Skip to main content

M.G.L. 93H and Data Privacy Basics

Massachusetts has enacted one of the strictest data-privacy laws in the country and is scheduled to go into effect on March 1, 2010. Any personal information that any business entity maintains or stores is subject to Massachusetts General Laws Chapter 93H, while M.G.L 93I governs the destruction of physical and electronic documents and data. Both M.G.L. 93H and M.G.L. 93I define “personal information” as a person’s last name and either his or her first name or first initial, combined with any one of the following: a social security number; driver’s license number or state-issued identification card number; financial account number, debit or credit card number, with or without any required security code, access code, personal identification number or password that would permit access to a resident’s financial account.

Guidance for business’ implementation of M.G.L. 93H can be found in 201 CMR 17.00, and creates an affirmative duty to every person that “owns, stores or maintains personal information about a resident of the Commonwealth” to “develop, implement, maintain and monitor a comprehensive, written information security program applicable to any records containing . . . personal information.” In determining whether such comprehensive security program complies with M.G.L. 93H and accompanying 201 CMR 17.00, a court will consider:
(a) the size, scope and type of business of the person obligated to safeguard the personal information under such comprehensive information security program;
(b) the amount of resources available to such person;
(c) the amount of stored data;
(d) the need for security and confidentiality of both consumer and employee information.

Any business must have a written information security program (“WISP”) that establishes security policies for the firm’s computers and wireless system, and all personal information contained therein. All personal information stored on laptops or “other portable devices” must be encrypted. All records and files, including emails, containing personal information that is transmitted across public networks or wirelessly must be encrypted “[t]o the extent technically feasible.” The written security program must include plans for systems monitoring for unauthorized use, up-to-date firewall protection, and up-to-date system security software that is set up to receive regular security updates.

Authentication protocols must include a “reasonably secure method of assigning and selecting passwords.” 201 CMR 17.04(1)(b). Assigning random complex passwords to clients would be a preferable defensive strategy. Such passwords must be controlled “in a location and/or format that does not compromise the security of the data they protect.”

With that in mind, businesses should develop a policy which includes:
(a) Encryption of all emails that contain personal information.
(b) Encryption of all personal information stored on portable devices
(c) Installation of system security agent software that is set up to receive security updates
(d) Maintenance of firewall protection for all files on a system connected to the internet.
(e) Implement a termination/Disciplinary policy for misuse of personal information.
(f) Education/Training of employees on proper use of computer security system and importance of personal information security.

Attorney Trask of Kelsey & Trask, P.C. was a cryptologic materials manager in the U.S. Marines, and has experience planning and implementing encrypted communications (voice and data) networks. If you have any questions regarding M.G.L. 93H, contact us at (508) 655-5980 or click here.

Comments

  1. We have done all of the business rules for this new law, and documented everything that needed to be documented. We added a Timeline for the Guidelines to our blog. It is very informative and can be viewed at: http://blog.nskinc.com/IT-Services-Boston/bid/20014/Your-Timeline-for-Compliance-with-MGL-93H-201CMR17-00
    or

    http://nskinc.blogspot.com/2009/10/your-timeline-for-compliance-with-mgl.html

    Cathie Briggette
    NSK Inc.

    ReplyDelete

Post a Comment

Popular posts from this blog

What is the purpose of the Divorce Nisi waiting period?

In Massachusetts the statutory waiting period after a Judgment of Divorce and before the divorce becomes final (or absolute) is called the Nisi period. After a divorce case settles or goes to trial, a Judgment of Divorce Nisi will issue and it will become Absolute after a further ninety (90) days. This waiting period serves the purpose of allowing parties to change their mind before the divorce becomes final. If the Judgment of Divorce Nisi has issued but not become final yet, and you and your spouse decide you don't want to get divorced, then you can file a Motion to Dismiss and the Judgment will be undone. Although many of my clients who are getting divorced think the idea of getting back together with their ex sounds crazy, I have had cases where this happened. In addition to offering a grace period to change your mind, the Nisi period has three other legal effects: 1. The most obvious effect of the waiting period is that you cannot remarry during the Nisi period, be

Does a Criminal Record affect Child Custody?

If one of the parents in a custody case has a criminal record, the types of crimes on their record could have an effect on their chances of obtaining custody. In custody cases the issue is always going to come down to whether or not the best interests of the child might be affected. In the most extreme case, in which one parent has been convicted of first degree murder of the other parent, the law specifically prohibits visitation with the children until they are of a suitable age to assent. Similarly, but to a less serious degree, in making custody and visitation determinations the court will consider crimes that would cause one to question the fitness of a parent. These types of crimes would obviously include any violent crime convictions which could call into question whether the children would be in danger around a parent who has shown themselves to resort to violence when faced with conflict. In addition, drug and alcohol abuse offenses would call into question a parent&#

What happens after my Divorce Agreement is approved by a Judge?

If you filed a Joint Petition for Divorce in Massachusetts then you will participate in an uncontested divorce hearing and the Judge will then issue Findings of Fact the day of the hearing.  A Judgment of Divorce Nisi will issue after thirty (30) days, and it will become Absolute after a further ninety (90) days. This means that if you file a Joint Petition for Divorce you are not legally and officially divorced until 120 days after the divorce hearing date. If you filed a Complaint for Divorce  then your case will end either with a trial (if you don't settle) or an uncontested divorce hearing (if you settle).  If you reach an Agreement, then a Judgment of Divorce Nisi will issue and be effective as of the date of the uncontested divorce hearing, and it will become Absolute after a further ninety (90) days. This means that if you file a Complaint for Divorce you are not legally and officially divorced until 90 days after the divorce hearing date. Therefore, for 90 - 120 day