South Dakota is the latest state to add notice requirements for data breaches, mandating notice within 60 days of the breach. Like many others before it, South Dakota armed the mandate with steep monetary penalties of up to $10,000 per day, per violation.
Alabama — the sole remaining U.S. state without a data breach law — ushered a data breach bill through the state legislature earlier this week. If Governor Kay Ivey signs the bill into law, all 50 states will have data breach legislation on the books.
The Department of Financial Services (“DFS” or “Department”) has issued notices to entities and licensees that it believes have failed to file a Certification of Compliance (“Certification”) pursuant to the Department’s Cybersecurity Regulation (“Regulation”). The Regulation required all DFS-regulated entities and licensed persons to submit a Certification by February 15, 2018 to verify compliance with the portions of the Regulation that were in effect at the end of 2017.
On February 21, 2018, the U.S. Securities and Exchange Commission (“SEC”) issued updated guidance to assist public companies with disclosure obligations under the federal securities laws relating to cybersecurity risks and incidents (“Guidance”). In addition to expanding upon the SEC’s prior guidance on cybersecurity, which focused on the disclosure of cybersecurity risks and incidents, the Guidance addresses two new issues – the implementation of cybersecurity policies and procedures and the examination of insider trading prohibitions in the wake of cybersecurity incidents. For additional information regarding the SEC’s new Guidance, please refer to the full Data Security & Privacy Client Alert. For a chronology summary of upcoming key dates and corresponding obligations under the Regulation, please see our most recent Data Security & Privacy 
Understanding and Managing Cybersecurity Risks Posed by Third Parties
As noted in Phillips Lytle’s recent Data Security & Privacy 
On Monday, Superintendent Maria T. Vullo of the New York State Department of Financial Services (“DFS”) issued a 
On December 3, 2017, the National Association of Insurance Commissioners (“NAIC”) Cybersecurity (EX) Working Group met and noted that the U.S. Department of the Treasury has recommended that states nationwide work to implement NAIC’s recently adopted Insurance Data Security Model Law (“Model Law”). The full text of the Model Law is available at NAIC.org and can be found 
In November 2017, New York Attorney General Eric T. Schneiderman introduced the Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”) to the New York State legislature. The bill, sponsored by Senator David Carlucci and Assemblymember Brian Kavanagh, seeks to amend current laws to broaden the definition of protected information and what are reportable data security incidents. As of November 27, 2017, the bill is under review by the Senate Rules Committee.