|
On March 1, 2010, the Massachusetts “Standards for the Protection of
Personal Information of Residents of the Commonwealth,” the most
stringent state regulations governing the protection of an individualR=
17;s
personal information in either electronic or paper form, will go into
effect. It is critical t=
hat
businesses nationwide recognize that they may be impacted to the extent t=
hey
conduct business with, or provide services to,
Massachusetts’ residents (e.g., allow them to register for contests=
or
purchase goods or services online).&=
nbsp;
Massachusetts joins various other states, including
California, New York, Maryland, Michigan, Connecticut, and Texas,
that require security policies and procedures for entities collect=
ing
and using sensitive and confidential personal information. However, the Massachusetts
regulations, which implement a relatively new data security statute, are =
the
most comprehensive and detailed, setting the bar for national companies a=
nd
other businesses that reach Massachusetts residents via the Internet or
offline. The penalties for
non-compliance can be significant and include fines of up to $5,000 per
violation and possibly investigation and litigation costs and reasonable
attorneys’ fees, civil suits brought by the Massachusetts Attorney
General, and private rights of action with the potential for class action
lawsuits.
The effect of these new regulations is national in scope, insofar as they=
set
forth heightened security standards that must be met by any entity that o=
wns,
licenses, receives, stores processes, maintains or otherwise has access to
personal information in electronic or paper form about a
Massachusetts resident, including employees, customers and clients. In other words, if your business
collects personal information from residents of Massachusetts, regardless=
of
where your business is located, it must comply with these regulations. “Personal information̶=
1; is
defined as the first name and last name or
first initial and last name of a Massachusetts resident and (i) the resident’s Social Security number; (=
ii)
driver’s license or state-issued identification number; or (iii)
financial account number, credit card or debit card number, with or witho=
ut
any required security code, access code, PIN or password that would permit
access to the resident’s financial account.
Every entity subject to these regulations must develop, implement, mainta=
in
and monitor a comprehensive wr=
itten
information security program that is “reasonably consistent with
industry standards” and contains “administrative, technical a=
nd
physical safeguards” to ensure the security and confidentiality of =
such
information. This includes =
any service
provider with access to personal information that is engaged by another
business. Compliance with t=
hese
regulations will be assessed against a sliding scale of risk factors that
take into account (i) the size, scope and type of business of the subject
entity, (ii) the amount of resources available to the entity, (iii) the
amount of stored data and (iv) the need for security and confidentiality =
of
both consumer and employee
information.
At a minimum, the written plan must:
- Designate one or=
more
employees to maintain the comprehensive information security program=
.
- Identify and ass=
ess
reasonably foreseeable risks to the security, confidentiality, and/or
integrity of any electronic, paper, or other records containing pers=
onal
information, and evaluate and improve, where necessary, the
effectiveness of the current safeguards for limiting such risks (e.g=
.,
full time, temporary and contract employee training and procedures f=
or
detection and prevention of security system failures).
- Include security=
policies
for employees relating to storage, access, and transportation of rec=
ords
containing personal information outside of the business’s
premises.
- Set forth reason=
able
steps to be taken to select and retain third party service providers
capable of maintaining appropriate security measures; and contractua=
lly
require such third party service providers to implement and maintain
appropriate security measures for personal information.
- Contain provisio=
ns to reasonably
restrict physical access to records with personal information, and s=
tore
such records and data in locked facilities.
- Provide for regu=
lar
monitoring of the security program to ensure that it operates in a
manner reasonably calculated to prevent unauthorized access to, or
unauthorized use of, personal information.
Entities covered by=
the new
regulations must:
- Impose disciplin=
ary
measures for violations of the security program.
- Prevent terminat=
ed
employees from accessing records containing personal information.
- Review the scope=
of the
program at least annually or whenever there is a material change in
business practices that reasonably implicates the security or integr=
ity
of records containing personal information.
- Document respons=
es to
any incident involving a security breach and conduct mandatory
post-incident reviews of events and actions taken, if any, to make
changes in business practices relating to protection of personal
information.
The written security program also must establish and
maintain a security system that covers the entity’s computers,
including any wireless systems (e.g., laptops, mobile phones and PDAs) th=
at
can access or store personal information. The system must include (i) user
authentication protocols (e.g., control of user IDs, reasonably secure me=
thods
for assigning and selecting passwords, etc.), (ii) secure access control
measures, (iii) encryption of all personal information that will travel
across public or wireless networks or via mobile devices, (iv) monitoring=
of
systems for unauthorized use of, or access to, personal information, and =
(v)
encryption, firewall, and malware protection. Entities subject to these regula=
tions
must also regularly educate and train employees (temporary, contract and =
full
time) on the written security policy and procedures, the proper use of
computer security systems, and the importance of computer security.
As noted above, these new regulations go into effect=
on March 1, 2010. Other data security requirements=
under
new Massachusetts laws are already in effect, such as data breach notific=
ation
and disposal requirements, which carry penalties up to $50,000. If your company or any of its
subsidiaries collect personal information from Massachusetts residents for
contests/sweepstakes prize fulfillment, website registration, loyal liste=
ner
club registration, the online sale of goods or services, or for any other
reason, you should therefore begin developing the written security program
described above as soon as possible.&nbs=
p;
If you have any questions regarding these regulations
and/or how to develop a comprehensive security program that complies with
Massachusetts laws or other state laws, please do not hesitate to contact=
S.
Jenell Trigg (strigg@lermansen=
ter.com
/ 202-416-1090); Louis Levy (ll=
evy@lermansenter.com
/ 202-416-6748); or John Bagwell (jbagwell@lermansenter.com
/ 202-416-6767).
January 13, 2010
|