New Mass. privacy rules start next month

BOSTON – Businesses that handle personal information of Massachusetts residents must conform to the state’s new data-security regulations starting March 1. The changes in regulations regarding personal information are aimed at preventing identity theft, particularly at small businesses, and they mandate new operational requirements similar to those already applied in the banking industry to protect personal information.
Personal information, according to the new regulation, is defined as “a resident’s first name and last name or first initial and last name in combination with any or more of the following data elements that relate to such a resident: (a) Social Security number; (b) driver’s license number or state-issued identification card number; or (c) financial account number, or credit or debit card number.”
“The new regulation is drafted to apply regardless of where a business is located, within or outside of Massachusetts, if the business owns, licenses, stores or maintains personal information,” Roger Hood, an attorney with the Providence law firm Duffy & Sweeney Ltd., said in an e-mail to clients. “Although enforcement of this new regulation for out-of-state businesses will certainly be challenged, the trend toward information security is ever- growing.” •