. Our rep, Karla, is so accommodating and friendly. We appreciate her also. So happy we made the switch to Complete Payroll!
Frances Sweeney
The service that we have received has been EXCELLENT and I can't say enough about Lindsay Ezard's patience and support. Everyone that I have had contact with is professional, knowledgeable, and personable. I have received many calls from your competitors wanting to talk to us but I tell them I am very happy with our service!
Lora Miller
Great company to work with. Wonderful people; knowledgeable, helpful, and friendly!
Helen Cunningham
Customer Service and payroll representatives are excellent!
Sally Kovatch
The program works very well for our company. We like the virtual payroll option and our Account Representative, Ashley, is always very responsive and helpful!
Teri Peters
For 11+ years, Andrea Dimmick has been our CSR. She is extremely competent, helpful, responsive. Evolution portal, once trained, is easy to use and again, if we ever run into an issue, Andrea walks us right through. I would highly recommend... and have!
Nicole Begin
Love working with CPP. They have made life so much simpler for me.
Mary Sutter
I have worked with two other payroll companies and Complete Payroll has been the best in payroll custom packages and customer support! The payroll reports are readable with larger font when printed and program is user friendly.
Laura Lane
The customer service is beyond compare!
Barbie Gozelski
LeRoy Country Club
When I need something, you always help. You're easy to get ahold of; you DON’T put me on hold! I get to email or talk to a real person (Lindsay) and she's always consistent.
Nancy Miller
N&G Broadway Inc
Very friendly staff, and you are always on top of the services you offer!
Patricia Gilbertson
CPP has resources that consistently monitor payroll regulations at all levels that ensures compliance. This is a great boon for a small business with limited personnel.
Elizabeth Barefoot
I have recommended Complete Payroll to my clients for years. You have the best customer service of any payroll company I deal with. I know that mistakes will happen on occasion, but Complete Payroll really works to resolve issues promptly.
Kris Dussmann
We are a Complete Payroll customer and have been very happy with our relationship. We have had no problem referring CPP to our business owner clients.
Margaret Urlacher
Pittsford Realty Corp
Customer Service is awesome! Love Andrea 😀
Liz Maher
Our payroll specialist, Ashlee Adams, is extremely knowledgeable, helpful and quick to respond to all questions and concerns. She has alleviated many stressful situations for our company and is a true pleasure to work with! Thank you Ashlee!
Marybeth Simoneit
Friendly employees, lots of resources.
Kathy Cassetta
You have the best employees working for you. They are professional and a delight to work with!
Joe Czerny
Service reps are so helpful and always available. Andrea is the best!
Mark Logan
I love our CSR Megan. She makes my life so easy. I used to be with one of your competitors and the CSR there treated me like a number. Megan treats me like she is part of my team.
Patty Dugan
Any time I need anything we always have a prompt response from you.
Kris Dussmann
We are a Complete Payroll customer and have been very happy with our relationship. We have had no problem referring CPP to our business owner clients.
Debbie Blacklock
Fantastic service! Friendly helpful staff. Your company was and is the most sourced not only with payroll needs but also with the update and verbal connection with your clients when it came to the COVID-19 PPP. Believe me when I tell you, I had less help from my bank or my Accountant! Thank you!
Recent Articles from the Blog
We're constantly publishing content about payroll, human resources or anything related to managing your people.
Subscribe to Our Newsletter
Twice a month we share relevant and timely blog articles and other resources. No solicitations. No funny business. Just quality stuff to help employers.
