On March 20th a new law in New York went into effect requiring all businesses holding personal data belonging to New York residents to institute specific data security measures. Known as the “Stop Hacks and Improve Electronic Data Security Act" (the “Shield Act), this new statute will be enforced by the New York Attorney General and mandates that a company must implement a number of “administrative, technical and physical safeguards and appoint an employee to manage the cybersecurity program. Among other changes, the new law expands the definition of personal information and the definition of what constitutes a data breach. Failure to comply with this new statute authorizes the Attorney General to obtain statutory damages and the actual damages to consumers.