A state law requiring organizations that handle private information of New York residents to implement reasonable administrative, technical, and physical safeguards to protect that data from unauthorized access.