Can You Be Charged with a Crime for Data Breach in New York?

Introduction

Imagine waking up one morning to find out that your business has experienced a data breach. The panic sets in as you realize the sensitive information of your clients has been compromised. What do you do next? More importantly, can you be charged with a crime for this data breach in New York? At Spodek Law Group, we understand the complexities and legal ramifications of data breaches. Let’s dive into the specifics of New York State laws and how they could impact you.

Understanding Data Breach Laws in New York

New York has stringent laws regarding data breaches, primarily governed by the Stop Hacks and Improve Electronic Data Security (SHIELD) Act. This law, which came into effect in 2019, significantly expanded the scope of data breach notifications and imposed stricter requirements on businesses.

Key Provisions of the SHIELD Act

• Expanded Definition of Private Information: The SHIELD Act broadens the definition of private information to include not just Social Security numbers and financial account information, but also biometric data, email addresses with passwords, and more.
• Unauthorized Access: The Act extends the definition of a breach to include unauthorized access to private information, not just unauthorized acquisition.
• Notification Requirements: Businesses must notify affected New York residents as soon as possible and without unreasonable delay if their private information has been accessed or acquired by an unauthorized person.

Legal Obligations and Penalties

Failure to comply with New York’s data breach notification laws can result in severe penalties. The New York Attorney General can bring an action for an injunction and impose civil penalties for non-compliance.

Penalties for Non-Compliance

• Civil Penalties: Businesses that fail to notify residents promptly could face a civil penalty of up to $20 per instance of failed notification, up to a maximum of $250,000.
• Additional Penalties: If the business did not appropriately safeguard the information, it could also face a penalty of up to $5,000 per violation.

Criminal Charges for Data Breaches

While the SHIELD Act primarily imposes civil penalties, there are circumstances under which criminal charges could be brought against individuals or businesses involved in a data breach.

Potential Criminal Charges

1. Unauthorized Use of a Computer (N.Y. Penal Law § 156.05): Unauthorized access to a computer system can lead to criminal charges. If an employee or an outsider hacks into a system without permission, they could be charged with unauthorized use of a computer.
2. Computer Tampering (N.Y. Penal Law § 156.20): This involves altering or destroying computer data without authorization. If someone intentionally tampers with data to cause harm, they could face criminal charges.
3. Identity Theft (N.Y. Penal Law § 190.78): If the data breach results in the theft of personal information used to commit fraud, those responsible could be charged with identity theft.

Case Studies and Hypothetical Scenarios

Let’s consider a hypothetical scenario to illustrate how these laws apply. Suppose a financial institution in New York experiences a data breach due to a phishing attack. The attackers gain access to customers' Social Security numbers and bank account details. The institution delays notifying the affected customers and fails to report the breach to the state authorities.In this scenario, the institution could face significant civil penalties under the SHIELD Act for failing to notify the affected individuals and state agencies promptly. Additionally, if it is found that the breach occurred due to gross negligence in safeguarding the data, further penalties could be imposed. If the attackers are identified, they could face criminal charges for unauthorized use of a computer and identity theft.

Practical Advice for Businesses

To avoid the severe consequences of a data breach, businesses should take proactive measures:

• Conduct Regular Security Audits: Regularly audit your security systems to identify and address vulnerabilities.
• Implement Strong Security Measures: Use strong passwords, two-factor authentication, and encryption to protect sensitive data.
• Train Employees: Educate employees about phishing attacks and other common cyber threats.
• Have a Response Plan: Develop a data breach response plan to ensure quick action in the event of a breach.

Conclusion

Data breaches can have severe legal and financial repercussions for businesses in New York. While the SHIELD Act primarily imposes civil penalties, criminal charges can also be brought in certain circumstances. At Spodek Law Group, we are here to help you navigate these complex legal waters. If you find yourself facing allegations related to a data breach, contact us at 212-300-5196 for expert legal assistance.Don’t wait until it’s too late—protect your business and your reputation with the help of our experienced attorneys.