Coronavirus: CO-OP AND CONDO ELIGIBILITY FOR PPP UNDER REVIEW IN WASHINGTON, D.C.

On April 7th, one of our professional colleagues sent a well-worded request to the New York District Office for an “interpretation” of the SBA rules that initially denied eligibility to cooperatives and condominiums for loans under the Paycheck Protection Program (“PPP”). We are advised that their letter has been “kicked upstairs” to SBA headquarters in Washington for review.

We are following up with our own letter specifically addressing the unique status of cooperatives and condominiums in New York State. Hopefully the SBA will grant some flexibility based on how co-ops and condos are organized within individual states, even if it continues to avoid a blanket determination.

Should Co-ops and Condos apply for PPP loans in the meantime?

We’re caught between legal and practical advice. The Application for a PPP loan requires the applicant to certify that “The Applicant is eligible to receive a loan under the rules in effect at the time this application is submitted that have been issued by the Small Business Administration (SBA) implementing the Paycheck Protection Program under Division A, Title I of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) (the Paycheck Protection Program Rule).” [Emphasis added.] Is that true right now?

As we have stated in prior Alerts, we think the SBA’s interpretation under the “Interim” Rules is legally incorrect. Pressure is also building among community associations nationally, as well as within New York, for the SBA to change its position. If you believe your certification is correct and that you should qualify, then you might still apply so long as you think the benefit is worthwhile. As a practical matter, the worst that might happen is that the application is simply denied.

EIDL DISASTER LOANS. So far in April, we have not heard of many associations that are experiencing substantial revenue losses from lost maintenance. (The test may come in May or June, as owners suffer the effects of layoffs or business losses.) A few associations are suffering from lost rents from commercial tenants. If an association is having trouble paying payroll or other operating expenses, it may qualify for a federal Economic Injury Disaster Loan (“EIDL”). While this type of loan may not be for everyone, it can be made to non-profits as well as for-profit businesses. It can include an emergency advance of $1,000 per [threatened] employee, up to $10,000, that can be converted into a grant. For further information, CLICK HERE for one helpful site.

NYC SMALL BUSINESS CONTINUITY LOANS. New York City had been advertising the availability of loans for up to $75,000 available at a 0% interest rate to small businesses (fewer than 100 employees) in New York City who suffered a 25% or more decrease in revenue as a result of COVID-19. Unfortunately, the City has been overwhelmed with applications and has suspended further processing.

AND IN OTHER NEWS…

The United States Tennis Association has advised that persons refrain from playing tennis during the COVID-19 emergency, recommending instead that everyone stay active and healthy with creative “tennis-at-home” variations. We will happily forward all suggestions to the USTA.

We will continue to keep you updated on new PPP developments. If you need assistance on any of our topics, please contact one of our partners on our Co-op/Condo team.

Coronavirus: CO-OP ELIGIBILITY FOR PPP LOANS QUESTIONED BY SBA. DOES A PPP LOAN MAKE SENSE FOR YOU?

A. SBA Questions Co-op Eligibility. In our earlier E-blast, we suggested that the SBA might take the position that Co-ops might not be eligible for PPP loans. So far that appears to be the case.

The SBA appears to be basing its position on portions of its “Standard Operating Procedure” handbook for loans to businesses, which states in part that certain types of businesses are ineligible for loans (except in limited circumstances), including:

“1. Businesses organized as a non-profit…

“3. a. Passive businesses owned by developers and landlords that do not actively use or occupy the assets acquired or improved with the loan proceeds…
“c. Businesses that are primarily engaged in owning or purchasing real estate and leasing it for any purpose…
“f. Apartment buildings and mobile home parks….
“g. Residential facilities that do not provide healthcare and/or medical services…”

In many other states, Co-ops are organized as non-profits. (In New York, though, they are business corporations.) One could also see the SBA claiming that Co-ops fall under one of the other exceptions noted above. As a result, many lenders have informed us that (for the moment) they are not treating Co-ops as “eligible businesses.”

