Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-5562" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/01/Data-breach_securities-fraud_digital-1.jpg" alt="" width="375" height="250" />

On Jan. 10, 2019, Massachusetts Gov. Charlie Baker signed <a href="https://malegislature.gov/Bills/190/H4806">legislation</a> that will significantly amend the state’s data breach notification law. The amendments become effective on April 11, 2019.

One of the significant changes includes a new requirement to provide an offer of complimentary credit monitoring for “a period of not less than 18 months” when the data security incident involves a Massachusetts resident’s Social Security number. With this new obligation, Massachusetts joins Connecticut and Delaware as states that require an offer of complimentary credit monitoring when the incident involves a resident’s Social Security number. There was no update to the timing of any required individual notice obligations, which remains “as soon as practicable and without unreasonable delay”; but the new amendments require a rolling notification to individuals under certain circumstances: “A notice provided pursuant to this section shall not be delayed on grounds that the total number of residents affected is not yet ascertained. In such case, and where otherwise necessary to update or correct the information required, a person or agency shall provide additional notice as soon as practicable and without unreasonable delay upon learning such additional information.” Additionally, the notice to individuals must now identify the name of the parent or affiliated corporation if the organization that experienced a breach of security is owned by another person or corporation.



Other significant changes update the kinds of information required to be provided to the Massachusetts Office of Attorney General and the Office of Consumer Affairs and Business Regulation in the event of a breach of security. In addition to the information required to be provided to the state regulators under the existing law, the amendments add a requirement to inform the state regulators “whether the person or agency maintains a written information security program.” This new requirement follows from existing Massachusetts regulation that obligates “[e]very person that owns or licenses personal information about a resident of the Commonwealth [to] develop, implement, and maintain a comprehensive information security program.” 201 CMR § 17.03(1). Further, the amendments require that a person who experienced a breach of security that involves a resident’s Social Security number “file a report with the attorney general and the director of consumer affairs and business regulation certifying their credit monitoring services comply with” the new requirement to offer complimentary credit monitoring services for the duration of at least 18 months.

Massachusetts Enacts Significant Changes to Its Data Breach Notification Law