Massachusetts

Who Is Covered?

A person or agency that owns or licenses data that includes personal information about a resident of Massachusetts. Mass. Ann. Laws ch. 93H, § 3(b).

“Agency” means any agency, executive office, department, board, commission, bureau, division or authority of the commonwealth, or any of its branches, or of any political subdivision thereof. Mass. Ann. Laws ch. 93H, § 1.

What Information Is Protected?

“Personal information” means a resident’s first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident:

  1. Social security number;
  2. Driver’s license number or state-issued identification card number; or
  3. Financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account; provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public. Mass. Ann. Laws ch. 93H, § 1.

What Is A “Breach”?

“Breach of security” is the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information, maintained by a person or agency that creates a substantial risk of identity theft or fraud against a resident of the commonwealth. A good faith but unauthorized acquisition of personal information by a person or agency, or employee or agent thereof, for the lawful purposes of such person or agency, is not a breach of security unless the personal information is used in an unauthorized manner or subject to further unauthorized disclosure. Mass. Ann. Laws ch. 93H, § 1.

“Data” is any material upon which written, drawn, spoken, visual, or electromagnetic information or images are recorded or preserved, regardless of physical form or characteristics. Mass. Ann. Laws ch. 93H, § 1.

What Triggers Notification?

When the person or agency:

  1. Knows or has reason to know of a breach of security; or
  2. Knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose. Mass. Ann. Laws ch. 93H, § 3(b).

How Is Notice Provided To Individuals?

Timing: As soon as practicable and without unreasonable delay. Mass. Ann. Laws ch. 93H, § 3(b).

Delivery: Notice may be by:

  1. Written notice;
  2. Electronic notice, if notice provided is consistent with the provisions regarding electronic records and signatures set forth in § 7001 (c) of Title 15 of the United States Code; and chapter 110G; or
  3. Substitute notice, if the person or agency required to provide notice demonstrates that the cost of providing written notice will exceed $250,000, or that the affected class of Massachusetts residents to be notified exceeds 500,000 residents, or that the person or agency does not have sufficient contact information to provide notice. Mass. Ann. Laws ch. 93H, § 1.

Content: The notice to be provided to the resident shall include, but shall not be limited to:

  1. The resident’s right to obtain a police report;
  2. How a resident may request a security freeze and the necessary information to be provided when requesting the security freeze;
  3. That there shall be no charge for a security freeze; and
  4. Mitigation services to be provided pursuant to this chapter.

The notice must not include the nature of the breach of security or unauthorized acquisition or use, or the number of residents of the commonwealth affected by said breach of security or unauthorized access or use. Mass. Ann. Laws ch. 93H, § 3(b).

If the breach involves a social security number, the covered person must contract with a third party to offer to each resident whose social security number was disclosed in the breach of security or is reasonably believed to have been disclosed in the breach of security, credit monitoring services at no cost to said resident for a period of not less than 18 months. A person that experienced a breach of security shall not require a resident to waive the resident’s right to a private right of action as a condition of the offer of credit monitoring services. Mass. Ann. Laws ch. 93H, § 3A(a), (b).

Is Notice To The Government Required?

Yes. The person or agency that experienced the breach of security shall provide a sample copy of the notice it sent to consumers to the attorney general and the office of consumer affairs and business regulation. A notice provided pursuant to this section shall not be delayed on grounds that the total number of residents affected is not yet ascertained. In such case, and where otherwise necessary to update or correct the information required, a person or agency shall provide additional notice as soon as practicable and without unreasonable delay upon learning such additional information. Mass. Ann. Laws ch. 93H, § 3(b).

The notice to be provided to the attorney general and said director, and consumer reporting agencies or state agencies if any, shall include, but not be limited to:

  1. The nature of the breach of security or unauthorized acquisition or use;
  2. The number of residents of the commonwealth affected by such incident at the time of notification;
  3. The name and address of the person or agency that experienced the breach of security;
  4. Name and title of the person or agency reporting the breach of security, and their relationship to the person or agency that experienced the breach of security;
  5. The type of person or agency reporting the breach of security;
  6. The person responsible for the breach of security, if known;
  7. The type of personal information compromised, including, but not limited to, social security number, driver’s license number, financial account number, credit or debit card number or other data;
  8. Whether the person or agency maintains a written information security program; and
  9. Any steps the person or agency has taken or plans to take relating to the incident, including updating the written information security program.

Is Notice To Credit Reporting Agencies Required?

Yes. See above.

Are There Security Measure Standards?

No, but see Mass. Ann. Laws ch. 93I, §§ 1, 2 and 3 for the standards for disposal of records containing personal information.

What Are The Possible Consequences Of A Violation?

The attorney general may bring an action pursuant to Mass. Ann. Laws ch. 93A, § 4 [temporary restraining order or preliminary or permanent injunction] against a person or otherwise to remedy violations of this chapter and for other relief that may be appropriate. Mass. Ann. Laws ch. 93H, § 6.

Are There Any Exemptions/Exceptions?

A person who maintains procedures for responding to a breach of security pursuant to federal laws, rules, regulations, guidance, or guidelines, is deemed to be in compliance with this chapter if the person notifies affected Massachusetts residents in accordance with the maintained or required procedures when a breach occurs; provided further that the person also notifies the attorney general and the director of the office of consumer affairs and business regulation of the breach as soon as practicable and without unreasonable delay following the breach. The notice to be provided to the attorney general and the director of the office of consumer affairs and business regulation shall consist of, but not be limited to, any steps the person or agency has taken or plans to take relating to the breach pursuant to the applicable federal law, rule, regulation, guidance or guidelines; provided further that if said person or agency does not comply with applicable federal laws, rules, regulations, guidance or guidelines, then it shall be subject to the provisions of this chapter. Mass. Ann. Laws ch. 93H, § 5.