Information contained in this publication is intended for informational purposes only and does not constitute legal advice or opinion, nor is it a substitute for the professional judgment of an attorney.
On Thursday, February 12, 2009, Massachusetts’ Office of Consumer Affairs and Business Regulation (OCABR) publicly disclosed key changes to the controversial Massachusetts data security breach regulations, 201 CMR 17.00. Taking into account testimony heard from business associations and employers at a public hearing last month, OCABR has further delayed the implementation deadline and somewhat loosened employers’ obligations with respect to third-party service providers and mandatory encryption requirements.
Highlights of the amendments to the regulations are:
Effective Date: Previously set to go into effect on May 1, 2009, the compliance date has been delayed until January 1, 2010.
Third-Party Service Providers: The original regulations required all employers to obtain: (a) by May 1, 2009, contractual assurances from their third-party vendors having access to Massachusetts residents’ personal information that the vendors are capable of safeguarding this information; and (b) by January 1, 2010, written certifications from each vendor that it has adopted a comprehensive information security program in compliance with Massachusetts regulations (201 CMR 17.00 et seq.).
The amended regulation no longer requires that employers obtain contractual assurances or a certification of compliance from third-party vendors. Instead, the regulations now require employers to take
all reasonable steps to verify that any third-party service provider with access to personal information has the capacity to protect such personal information in the manner provided for in 201 CMR 17.00; and taking all reasonable steps to ensure that such third party service provider is applying to such personal information protective security measures at least as stringent as those required to be applied to personal information under 201 CMR 17.00.”
OCABR did not provide any guidance on how employers are expected to satisfy this requirement.
Encryption Requirements: Initially, the regulations required that employers encrypt all data that was transmitted wirelessly. OCABR’s revised rules now specifically limit this encryption requirement to data containing personal information that is transmitted wirelessly. Additionally, personal information stored on laptops and other portable devices must be encrypted by January 1, 2010.
This entry was written by Jennifer Bombard McGovern, an associate in Littler's Boston office.