We strongly disagree with the SBA’s current approach, especially for New York State cooperatives. Please Contact Your Representative and let them know that New York cooperatives must be included as businesses eligible for PPP protection. Attached are sample letters for association members to send to their representatives in Washington. Locate their e-mail addresses on the Web and make sure you make your position clear.

CLICK HERE FOR SAMPLE LETTER TO YOUR REPRESENTATIVE

CLICK HERE FOR SAMPLE LETTER TO YOUR SENATOR

What about Condos and HOA’s? As we stated in our prior E-blast, the SBA may have similar concerns for Condos and HOA’s as it does for Co-ops, e.g., deeming them to be “non-profits” or “passive” real estate operators. As with Co-ops, we can think of several technical distinctions – for example, that they are “Managers” or “Operators” rather than passive “owners” — but their status remains uncertain.

B. Putting “Forgiveness” in Perspective.

Granted, the PPP is potentially “free money.” But 75% of the amount forgiven has to be used on payroll. (“Payroll” includes benefits other than FICA.) The other 25% can be applied to amounts used largely for utilities, mortgage interest or rent. Therefore:

Monthly Payroll Maximum Forgiveness (2 mo. Payroll /.75)

$50,000     $133,000

$25,000     $66,667

$ 6,000      $16,000

Note that only a limited amount of your non-payroll costs can be forgiven. So in the first example, if your utilities are $10,000 per month you can borrow a maximum of $150,000 [2.5 x allowable costs], but you can only get forgiveness for $133,000.

From this you also need to subtract the fees of your professionals to compile the information to make the application, the 1% interest charge while the loan is pending, the difficulty of finding a bank willing to process your application, the cost of administration and the value of any unpaid time. You also need to consider the “moral hazard” of borrowing more money than you may need to pay operating expenses.

In short, even if the SBA changes its position, for non-doorman buildings with lower payroll costs, the actual benefits of the loan are relatively lower in absolute terms.

We will continue to keep you updated on new PPP developments. If you need assistance on any of our topics, please contact one of our partners on our Co-op/Condo team.

Coronavirus: PPP FEVER- NEW APPLICATION FORMS!

PPP applications were made available on Tuesday night. By Wednesday, approved SBA lenders were overwhelmed with requests for assistance. This morning, Treasury issued new application forms that are completely different from the old ones! [CLICK HERE FOR APPLICATION]

Meanwhile, we are getting the following feedback from lenders and asset managers:

1. They will give first priority to customers. They are not offering to handle anyone else.

2. They have not received any meaningful guidance from Treasury. [Update – Treasury has issued “Interim Final Rules” which were supposed to help clarify who can apply and how loan amounts are calculated, among other things, but still leave a lot of questions unanswered. [CLICK HERE FOR INTERIM FINAL RULES] We are advised that none of the large banks (like Chase, Wells Fargo) are processing applications as of this morning (lucky for them).

3. Borrowers should not panic. If the amount authorized by Congress is insufficient, they expect Congress to authorize additional funds.

4. The focus for use of these funds will be maintaining payroll.

Where to Apply; Where to Get Help. While the PPP is a windfall for borrowers, it is not a big profit center for lenders, even though Treasury Secretary Steve Mnuchin has raised the interest rate on loans from .5% to 1%. Prospective borrowers may have trouble finding a lender willing to process their application. If you’re a community association, though, you may have some options:

1. Contact your Managing Agent. Many managing agents keep your building’s funds with an approved SBA lender. So directly or indirectly, you are a customer of the bank, and your managing agent may be able to leverage the relationship into an agreement by the bank to process your application. If your bank won’t cooperate, your agent might consider changing its depository relationship to one who will.

