New York’s SHIELD Act could change companies’ security practices nationwide