Massachusetts' Revised Data Security Regulations Extend Deadline (Again) and Soften Some Requirements

Posted on August 17, 2009 by Kristen J. Mathews

Undersecretary Barbara Anthony, of the Massachusetts Office of Consumer Affairs and Business Regulation, announced today revisions to Massachusetts' data security regulations, as well as an extension of the applicable compliance deadline from January 1, 2010 to March 1, 2010.  (Previous to an earlier extension, the compliance deadline was May 1, 2009.)

The revised regulations emphasize their “risk-based” approach, enabling persons covered by the regulations to tailor their information security programs to their size, scope, type of business, resources, amount of personal information, and need.  These changes were primarily intended to ease the burden of the regulations on small businesses that may not handle a significant amount of personal information, or may not have the resources to develop a sophisticated security program.  That said, the changes apply to all business, not just small businesses.

 

This shift indicates that Undersecretary Anthony, only a few months into her new position, has listened to widespread criticism of the regulations, particularly from small business leaders, and understands their potential impact. 

Importantly, the revised regulations add a “to the extent technically feasible” qualifier to all of the regulations’ computer system security requirements, meaning that encryption of personal information in transit and stored on portable devices is only required to the extent “technically feasible.”  Although “technically feasible” is not defined in the regulations themselves, a definition is provided in the Frequently Asked Questions (FAQ) that accompanied the regulations.  In addition, the regulations are technology neutral; in particular, “encryption” now includes any transformation of data into a form in which meaning cannot be assigned “without the use of a confidential process or key.”  (Some will surely argue that this new definition of “encryption” does not necessarily require encryption at all; however, the FAQ suggests that the removal of references to specific technology from the definition was intended to allow for future encryption technologies, not necessarily earlier or less secure technologies.)

Another important change regards the required oversight of service providers.  The revised regulations still require that service providers be bound to comply with the regulations’ standards, but only future service provider agreements must include such a requirement.

Additionally, the new regulations make other changes – such as deleting some of the prior regulations’ more specific requirements.

As noted by Undersecretary Anthony, "these updated regulations feature a fair balance between consumer protections and business realities."

A press release by The Associated Industries of Massachusetts (AIM) specifically expresses AIM’s appreciation for the cooperation of Secretary Barbara Anthony and the assistance of Attorney General Martha Coakley, Representative Michael Rodrigues and Senator Michaela Morrissey over the course of the last several months to develop revised regulations that answer the concerns of the business community.

Public hearings on the revised regulations will be held on September 22, 2009.

This post was contributed to by Amy Crafts, a senior Associate in Proskauer's Boston office and a member of Proskauer's Privacy and Data Security Practice Group.
Tags: , , , , ,

Massachusetts Regulators Postpone Compliance Deadline and Issue Revised ID Theft Regulations

Posted on February 13, 2009 by Brendon Tavelli

On Thursday, the Massachusetts Office of Consumer Affairs and Business Regulation (“OCABR”) revised and postponed -- for the second time -- its comprehensive data security regulations. The new deadline for all covered entities to achieve full compliance with the Massachusetts regulations is January 1, 2010. This fixed deadline replaces a tiered-compliance schedule established by OCABR in November 2008 that would have given covered entities until May 1, 2009 to install certain data security safeguards, including encrypting personal information on laptops, and until January 1, 2010 to implement more aggressive security measures. (See our prior post here.)

Responding to the concerns of the regulated community, the OCABR’s revised regulations, 201 CMR 17.00, do not require covered entities to obtain written certification of compliance with the regulations from third party service providers handling personal information on their behalf. Instead, covered entities need only take steps to verify that third party service providers are able to, and do, employ the kind of personal information security measures required by 201 CMR 17.00. The revised regulations are otherwise nearly identical to the OCABR’s earlier version, which is described here.

In the OCABR’s Thursday press release, Undersecretary Daniel Crane expressed the importance of the new regulations to Massachusetts consumers and the need for businesses to take steps toward compliance. As to the revised compliance timeframe, Crane said “[w]e understand the impact of the current business environment, and feel this is an appropriate timeframe for companies to implement the necessary protections.”
Tags: , , , , , , ,