New Data Security Regulations to Take Effect in Massachusetts on March 1st, 2010
The scramble in on as companies seek to comply with the identity theft regulations adopted in Massachusetts and touted as 'the first of their kind in the country' which are scheduled to take effect on March 1, 2010.
The effective date’s announcement followed a report indicating there have been over one million instances of Massachusetts residents’ personal information being exposed in two years. “We hope these regulations will make it harder for information to get into the wrong hands, and lower the number of instances of data being lost or stolen,” said Barbara Anthony, the Undersecretary of the Office of Consumer Affairs and Business Regulation (OCABR).
While M.G.L. c. 93H was passed in 2007, controversy emerged over how to pursue some of the law’s objectives under the regulations. After repeated postponements and revisions—brought upon largely by changes in the economic climate as well as compliance concerns of businesses— the regulations are now set to take effect on March 1st.
“We heard testimony from a wide range of sources, and the message was that we have struck the right balance. We created regulations that are protective of consumers without being onerous to businesses,” Undersecretary Anthony said.
The regulations, known as 201 CMR 17 (PDF file), are designed to help preserve privacy by increasing the level of security on personal information. These regulations apply to those that own or license “personal information” about a Massachusetts resident. Personal information includes a resident’s first name and last name (or first initial and last name) in combination with their: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, that would permit access to a resident’s financial account.
The regulations require businesses take a risk-based approach and develop, implement, and maintain a written comprehensive information security program containing administrative, technical, and physical safeguards appropriate to the size, scope, and type of business. The written security plan takes into account the amount of resources available; the amount of stored data; and the need for security and confidentiality of both consumer and employee information. Further, the written security plan also requires a comprehensive security system be included which covers computers with access to the stored personal information (including any wireless system.)
The regulations set minimum requirements to the extent they are technologically feasible. For instance, encryption of personal information is required for: a) transmitted records and files that will travel across public networks, b) data transmitted wirelessly, and c) information stored on laptops or other portable devices. Further, the security system requirements for computers require other protocols be adopted and followed (e.g. passwords, training, restrictive and monitoring efforts, as well as firewall, malware, and other updated protections.)
In examining reported data breach incidents, OCABR found that less than 3% involved data that was encrypted when breached. In addition, they found 60% of the reported incidents were the result of criminal/unauthorized acts, with a high frequency of laptops or hard-drives being stolen, and that roughly 40% of the total incidents were the result of “employee error or sloppy internal handling of personal information or other data.”
The OCABR report adds, “[t]his confirms that any regulatory regime must include both measures that protect against intentional wrongdoing and measures that focus on establishing internal protocols that set minimum standards for handling sensitive paper and electronic records.” These concerns, and others, lie at the foundation of the adopted regulations.
In sum, the new regulations seek to balance consumer protections with business concerns. Business owners should review the regulations fully as the requirements are comprehensive and may require time and effort to comply with. In addition, there are also extended deadlines and requirements for businesses that contract with third parties. To learn more about identity theft protection, visit the Office of Consumer Affairs and Business Regulation website at www.mass.gov/consumer.
