Final phase of Mass. data protection law kicks in March 1
It requires companies to take measures to protect personal data of state residents
Computerworld - All companies storing personal data on Massachusetts residents have just over a month to ensure that their contractors, suppliers, technology providers and other third parties comply with a provision of a state data breach law that went into effect in March 2010.
The law (download PDF) is designed to ensure that companies holding data on Massachusetts residents have certain security controls in place .
Over the past two years, most of the provisions of the bill have already gone into effect. The last one, which deals with third-party compliance, takes effect on March 1.
After that date, all companies with personal data on Massachusetts residents will be required to have specific language in third-party contracts that obligates their vendors to employ reasonable measures for protecting personal information.
The provision is aimed at ensuring that companies select and retain companies capable of adequately protecting customer data, said Socheth Sor, an associate at Edwards Wildman Palmer LLP in Hartford, Conn.
The law does not require businesses to go out and audit their third-parties for compliance, Sor said. It simply requires businesses to get a contractual assurance from their partners attesting to their ability to protect customer data in compliance with the state standards.
"If I was contracting with a third-party service provider, I would say 'Can I see your security policies?'" Sor said. "I would require by contract that they are capable of protecting my company's information."
Though companies are not required to audit third-party firms, they should reserve the right to do so in their contract language, Sor said.
They also need to include language requiring vendors and other partners to notify them immediately of any data breach. In addition, companies need to make sure in their contracts that vendors destroy or return all personal information that the company may have provided to them upon termination of the contract.
The Massachusetts data protection law applies to all businesses that store personal information on state residents, regardless of where the companies are based.
The rules require businesses to encrypt sensitive personal information on portable devices such as PDAs and laptops or on storage media such as memory sticks and DVDs. The rules also require encryption for all personal information transmitted over a public or wireless network.
In addition, the law requires businesses to take reasonable steps to control logical and physical access to sensitive customer data and for limiting the amount of personal data they collect, store and share.
The rules were crafted by the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) and were originally supposed to go into effect Jan. 1, 2009. The deadline was extended twice as a result of considerable resistance from businesses, many of whom were concerned about its provisions.
The third-party contract requirement about to take effect was one major sticking point. As originally written, the provision would have required businesses to take far more elaborate measures to ensure third-party compliance with the state law. The provision was heavily revised following strong protests from several industry groups and large companies, including Microsoft, Google, Target and Wal-Mart.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
- Teen nabbed in Heartbleed attack against Canadian tax site
- Heartbleed bug can expose private server encryption keys
- FTC can sue companies hit with data breaches, court says
- 5-year-old hacks Xbox, now he's a Microsoft 'security researcher'
- State AGs probe Experian subsidiary's data breach
- NSA sniffing prompts Yahoo to encrypt traffic between its data centers
- Banks withdraw data breach claim against Target
- Bank abandons place in class-action suit against Target, Trustwave
- Banks' suit in Target breach a 'wake-up call' for companies hiring PCI auditors
- Gameover malware takes aim at Monster.com and CareerBuilder.com
Read more about Privacy in Computerworld's Privacy Topic Center.
- Data Warehouse Augmentation: The Queryable Data Store While organizations have, to date, been busy exploring and experimenting, they are now beginning to focus on using big data technologies to solve...
- Rebranded Quadmark revamps its IT solutions with Google Apps Switching to Google Apps halved Quadmark's IT admin costs while achieving 10% time savings per employee. The global consulting firm now spends 80%...
- CrashPlan PROe Security Because mobile laptops often are connected to unsecured networks, a very high standard of security is required to ensure privacy.
- Protecting Digitalized Assets in Healthcare Healthcare providers face an urgent, internal battle every day: security and compliance versus productivity and service. For most healthcare organizations, the fight is...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- Make or Break: New Auto Products Must Go To Market On Time This Webcast quantifies the value of time to market for the auto industry and highlights how Primavera Enterprise Portfolio Management can help organizations. All Data Storage White Papers | Webcasts