2. Contact your Bank. If you’re a customer of the Bank, they’re going to want to keep you happy. Your lender may offer to process or your application themselves. If they’re not approved SBA lenders, they are also likely to be looking for a partner to handle the flood of applications that they are receiving to maintain good will.

3. Contact your Attorney. Your attorney may keep substantial deposits with a lender – either its own funds or down payments for residential sales. They may be able to assist you to find a lender willing to take your application.

4. Consider a Different Type of Loan or a Grant. The federal government is offering Economic Injury Disaster loans (EIDL) and emergency grants. [More on these in another memo.] The EIDL loan does not offer forgiveness, but may be quicker and more flexible than the PPP program.

Will NYS Co-ops Qualify for the PPP? Private co-ops in NY State are mostly organized under the “Business Corporation Law” and operate like other multi-family “business concerns.” But Co-ops in most other states are organized as non-profits, and in a conference call with lenders on Thursday SBA didn’t acknowledge this key difference, and actually opined that “cooperative organizations” would probably not qualify for PPP loans because they are not 501(c)(3) non-profits, so the law would need to be changed. We urged them to emphasize to the SBA that NYS Co-ops are NOT organized as non-profits and need the money as much as any other building owner — if not more.

We will keep everyone advised of the SBA’s position. In the meantime, contact your federal representatives to make sure that private cooperatives in New York are not classed with non-profits in other states.

Will HOA’s Qualify? Many Homeowners Associations are organized under the Not-for-Profit Corporation Law, so they have an additional strike against them from the point of view of the SBA. Private HOA’s also frequently seek exemption from taxation under IRC Section 528, not 501(c)(4), but Section 528 might also considered a form of “non-profit” taxation. The new rules state that “businesses” qualify. We will need to see what the SBA says on the topic.

How About Condos? Condo associations are also “business concerns” that manage common property for the benefit of their members. However, in New York State, Condos are considered “unincorporated associations.” Condos also frequently seek exemption from taxation under Section 528 of the Code, which might affect the SBA’s view of their eligibility.

Bottom Line: While waiting for definitive guidelines to come out, Co-ops, Condos and HOA’s may need to do some lobbying in Washington to protect their interests. Do it now.

We will continue to keep you updated on new PPP developments. If you need assistance on any of our topics, please contact one of our partners on our Co-op/Condo team.

Ken Jacobs kjacobs@sbjlaw.com
Tom Smith tsmith@sbjlaw.com
Emma Lupu elupu@sbjlaw.com
Domenick Tammaro dtammaro@sbjlaw.com
Eric Blaha eblaha@sbjlaw.com

Coronavirus: Paycheck Protection Program Application Form Out!

PPP APPLICATION FORM OUT!

The Treasury Department has just issued the form of Application for Paycheck Protection Program applications. The form of application is attached to this E-Mail, together with guidance from Treasury for prospective Borrowers.

Who to Believe? The Borrower’s Guidance accompanying the application states that loans will have a maturity of two years and an interest rate of .5%. The Guidance adds, “Due to likely high subscription, at least 75% of the forgiven amount must have been used for payroll.”

These statements preempt the text of the law, which provides that the loan can have a ten-year maturity date and a maximum interest rate of 4%, and imposes no limitations on the amount that must be used for payroll. We assume that the Treasury guidelines will prevail, but await reaction from lenders.

Use an Experienced Lender. Certain lenders, including many banks, have long experience making SBA loans. Do not just go to the website that promises “fast action.” Some lenders may take your information with a promise to get in touch with you when applications are issued (e.g., pursuitlending.com, a longstanding SBA lender run by a consortium of New York banks). Check with your local bank to find out if they are qualified to take yours.

By this time, summaries of the PPP abound. One good one is the Small Business Owner’s Guide to the CARES Act, put out by the U.S. Chamber of Commerce: https://www.uschamber.com/sites/default/files/023595_comm_corona_virus_smallbiz_loan_final.pdf

Do NY Homeowners Associations Qualify? On one hand, they are “business concerns” like any other real estate owner. On the other hand, the CARES act specifies that only IRS 501(c)(3) non-profits can apply. Many HOA’s were organized under the “Not-for Profit Corporation Law,” but are not 501(c)(3) charitable entities. Are they inadvertently excluded?

