Final phase of Mass. data protection law kicks in March 1
It requires companies to take measures to protect personal data of state residents
Computerworld - All companies storing personal data on Massachusetts residents have just over a month to ensure that their contractors, suppliers, technology providers and other third parties comply with a provision of a state data breach law that went into effect in March 2010.
The law (download PDF) is designed to ensure that companies holding data on Massachusetts residents have certain security controls in place .
Over the past two years, most of the provisions of the bill have already gone into effect. The last one, which deals with third-party compliance, takes effect on March 1.
After that date, all companies with personal data on Massachusetts residents will be required to have specific language in third-party contracts that obligates their vendors to employ reasonable measures for protecting personal information.
The provision is aimed at ensuring that companies select and retain companies capable of adequately protecting customer data, said Socheth Sor, an associate at Edwards Wildman Palmer LLP in Hartford, Conn.
The law does not require businesses to go out and audit their third-parties for compliance, Sor said. It simply requires businesses to get a contractual assurance from their partners attesting to their ability to protect customer data in compliance with the state standards.
"If I was contracting with a third-party service provider, I would say 'Can I see your security policies?'" Sor said. "I would require by contract that they are capable of protecting my company's information."
Though companies are not required to audit third-party firms, they should reserve the right to do so in their contract language, Sor said.
They also need to include language requiring vendors and other partners to notify them immediately of any data breach. In addition, companies need to make sure in their contracts that vendors destroy or return all personal information that the company may have provided to them upon termination of the contract.
The Massachusetts data protection law applies to all businesses that store personal information on state residents, regardless of where the companies are based.
The rules require businesses to encrypt sensitive personal information on portable devices such as PDAs and laptops or on storage media such as memory sticks and DVDs. The rules also require encryption for all personal information transmitted over a public or wireless network.
In addition, the law requires businesses to take reasonable steps to control logical and physical access to sensitive customer data and for limiting the amount of personal data they collect, store and share.
The rules were crafted by the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) and were originally supposed to go into effect Jan. 1, 2009. The deadline was extended twice as a result of considerable resistance from businesses, many of whom were concerned about its provisions.
The third-party contract requirement about to take effect was one major sticking point. As originally written, the provision would have required businesses to take far more elaborate measures to ensure third-party compliance with the state law. The provision was heavily revised following strong protests from several industry groups and large companies, including Microsoft, Google, Target and Wal-Mart.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- Hackers steal user data from the European Central Bank website, demand money
- Arrests made after international cyber-ring targets StubHub
- SQL injection flaw opens door for Wall Street Journal database hack
- Goodwill Industries probes possible payment card breach
- Aloha point-of-sale terminal, sold on eBay, yields security surprises
- The biggest data breaches of 2014 (so far)
- Blue Shield discloses 18,000 doctors' Social Security numbers
- PF Chang's says breach was 'highly sophisticated criminal operation'
- Breaches exposed 1 in 7 US debit cards in 2013
- New malware program targets banking data
Read more about Privacy in Computerworld's Privacy Topic Center.
- ESG Lab Report: Virident FlashMAX Connect Performance Advantage with vCache on a single Oracle instance View Now>>
- Accelerating Oracle with Preferred Reads Storage based configuration. View Now>>
- What is this "File Sync" Thing and Why Should I Care About It? All of a sudden, getting a file from your work laptop to your iPad became as simple as clicking "Save." So it's no...
- The Keys to Securing Data in a Collaborative Workplace Losing data is costly. IT professionals have spent years learning how to protect their organizations from hackers, but how do you ward off...
- The Key to Happiness: Throw out Your Data Warehouse In this webinar, Kerry Reitnauer, Director, Solution Architect at FairPoint Communications will discuss the challenges the data warehouse brought, how they migrated to...
- The Foundation You Need to Build a Better Storage Infrastructure Watch this webcast to hear how you can maximize the economics of your data center by modifying your storage footprint and power usage... All Data Storage White Papers | Webcasts