Final Version of MGL 93H 201CMR 17.00 Filed

OCABR (Massachusetts Office of Consumer Affairs and Business Regulation) on October 29th, 2009 filed the "Final" version of the "Standards for the Protection of Personal Information" also know as MGL 93H 201 CMR 17.00 with the Secretary of State's office. The first issue was in September of 2008, and after more than a year of amendments to the original regulations this is the final step before the regulation takes effect on March 1, 2010. The final regulations include some further clarifications than the amendment that was released in August of this year, but are substantially similar.

The latest revisions were written in response to requests from companies and business leaders that were looking for further clarification of the regulation.

Following are the changes:

17.02 Definitions
Owns or licenses - adds the word "stores"
Service provider - adds the word "stores" and deletes the phrase provided, however that "Service provider" shall not include the U.S. Postal Service.

17.03 Duty to Protect and Standards for Protecting Personal information

Clarifies the language in section (2)(f)(2) relating to service provider contracts - A contract entered into with a third party service provider is deemed to be in compliance with this section until March 1, 2012, even if the contract does not include a requirement that the third party service provider maintain such appropriate safeguards, as long as the contract was entered into no later than March 1, 2010

"Definition of Owns or Licenses. A company owns or licenses personal information if it "receives, stores, maintains, processes, or otherwise has access to personal information in connection with the provision of goods or services or in connection with employment." The final regulations make clear for the first time that a company that "stores" the personal information of a Massachusetts resident is subject to the regulations' requirements, even if the company does not otherwise process or access such information.

Definition of Service Providers. A service provider is defined as "any person that receives, stores, maintains, processes, or otherwise is permitted access to personal information through its provision of services directly to a person that is subject to this regulation." The final regulations eliminate a previous carve-out that had stated, "‘service provider' shall not include the U.S. Postal Service." It is not clear that the OCABR intends this change to mean that a company using the U.S. Postal Service to transmit personal information must contractually require the U.S. Postal Service to implement and maintain appropriate security measures for such personal information, as it must do with other service providers. But the OCABR has stated that a company must assess the risks of using a common carrier, including the U.S. Postal Service, to transmit personal information and take steps to protect that personal information.

Amending Existing Contracts with Service Providers. The final regulations clarify prior language related to a grace period for amending existing contracts with service providers so that such contracts require the service providers to implement and maintain appropriate security measures for personal information. The regulations now make clear that a company has until March 1, 2012 to amend existing contracts with service providers to include personal information security provisions, as long as the existing contracts were entered into before March 1, 2010. As before, service-provider contracts that the company entered into after March 1, 2010, must include personal information security provisions." [1]

For a copy of the most up to date Regulation please click here.

MPICA - Massachusetts Personal Information Compliance Assessment

[1] David M. McIntosh, Lisa M. Ropple Christine Santariga - Ropes & Gray LLP Boston Office

Massachusetts Consumer Protection Law

ARE YOU IN COMPLIANCE?

Does your company store and/or maintain personal information about a resident of Massachusetts? Do you have client databases, direct deposit records, payroll files, 401K information, employee records files or a QuickBooks company database? If so you need to be aware of this new regulation.

The new Massachusetts General Law (M.G.L.) Chapter 93H requires that companies that own, license, store or maintain personal information about a resident of the Commonwealth of Massachusetts establish minimum standards in safeguarding the personal information contained in both paper and electronic records. This new law’s further purpose is to:

Ensure security and confidentiality of information consistent with industry standards;
Protect against anticipated threats or hazards to the security or integrity of information;
Protect against unauthorized access to or use of such information


NSK Inc., along with Burns & Levinson are hosting a Free Seminar at the Omni Parker House Hotel, 50 School St., Boston, MA on February 24th, 2009, explaining:

The law and how it relates to you and your company.
The implications of the law
How to assess your information technology environment and make it comply with the new regulations.

There will be three (3) 1 hour sessions during the day. For more information and to sign up please call us at 617-303-0480 X 224 and we will sign you up.

New Data Security Law - Massachusetts – Personal Information Compliance Assessment

75 Kneeland Street, Suite 201, Boston, MA 02211

Tel: 617.303.0480
Fax: 617.303.0481

http://www.nskinc.com/

Are you aware of the new Massachusetts General Law (M.G.L.) Chapter 93H?

(201 CMR 17.00: M.G.L. c. 93H)

201 CMR 17.00: Standards for the Protection of Personal information of Residents of the Commonwealth.

This regulation implements the provisions of M.G.L. c. 93H relative to the standards to be met by persons who own, license, store or maintain personal information about a resident of the
Commonwealth of Massachusetts. This regulation establishes minimum standards to be met in
connection with the safeguarding of personal information contained in both paper and electronic records. Further purposes are to (i) ensure the security and confidentiality of such information in a manner consistent with industry standards, (ii) protect against anticipated threats or hazards to the security or integrity of such information, and (iii) protect against unauthorized access to or use of such information

NSK Inc. Is!

We have a new program that will handle your company's Personal Information that is covered under the electronic records of this new law.

The New Program is Called:

M-PICA (Massachusetts - Personal Information Compliance Assessment)

Every person that owns, licenses, stores or maintains personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include in its written, comprehensive information security program the establishment and maintenance of a security system covering its computers, including any wireless system, that, at a minimum, shall have the following elements:

Secure user authentication protocols including:

1. Control of user IDs and other identifiers;

2. A reasonably secure method of assigning and selecting passwords, or use of unique identifier technologies, such as biometrics or token devices;

3. Control of data security passwords to ensure that such passwords are kept in a location and/or format that does not compromise the security of the data they protect;

4. Restricting access to active users and active user accounts only;

5. Blocking access to user identification after multiple unsuccessful attempts to gain access or the limitation placed on access for the particular system;

Secure access control measures that:

1. Restrict access to records and files containing personal information to those who need such information to perform their job duties;

2. Assign unique identifications plus passwords, which are not vendor supplied default passwords, to each person with computer access, that are reasonably designed to maintain the integrity of the security of the access controls;

3. To the extent technically feasible, encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data to be transmitted wirelessly.

4. Reasonable monitoring of systems, for unauthorized use of or access to personal information;

5. Encryption of all personal information stored on laptops or other portable devices;

6. For files containing personal information on a system that is connected to the Internet, there must be reasonably up-to-date firewall protection and operating system security patches, reasonably designed to maintain the integrity of the personal information.

7. Reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, or a version of such software that can still be supported with up-to-date patches and virus definitions, and is set to receive the most current security updates on a regular basis.

8. Education and training of employees on the proper use of the computer security system and the importance of personal information security.


17.05: Effective Date
These regulations shall take effect on May 1, 2009.