This was a busy week for activity and discussions on the federal level regarding existing privacy laws – namely the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). But the real question is, could a federal privacy law actually happen in 2019? Cybersecurity issues and the possibility of a
State Laws Relating to Data
Compliance With New York’s Cybersecurity Regulation 23 NYCRR Part 500
On March 1, 2017, New York’s Cybersecurity Regulation (23 NYCRR Part 500)[1] became effective. The regulation is the first of its kind in the nation and requires certain companies, including banks, insurance companies and other financial services institutions regulated by the Department of Financial Services (“Covered Entities”), to have:
- a cybersecurity program designed to protect consumers’ private data;
- a written policy or policies that are approved by the Board of Directors or a senior officer;
- a Chief Information Security Officer to help protect data and systems; and
- in place controls and plans to help ensure the safety and soundness of New York’s financial services industry.[2]
In addition, pursuant to the regulation, Covered Entities must report a cybersecurity event if (a) the event impacts the Covered Entity and notice of it is required to be provided to any government body, self-regulatory agency or any other supervisory body; or (b) the event has a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity. Details regarding what makes up such an event are detailed on the New York Department of Financial Services website.[3] …
Continue Reading Compliance With New York’s Cybersecurity Regulation 23 NYCRR Part 500