BOSTON – Businesses that handle personal information of Massachusetts residents must conform to the state’s new data security regulations starting March 1.
The changes in regulations regarding personal information are aimed at preventing identity theft, particularly at small businesses, and they mandate new operational requirements similar to those already applied in the banking industry to protect personal information.
Seifert Systems Invests in Energy Efficiency to Strengthen Operations
For manufacturers, energy is more than just another operating expense. It plays a critical role…
Learn More
Personal information, according to the new regulation, is defined as “a resident’s first name and last name or first initial and last name in combination with any or more of the following data elements that relate to such a resident: (a) Social Security number; (b) driver’s license number or state-issued identification card number; or (c) financial account number, or credit or debit card number.”
Among the new requirements, businesses must provide a formal, written information security program; designate an employee to manage the security program; implement encryption where necessary and technically feasible; and verify the compliance of third parties with the regulation.
“The new regulation is drafted to apply regardless of where a business is located, within or outside of Massachusetts, if the business owns, licenses, stores or maintains personal information,” Roger Hood, an attorney with the Providence law firm Duffy & Sweeney Ltd., said in an e-mail to clients. “Although enforcement of this new regulation for out-of-state businesses will certainly be challenged, the trend toward information security is ever growing.”
Additional information is available at mass.gov.
