Privacy Law and Policy : Privacy Lawyer & Attorney : Kevin Whitaker Law Firm : Patient Confidentiality, Defamation, Identity Theft : Privacy Law & Policy Blog

If your identity is stolen because a company you do business with collects your personal identifying information and negligently fails to protect it, do you care what size company they are or do you feel that perhaps the offending company shouldn't be held accountable because of their "unique situation and resources." Peoples' privacy rights shouldn't be protected a little bit--depending on who is violating them--they should be protected, period.

Recall, the first set of regulations have been delayed again and again--now more delays will likely be needed for new regulations to be adopted for small businesses. On November 12, 2008, the Office of Consumer Affairs and Business Regulation (OCABR) extended the deadline for compliance with its standards for how businesses protect and store consumers' personal information. On February 12, 2009, they filed revised ID theft regulations that would take effect, Jan. 1, 2010, stating in their press release,

The regulations will take effect Jan. 1, 2010, and mandate that personal information – a combination of a name along with a Social Security number, bank account number, or credit card number – be encrypted when stored on portable devices, or transmitted wirelessly or on public networks. Encryption of personal information on portable devices carrying identity data like laptops, PDAs and flash drives must also be completed by Jan. 1, 2010, and will ensure better protection of personal information.

“It is time for businesses and other holders of personal information to ensure that consumers’ information is kept safe,” said Daniel C. Crane, the Undersecretary of the Office of Consumer Affairs and Business Regulation. “These new safeguards are fundamental standards that will keep information safer and will help businesses reinforce a vital sense of trust with customers.”

The regulations are a product of the identity theft prevention law signed by Gov. Deval Patrick. In keeping with the administration’s commitment to protecting consumers, Patrick signed an executive order last September requiring all state agencies to implement security measures consistent with the requirements in the regulations.

Since November 2007, there have been over 450 reported cases of stolen or lost personal information that have affected nearly 700,000 Massachusetts residents.  The regulations are the first of their kind in the country, and had originally been scheduled to take effect on Jan. 1, 2009. A sharp change in the business climate, along with the business community’s increased understanding of what is required to protect their customers’ identity, led to the new date.

“Businesses are becoming more aware of the urgency of this issue. To achieve the full benefit for consumers as quickly as possible, it’s worth making sure every business in the state has time to make the necessary changes to comply with these regulations,” Crane said. “We understand the impact of the current business environment, and feel this is an appropriate timeframe for companies to implement the necessary protections.”

OCABR's approach has seemed and continues to seam reasonable. This proposed legislative change (requiring new standards for small businesses), by contrast, seems rather odd. As my last post discussed a proposed legislative change which would prevent OCABR from even requiring encryption or any other specific methods in its regulations. If the regulators can't require specific methods in their regulations, in what way will the small business standards be any different that the other regulations being watered-down?

Unfortunately, enacting changes that lead to further delay simply ignores the real problem of consumer privacy invasions occurring today and which will continue while the time consuming task of formulating new regulatory schemes unfolds. Perhaps this change, however, is more about the added timing element and the further delay required to adopt, advertise, and implement new regulations. Otherwise, it's perplexing, why would legislators pass a law in the first place and not even allow  the adopted data protection regulations be implemented before tinkering with the enabling law?

Time, energy, and resources have already been expended to put a consumer data protection law in place.  Why wouldn't the legislature first see how it goes before gutting it? Were the lawmakers unaware of what they were doing when they passed the law in the first place? Or have certain lobbying efforts made the difference in a law that hasn't even gotten out of the starting blocks?

Many legislators had the courage to pass a consumer protection law to help protect people from some of the perils of the information age we find ourselves living in. The law they passed will help to safeguard peoples' personal identities and to bring protective measures into the forefront of the entire business community nationwide. I hope our legislators have the conviction to stick to their guns and to let their efforts lead the way. While no legislation by itself will be a panacea against identity theft or other data protection woes, allowing an enforceable law to proceed as currently written and planned demonstrates political conviction as well as a commitment to Massachusetts consumers.

Other parts of this series:

• Part 1
• Part 2
• Part 3

The U.K. appears to have addressed this question more frequently than in the U.S. with the U.K. often requiring individuals provide access to encrypted materials. Here are some examples:

• Animal rights activist hit with RIPA key decrypt demand - allows police to demand encryption keys or provide a clear text transcript of encrypted text.

• Regulation of Investigatory Powers Act now carries up to five-year jail sentence if data or keys not handed over.

Failure to hand over either cryptographic keys or data in a decrypted form that resides in the UK on is hosted on UK servers and affects a police or military anti-terrorism investigation could now cost the data holder up to five years in prison. All other failures to comply can lead to a maximum two-year sentence.

But the law does not authorise the government to intercept encrypted materials in transit on the internet via the UK or to attempt to have them decrypted under the auspices of the jail time penalty.

• Court of Appeal orders men to disclose encryption keys 

The Court of Appeal has said, though, that an encryption password is not in itself incriminating information and that both it and the information on the computers exist outside of and independent of the men. It said they do not have the right to refuse to divulge the keys.

The Federal Evidence Blog, discusses a U.S. case, In re Boucher,  in its post, Compelling Access to Encrypted Laptop where the court ultimately required an unencrypted computer be provided to law enforcement officials.

Fifth Amendment Privilege was not violated by compelling the defendant to provide an unencrypted version of his laptop drive ... to the government, in In re Boucher, (D.Vt. Feb. 19, 2009) (No. 2:06-mj-91) (2009 WL 424718) (unpublished) ("Boucher II") PDF

The court's decision in Boucher, however, may only apply to the unique facts in that case and not more generally. Until a body of law has emerged, there is likely to be a continued case-by-case analysis applied in encryption issues.