Massachusetts extends compliance deadline on data security rules — again
State bows to pressure, gives businesses until next January to comply with new regulations on securing personal data
Computerworld - For the second time in three months, Massachusetts officials have pushed back the deadline for companies to comply with a controversial set of data security regulations that the state announced last September.
In addition to the deadline extension, which was announced late yesterday, the state's Office of Consumer Affairs and Business Regulation (OCABR) also revised a key provision in the regulations that had prompted considerable concern within the business community both inside and outside of Massachusetts.
Under the new deadline, businesses now have until the start of next year to comply with the regulations, which are aimed at protecting the personal data of Massachusetts residents (download PDF). Prior to the extension, the compliance deadline was May 1. That date was set in November, when the OCABR extended its original deadline of Jan. 1.
In a statement yesterday, OCABR undersecretary Daniel Crane said that given the importance of the data-protection mandate, state officials decided it was necessary to give companies more time to make the necessary changes to their systems and business processes. Crane also cited the economic recession. "We understand the impact of the current business environment, and feel [next January] is an appropriate time frame for companies to implement the necessary protections," he said.
As part of the revisions, state regulators also removed an especially contentious requirement mandating that companies get third parties with access to customer data to attest that they were compliant with the regulations as well. In addition, that provision also required third-party services providers to include language in their contracts specifying that they were willing and able to comply with the security rules.
Under the revised regulations, companies only have to take "reasonable steps" to verify that any third-party providers with access to personal data have the ability to protect the information through measures that are comparable to the ones spelled out by the OCABR.
Deborah Birnbach, an attorney at Goodwin Procter LLP in Boston who has been working with clients on compliance issues related to the regulations, said the changes are a definite improvement over the original rules, which she claimed would have required companies to rewrite their vendor contracts. Such a requirement would have been unreasonable, according to Birnbach — especially in the case of large companies that typically deal with numerous third parties at any given time. "Our clients have been somewhat up in arms," she said.
At a high level, the regulations — which implement the data breach provisions in the state's consumer protection law — require any business that handles sensitive personal information on Massachusetts residents to encrypt the data while it's being transmitted over public networks or stored on mobile devices such as laptops, handhelds and memory sticks.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Legal White Papers | Webcasts