Other Coronavirus News

A. Landscaping back out as “essential.” The state Agriculture website, last updated on March 31st removed landscaping as an “essential service.” (The Coronavirus landscape changes day by day!) However, maintenance related to “health and safety”, such as pest management, is still permitted. We are advised by a credible source that new guidance on what constitutes an “essential service” in the horticultural arena will be coming out, hopefully by the end of the week. Townhome communities and HOA’s please take note.

B. Will the Government Allow Owners to Defer Payment of Common Charges, Maintenance and Assessments? Several lawmakers have introduced federal legislation modifying the Fair Debt Collection Practices Act to forbid collection of “consumer debts” for 90 days. The proposed legislation does not distinguish maintenance and common charges from other types of debts. Obviously, to allow owners not to pay their maintenance/common charges for three months would devastate our condos and co-ops. We will keep you advised on the progress of this legislation.

Paycheck Protection Program Application
PPP Borrower Information Fact Sheet

We will continue to keep you updated as the governmental response to the COVID-19 epidemic evolves. Please stay safe and healthy in the meantime!

Coronavirus: State & Federal Updates – Who’s “Essential” Now?

STATE UPDATES

The list of occupations deemed “essential” – which means that employers don’t have to close, and their employees don’t have to remain at home – is being refined daily. Doormen were excluded, only to be reinstated a day later. Landscapers have now been deemed “essential”, to the relief of many suburban communities. Property Managers are also considered essential to maintaining the safety of residents. So most building service personnel remain able to perform their work for the Association.

What about Construction? Initially construction was considered “essential,” without any limits, but as of Friday that changed. Now construction is barred except to protect the health and safety of building occupants, or to maintain infrastructure (roads, bridges, transit facilities) utilities, hospitals or health care facilities, affordable housing, or homeless shelters. Work required to the point of making conditions safe (if immediately stopping a project would leave it in an unsafe condition) is also permitted. Interestingly, a job utilizing only a single worker is not considered “construction work,” and therefore can continue.  Contractors are also expected to maintain “social distancing” to the extent possible.

Banning Gatherings. Executive Order 202.10 is almost five pages long, and devoted almost exclusively to expanding the ability of doctors and medical facilities to treat coronavirus victims. The very last line — almost like an afterthought — states, “Non-essential gatherings of individuals of any size for any reason (e.g. parties, celebrations or other social events) are canceled or postponed at this time.” There is no further elaboration.

What “gatherings” are deemed essential? The examples provided are all social and imply larger numbers. Can a Board meet to deal with building policy or operational issues? [We think so.]

How many people constitutes a “gathering?” Does the Board have the right to use this Executive Order to bar all visitors to the building for social purposes, or does this simply supplement a Board’s potential reliance on the “business judgment” rule to limit visitors in order to protect the health and safety of building residents? [More on that in an upcoming Client Alert.]

FEDERAL UPDATES

On Friday the government passed the CARES Act, which grants relief to a huge number of individuals and businesses. All small businesses – including cooperative corporations, condominiums, homeowners associations, property managers, building owners and contractors – should pay particular attention to the Payroll Protection Program, which grants loans and potential loan forgiveness to businesses who have incurred economic hardship due to COVID-19. We will be providing more specific information in a future Client Alert.

The CARES Act also allows multifamily building owners who have loans insured by a federal agency (like HUD), or that are purchased or securitized by FNMA (Fannie Mae) or the Federal Home Loan Mortgage Corporation, to seek forbearance on their mortgages for up to 90 days. Individual co-op and condo unit owners whose mortgages are purchased or securitized by FNMA (Fannie Mae) or the Federal Home Loan Mortgage Corporation may also be able to obtain forbearance for up to 180 days.

