What does Massachusetts's data breach law ask a business to do?

Who does this law apply to?

The law says a person or agency that owns or licenses personal information about a Massachusetts resident must give notice when it knows or has reason to know of a breach of security, or that the information was acquired or used by an unauthorized person or for an unauthorized purpose. The notice goes to the resident, the attorney general and the director of consumer affairs and business regulation.

A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay, when such person or agency (1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose, to the attorney general, the director of consumer affairs and business regulation and to such resident, in accordance with this chapter.

What counts as personal information?

Personal information is a first name or first initial and last name together with a Social Security number, a driver's licence or state identification card number, or a financial account or card number.

a resident's first name and last name or first initial and last name in combination with any 1 or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number;

How fast must people be told?

The text sets no number of days. Notice must be given as soon as practicable and without unreasonable delay, and it may not be held back because the total number of residents affected is not yet known.

A notice provided pursuant to this section shall not be delayed on grounds that the total number of residents affected is not yet ascertained.

Who else must be told?

Besides the attorney general and the director of consumer affairs and business regulation, the person or agency must notify the consumer reporting agencies and state agencies that the director identifies.

Such person or agency shall, as soon as practicable and without unreasonable delay, also provide notice, in accordance with this chapter, to the consumer reporting agencies and state agencies identified by the director of consumer affairs and business regulation.

Is encrypted information treated differently?

A breach of security covers unencrypted data, and encrypted data taken together with the key, where it creates a substantial risk of identity theft or fraud against a Massachusetts resident.

the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information, maintained by a person or agency that creates a substantial risk of identity theft or fraud against a resident of the commonwealth.

What if a vendor holds the data?

A person or agency that keeps personal information it does not own or license must notify the owner or licensor as soon as practicable and without unreasonable delay, and must cooperate with them.

In addition to providing notice as provided herein, such person or agency shall cooperate with the owner or licensor of such information.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.