New York Imposes New CLE Requirement for Lawyers: Cybersecurity, Privacy and Data Protection

Effective July 1, 2023, as part of their biennial continuing legal education (CLE) requirements, lawyers in New York must complete 1 CLE credit hour in a new Cybersecurity, Privacy and Data Protection category of credit. New York is the first state to require attorneys to complete a CLE in this category.

Lawyers can start earning CLE credit in this new category beginning on January 1, 2023. CLE courses that lawyers take in this category before January 1, 2023 do not count toward the new requirement.

The total number of credits that lawyers must complete is still the same. So, experienced attorneys must still earn 24 CLE credit hours each biennial reporting cycle:

(Newly admitted attorneys should consult 22 NYCRR § 1500.12 and  the Cybersecurity FAQs for details about their requirements.)

Two Parts: Ethics & General

The requirements distinguish “Cybersecurity Ethics” and “Cybersecurity General." Attorneys can complete the new requirement in several ways:

• Taking Cybersecurity, Privacy and Data Protection-General,
• Taking Cybersecurity, Privacy and Data Protection-Ethics programs, or
• Taking a combination of the two: 1⁄2 credit in Cybersecurity General and 1⁄2 credit in Cybersecurity Ethics.

The Cybersecurity FAQs inform that attorneys can count a maximum of 3 credit hours of Cybersecurity Ethics (not Cybersecurity General) toward their 4-credit Ethics and Professionalism requirement. So, if an attorney earns 3 credits in Cyberseucirty Ethics, then the attorney must still earn 1 credit in Ethics and Professionalism, 1 credit in Diversity, Inclusion and Elimination of Bias and 19 credits in any category of credit for a total of 24 credits.

22 NYCRR § 1500.2(h)(1) defines Cybersecurity, Privacy and Data Protection Ethics as including:

• sources of lawyers’ ethical obligations and professional responsibilities and their application to electronic data and communication;
• protection of confidential, privileged and proprietary client and law office data and communication;
• client counseling and consent regarding electronic data, communication and storage protection policies, protocols, risks and privacy implications;
• security issues related to the protection of escrow funds; inadvertent or unauthorized electronic disclosure of confidential information, including through social media, data breaches and cyber attacks; and
• supervision of employees, vendors and third parties as it relates to electronic data and communication

22 NYCRR § 1500.2(h)(1) defines Cybersecurity, Privacy and Data Protection General as including:

• technological aspects of protecting client and law office electronic data and communication (including sending, receiving and storing electronic information;
• cybersecurity features of technology used; network, hardware, software and mobile device security;
• preventing, mitigating, and responding to cybersecurity threats, cyber attacks and data breaches);
• vetting and assessing vendors and other third parties relating to policies, protocols and practices on protecting electronic data and communication;
• applicable laws relating to cybersecurity (including data breach laws) and data privacy; and law office cybersecurity, privacy and data protection policies and protocols

FAQs for Providers

Cybersecurity, Privacy and Data Protection CLE programs must relate to the practice of law, be specifically tailored to a legal audience, and aim to increase attorneys’ professional legal competency. See Guidance for CLE Providers relating to Cybersecurity Ethics program areas and Cybersecurity General program areas.

Resources

CLE website, nycourts.gov.

Cybersecurity FAQs

Guidance for CLE Providers relating to Cybersecurity Ethics program areas and Cybersecurity General program areas.

22 NYCRR § 1500.2 Definitions — Effective January 1, 2023.

22 NYCRR § 1500.12 Minimum Requirements — for newly admitted attorneys.

22 NYCRR § 1500.22 Minimum Requirements — for experienced attorneys.