Skip to main content

M.G.L. 93H and Data Privacy Basics

Massachusetts has enacted one of the strictest data-privacy laws in the country and is scheduled to go into effect on March 1, 2010. Any personal information that any business entity maintains or stores is subject to Massachusetts General Laws Chapter 93H, while M.G.L 93I governs the destruction of physical and electronic documents and data. Both M.G.L. 93H and M.G.L. 93I define “personal information” as a person’s last name and either his or her first name or first initial, combined with any one of the following: a social security number; driver’s license number or state-issued identification card number; financial account number, debit or credit card number, with or without any required security code, access code, personal identification number or password that would permit access to a resident’s financial account.

Guidance for business’ implementation of M.G.L. 93H can be found in 201 CMR 17.00, and creates an affirmative duty to every person that “owns, stores or maintains personal information about a resident of the Commonwealth” to “develop, implement, maintain and monitor a comprehensive, written information security program applicable to any records containing . . . personal information.” In determining whether such comprehensive security program complies with M.G.L. 93H and accompanying 201 CMR 17.00, a court will consider:
(a) the size, scope and type of business of the person obligated to safeguard the personal information under such comprehensive information security program;
(b) the amount of resources available to such person;
(c) the amount of stored data;
(d) the need for security and confidentiality of both consumer and employee information.

Any business must have a written information security program (“WISP”) that establishes security policies for the firm’s computers and wireless system, and all personal information contained therein. All personal information stored on laptops or “other portable devices” must be encrypted. All records and files, including emails, containing personal information that is transmitted across public networks or wirelessly must be encrypted “[t]o the extent technically feasible.” The written security program must include plans for systems monitoring for unauthorized use, up-to-date firewall protection, and up-to-date system security software that is set up to receive regular security updates.

Authentication protocols must include a “reasonably secure method of assigning and selecting passwords.” 201 CMR 17.04(1)(b). Assigning random complex passwords to clients would be a preferable defensive strategy. Such passwords must be controlled “in a location and/or format that does not compromise the security of the data they protect.”

With that in mind, businesses should develop a policy which includes:
(a) Encryption of all emails that contain personal information.
(b) Encryption of all personal information stored on portable devices
(c) Installation of system security agent software that is set up to receive security updates
(d) Maintenance of firewall protection for all files on a system connected to the internet.
(e) Implement a termination/Disciplinary policy for misuse of personal information.
(f) Education/Training of employees on proper use of computer security system and importance of personal information security.

Attorney Trask of Kelsey & Trask, P.C. was a cryptologic materials manager in the U.S. Marines, and has experience planning and implementing encrypted communications (voice and data) networks. If you have any questions regarding M.G.L. 93H, contact us at (508) 655-5980 or click here.

Comments

  1. We have done all of the business rules for this new law, and documented everything that needed to be documented. We added a Timeline for the Guidelines to our blog. It is very informative and can be viewed at: http://blog.nskinc.com/IT-Services-Boston/bid/20014/Your-Timeline-for-Compliance-with-MGL-93H-201CMR17-00
    or

    http://nskinc.blogspot.com/2009/10/your-timeline-for-compliance-with-mgl.html

    Cathie Briggette
    NSK Inc.

    ReplyDelete

Post a Comment

Popular posts from this blog

What is the purpose of the Divorce Nisi waiting period?

In Massachusetts the statutory waiting period after a Judgment of Divorce and before the divorce becomes final (or absolute) is called the Nisi period. After a divorce case settles or goes to trial, a Judgment of Divorce Nisi will issue and it will become Absolute after a further ninety (90) days. This waiting period serves the purpose of allowing parties to change their mind before the divorce becomes final. If the Judgment of Divorce Nisi has issued but not become final yet, and you and your spouse decide you don't want to get divorced, then you can file a Motion to Dismiss and the Judgment will be undone. Although many of my clients who are getting divorced think the idea of getting back together with their ex sounds crazy, I have had cases where this happened. In addition to offering a grace period to change your mind, the Nisi period has three other legal effects: 1. The most obvious effect of the waiting period is that you cannot remarry during the Nisi period, be

Does a Criminal Record affect Child Custody?

If one of the parents in a custody case has a criminal record, the types of crimes on their record could have an effect on their chances of obtaining custody. In custody cases the issue is always going to come down to whether or not the best interests of the child might be affected. In the most extreme case, in which one parent has been convicted of first degree murder of the other parent, the law specifically prohibits visitation with the children until they are of a suitable age to assent. Similarly, but to a less serious degree, in making custody and visitation determinations the court will consider crimes that would cause one to question the fitness of a parent. These types of crimes would obviously include any violent crime convictions which could call into question whether the children would be in danger around a parent who has shown themselves to resort to violence when faced with conflict. In addition, drug and alcohol abuse offenses would call into question a parent&#

The Questions that Lawyers and Mediators aren't asking but should: Let's talk about Pronouns

I recently had the opportunity to train with two of the most prominent mediators in Massachusetts: John Fiske and Diane Neumann . Each time they run a training, John and Diane share what they think is the most important question for a client to answer to have an effective mediation. John says that he thought the most important question is "What do I want?" But then he will tell you, with a knowing smile, that Diane disagreed with him and she would say that the most important question for a client to answer is "Who am I?" I agree with Diane. The best lawyers and mediators ask their clients not just about what they want, but also deep questions about the clients' identity, goals, and values in order to help the clients resolve conflict in the most effective way possible. Despite knowing this, we often fail to ask clients the simplest questions when we first meet them or have them fill out an intake. We fail to give them an opportunity to answer the question “W