Governor Cuomo Issues Executive Order Amending the Corporation Law to Permit Board Member Votes by E-mail

Business Corporation Law 708(b) permits corporate boards to take action upon written approval of its members without conducting a meeting, unless such action is prohibited by the entity’s articles of organization or by-laws. NYS Executive Order 202.5 issued on March 18, 2020, in response to the COVID-19 pandemic, amends BCL 708(b):

“To the extent necessary to permit business corporations to take any action otherwise permitted under that section with the electronic consent of the members of the board or committee, when such consent is submitted via electronic mail along with information from which it can reasonably be determined that the transmission was authorized by such member.”

Boards can now avoid challenges by members or other directors to board actions taken between formal meetings and approved by emails from individual directors.

Governor Cuomo Issues Executive Order Requiring 75% Reduction In On-Site Workforce At All Locations; Union and Real Estate Industry Assert that Building Service Personnel and Managing Agents Provide “Essential Services.”

Governor Cuomo has ordered that all New York businesses, including not-for-profit businesses, shall utilize to the extent possible all telecommuting and work from home procedures. Further, the Governor ordered that every employer in the state shall reduce its in person workforce at all locations by 75% no later than March 20 8 p.m. This Order supersedes yesterday’s Order mandating a 50% reduction.

Businesses identified as “essential” are not subject to the in-person restrictions. Essential businesses include essential healthcare operations; essential infrastructure including utilities; telecommunication; airports and transportation infrastructure; essential manufacturing, including food processing and pharmaceuticals; essential retail including grocery stores and pharmacies; essential services including trash collection, mail and shipping services; news media; banks and related financial institutions; providers of basic necessities to economically disadvantaged populations; construction; and vendors of essential services necessary to maintain the safety, sanitation and essential operations of residences or other essential businesses.

Union Local 32BJ in Manhattan, supported by the Realty Advisory Board (in NYC) and the Builders and Realty Institute (in Westchester), assert that neither order covers residential building service workers (supers, porters etc.), based on the highlighted exception. An argument can also be made that managing agents are “vendors” that are essential for the safety and sanitation of residences, since someone needs to supervise, direct, order supplies, pay for supplies, collect common charges, maintenance, and rent.

Industry associations have asked for clarification from the Governor. In the meantime, owners should use their judgment as to how to implement the Order. The Governor’s office will conduct an ongoing evaluation as to whether any other businesses qualify as essential.

What Penalties Can Employers Suffer for Denying Coronavirus-Based Paid Sick Leave Requests?

Many of our clients have been consulting us regarding paid leave requests they anticipate related to the coronavirus. Employers should be aware of the penalties for an unlawful denial of such requests under paid sick leave laws enacted by Westchester County and NYC. The penalties include fines, back pay, job reinstatement and the payment of the employee’s attorneys’ fees. In the current environment, an employer’s unlawful denial of a coronavirus-based paid leave request would likely be met with palpable disdain by Westchester County and NYC agencies.

In 2019 Westchester County passed the Earned Sick Leave Law and separately passed the Safe Time Leave Law. In 2018 New York City amended its Earned Sick Time Act to provide for safe time off needed by employees and amended the title of the law to the Earned Safe and Sick Time Act. The primary purpose of these sick leave laws is to provide employees up to five days of leave to seek medical treatment for themselves or to address medical treatment needed by family members. The primary purpose of the safe leave laws is to provide up to five days of leave for employees who are victims of domestic violence and human trafficking in order to attend criminal and civil court proceedings and/or relocate to a safe location needed in those circumstances. Under these laws, employers who employ five or more employees are required to provide paid leave and employers who employ less than five employees are required to provide unpaid leave.[1]

