It's natural to compare the NY Shield Act to CCPA and GDPR. Like CCPA, the Shield Act includes biometric data in its purview. Like GDPR, the Shield Act broadly defines coverage to be any company having data of residents in its geographic scope. Unlike either of these earlier privacy regulations, however, the Shield Act mandates a "reasonable security" program, and goes on to define quite specifically what that means. It includes identifying external risks and implementing a vendor cybersecurity due diligence program that ensures providers are able to maintain safeguards. The Shield Act departs significantly from CCPA and GDPR by mandating notification for "unauthorized access to private information," where the other laws only require it when there is an actual breach. But where NY Shield Act may have its greatest impact is the enforcement authority it empowers: the NYS Attorney General. NY's chief legal office has a history of aggressive legal action, and for this reason, companies that are "in scope" for this very well-crafted new privacy law will be well advised to pay attention!  Read Less