The Westchester and NYC laws bar an employer from conditioning an employee’s use of earned sick or safe time on the employee securing a substitute worker to cover the work during the employee’s absence. Westchester County requires the employer to notify employees when they are hired of the safe/sick leave laws by providing a copy of them and written notice of how the laws apply to the employee. Westchester County employers must also display a copy of the laws in a conspicuous location accessible to employees. Similarly, NYC requires employers to provide new employees with written notice of the right to safe/sick time, including the accrual and use of such time, the calendar year of the employer, the right to be free from retaliation, and the right to file a complaint with the Department of Consumer Affairs (“DCA”) if the leave rights are not provided. Alternatively, NYC allows the employer to provide this notice by conspicuously posting the information in an area accessible to employees (herein we refer to these notices required by Westchester County and NYC as the “Notice of Leave Rights”).

Westchester County Penalties

Under the Westchester County laws, employers who willfully fail to provide the required Notice of Leave Rights are subject to a civil fine in an amount not to exceed $500 for each separate offense.  Employees who may be aggrieved can file a complaint with the Department of Consumer Protection (“DCP”), who will initially try to resolve the dispute. If that effort is unsuccessful, the DCP will hold a hearing and can issue penalties including:

(i) requiring the employer to pay the employee three times the wages that should have been paid or $250, whichever is greater, for each instance of sick time taken by an employee but unlawfully not compensated by the employer;

(ii) requiring the employer to pay the employee $500 for each instance of sick time requested by an employee but unlawfully denied by the employer and not taken by the employee, or unlawfully conditioned upon searching for or finding another employee to work; and

(iii) granting such additional relief, as it deems appropriate, such as the full amount of any unpaid earned sick time plus any actual damages suffered as a result of the employer’s violation of the law, reasonable attorneys’ fees, cost of the administrative hearing, and other monetary or equitable relief as may be appropriate including reinstatement to employment and back pay.

NYC Penalties

Under NYC’s laws, employers who fail to provide the required Notice of Leave Rights are subject to a civil fine in an amount of $50 for each separate offense       . If an employee files a complaint with the DCA, the DCA will investigate and, like the Westchester County DCP, attempt to mediate a settlement. If as a result of the investigation, the DCA believes there has been a violation, it can impose penalties, parts of which are identical to those that the Westchester County DCP can impose (i.e., (i) and (ii) below), including:

(i) for each instance of sick time taken by an employee but unlawfully not compensated by the employer, three times the wages that should have been paid under this chapter or $250, whichever is greater;

(ii) for each instance of sick time requested by an employee but unlawfully denied by the employer and not taken by the employee or unlawfully conditioned upon searching for or finding a replacement worker, or for each instance an employer requires an employee to work additional hours without the mutual consent of such employer and employee to make up for the original hours during which such employee is absent, $500;

(iii) for each instance of unlawful retaliation not including discharge from employment, full compensation including wages and benefits lost, $500 and equitable relief as appropriate; and

(iv) for each instance of unlawful discharge from employment, full compensation including wages and benefits lost, $2,500 and equitable relief, including reinstatement.

In addition, any person or entity found to be in violation of the NYC safe/sick leave law, shall be liable for a civil penalty payable to NYC not to exceed $500 for the first violation and, for subsequent violations that occur within two years of any previous violation, not to exceed $750 for the second violation and not to exceed $1,000 for each succeeding violation.

NYC passed its paid sick leave law in 2014. According to a December 2019 DCA press release, as of that date, NYC had received more than 2,000 complaints regarding safe/sick leave and collected nearly $11.5 million in combined fines and restitution for more than 35,300 workers.

Two of the City’s more notable prosecutions were against Starbucks Corp. and Chipotle Mexican Grill, Inc. Starbucks violated NYC’s safe/sick leave law by a policy that required employees to find a substitute worker to qualify for sick leave, and face corrective action including termination if they could not find one. By a settlement agreement that went into effect on December 19, 2019, Starbucks paid $26,000 to be distributed to workers previously identified as being damaged by the unlawful policy and established a $150,000 fund to compensate other claimants. Last month, after the City found that Chipotle had fired an employee for using sick leave, Chipotle agreed to pay the employee $2,500 and rehire her.

So what’s the take away? Both the NYC and Westchester County safe/sick leave laws have teeth, and employers can suffer material consequences if they fail to comply with them including with respect to a coronavirus-based claim.

[1] There are exceptions to these rules which are not addressed here, most significantly with respect to domestic workers.

Legal Issues Dealing with Coronavirus in Condos and Co-ops

Boards face new legal issues in dealing with the coronavirus epidemic, requiring them to balance the interests of the community against the rights of individual residents. What steps can Boards take to protect their residents against the spread of coronavirus in the building while avoiding liability for either acting too invasively or not doing enough?

Board Options

Sample Letter

 

Nonprofit Update: The New York SHIELD Act – The Top 5 Things You Need to Know

Nonprofit organizations are reminded that under the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act, they have until March 21, 2020 to develop and implement a data security program that contains reasonable administrative, technical and physical safeguards for protecting against unauthorized access to private information of New York residents. Here are five key things to know about the SHIELD Act.

1. The SHIELD Act applies to all businesses and nonprofit organizations.

The SHIELD Act applies to any person, business, or organization that stores personal information of New York residents. Personal information includes social security numbers, driver’s license numbers, bank account numbers, credit or debit card numbers, biometric information (such as fingerprints), and username or e-mail addresses in combination with a password or security questions. Thus, personal information includes information that an organization might ordinarily maintain about its employees, donors, volunteers, and others. The broad definition of personal information captures all employers, including nonprofit organizations.

2. The SHIELD Act contains robust minimum standards for a reasonable security program.

A data security program that contains the minimum standards set forth in the SHIELD Act will be deemed compliant. According to those standards, a data security program must, at minimum, contain the administrative, technical and physical safeguards enumerated in the statute. These include a plan for assessing reasonably foreseeable internal and external risks of unauthorized access to or use of private information and specific safeguards to control those risks. An organization that puts in place a data security program that contains the safeguards enumerated in the SHIELD Act will be found in compliance with the Act.

3. Small businesses and organizations have flexibility to adopt less stringent security safeguards.

Organizations with fewer than fifty employees, or less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets need not necessarily comply with the minimum standards under the SHIELD Act to be compliant with the Act. Rather, such small businesses may develop a security program that is appropriate for its size and complexity, given the nature and scope of the organization’s activities and the nature of the personal information collected.

4. If you are subject to health and financial data security regulations, you already comply with the SHIELD Act.

Organizations that are subject to and in compliance with health care data security regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and financial services security regulations under the Gramm-Leach-Bliley Act (GLBA) or the Cybersecurity Requirements for Financial Services Companies under regulations promulgated by the New York Department of Financial Services are deemed compliant with the reasonable security requirement and need not take further action in that regard.

5. Violation of the SHIELD Act is subject to civil action and penalties.

The Attorney General is charged with enforcing the SHIELD Act and may bring an action for civil penalties or to enjoin unlawful practices. The penalty for failing to adopt reasonable safeguards is up to $5,000 per violation. This is on top of the penalty for failing to provide the required notification in the event of a breach, which can amount to the greater of $5,000 or up to $20 per instance of failed notification, up to $250,000 per breach. The notification requirements of the SHIELD Act became effective on October 23, 2019, whereas the requirement of the establishment of a data security program takes effect on March 21, 2020.

Organizations that already have a cybersecurity policy in place should review it to ensure it is up to date and compliant with the SHIELD Act and similar data security laws in other jurisdictions in which the organization operates or from which it collects data. Those that do not have such a policy in place should evaluate the sufficiency of their internal programs and those of any third-party service provider and adopt a data security policy as soon as possible to ensure compliance with the SHIELD Act.