Massachusetts Data Privacy Law Blog

On March 1, 2010, two years ago, the regulations associated with the Massachusetts Data Privacy Law went into effect. The regulations, found at 201 CMR 17, require business who possess “Personal Information” (PI) of Massachusetts’ residents to protect that data in fairly specific ways. Arguably, the most important aspect of the regulations was the requirement that all businesses have a “Written Information Security Program” or WISP. But there are certainly other important regulations, one of which comes into effect today, March 1, 2012.

March 1, 2012 is the deadline for those businesses who possess “PI” to address any third-party contracts where the third-party possesses or otherwise maintains PI on behalf of the business.

Let’s say you’re a large law firm who, by nature of the business, are in possession of a large amount of PI. Your firm processes hundreds or even thousands of cases each year. As each case comes to an end, the file gets boxed up and shipped out for storage for say, ten years. Contained in that box is the personal information of Massachusetts’ residents who were involved in the case. Your firm has used the same storage company for twenty years and so far things have seemingly been fine. (at least as far as you know) **NOTE: the “file” and the “box” could be, and probably are, electronic files as opposed to physical (paper) ones.

Under the regulations that come online today, your firm must now have, as part of its contract with the storage company, certain clauses or elements in that contract in order to comply with MA law. Specifically, the regulations require that the “owner” (see here: the large law firm) of the PI, must have a clause in their contract with the vendor (see here: storage company) that seeks to obtain the assurance that the vendor can protect the PI that it possess on behalf of the business.

The regulations require that owners/licensors of Personal Information of MA residents’ “oversee service providers” by selecting providers that are capable of maintaining appropriate security measures to protect PI and require by contract that the vendor implement and maintain such appropriate security measures to protect the PI. In addition, the contract should include a clause that requires the vendor, in the event of a loss or “breach” of that data, give notice to the owner as soon as is practicable and without reasonable delay. Cooperation between the owner of the PI and the vendor, or possessor of the PI is required as well. Cooperation is defined as vendor informing the owner of the breach; the date of the breach; and any steps taken by the vendor related to the breach. (M.G.L. c. 93H s. 3(a))

[ **NOTE: the above is not legal advice, and this blog post should not be considerer legal advice – if you have questions or concerns about this law, please consult competent legal counsel. ]

I suspect the large law firm who has been doing business with the storage company for twenty years will have no problem fixing up their contract. After all, the storage company wants their business.

But what about the smaller businesses who use an outside IT company to run their computer systems? Let’s say the IT company stores the client’s data on servers located in the IT company’s offices; a sort of “private cloud” arrangement since he also stores other clients’ data of these servers as well. Or what if the small business uses a behemoth like Amazon Web Services for their cloud storage of data? Will the small business be in the position to “oversee” Amazon’s internal security apparatus? These small businesses are the entities that need to be made aware of this regulation, but I fear that their education in this area is lacking.

I suppose the answers to the above questions will lie in the regulator’s definition of “oversee.” The law seems to define “oversee” as selecting entities that are capable of providing the appropriate security measures. Will having boilerplate language in your contract be enough? I guess we will have to wait and see for that answer. (Again, please consult a lawyer if you find yourself in this situation)

P.S.

March 1, 2012 is also a special date because it’s the first anniversary of the Massachusetts Data Privacy Law Blog. Its official launch, live on the Internet, was March 1, 2011… We’ve had over 11,000 visitors and several thousand are returning readers. I thank you for your interest in this blog. I try to keep it light, but at the same time convey interesting material.

Thanks for reading.

Your author,

John.

When you are born in the United States you are entitled to a "social security number." I say entitled, because it doesn't seem to be required, at least it wasn't. I didn't get mine until I was applying for my first job. My mother took me down to the Social Security Administration's office and I got myself a shiny new blue card with a number that would follow me my entire life. My children got theirs from the doctor who delivered them (kidding, but it was close in time).

When you die in the United States, apparently the Social Security Administration "re-categorizes" you as deceased in what is called the Death Master File or DMF. I can see the usefulness of that. It seems logical that you'd want to make sure that a decedent's SSN isn't used by anyone else... But what if, just maybe, the SSA listed you erroneously on the DMF? But wait, I'm not dead, in fact, I'm feeling much better now (remember Monty Python's Holy Grail..bring out yer dead scene? Hilarious).

What is the impact when you are erroneously listed on the DMF? Apparently, and according to people who were erroneously listed on the DMF, you can be turned down for loans and apartments, have bank accounts frozen and other negative events when your SSN is a required aspect. I guess the "inquirer" looks up the applicant's SSN on the DMF and if it's there, then the applicant must be dead (at least their SSN is), therefore the applicant can't have whatever it is they're asking for - because they are dead.

The DMF is apparently available for purchase, but if you buy it, you get the SSN's of living breathing humans because mistakes happen.

According to a report in the Seattle Times by Howard Scripps News Service reporter Thomas Hargrove, the news service purchased the list and then started contacting the "erroneously placed names and SSNs" to inform them that they are listed as dead. One woman said that she has been dealing with her number situation for 10 years! What a hassle.

From the article in the Seattle Times:

Social Security officials admit that, each year, they accidentally release the personal information of about 14,000 living Americans by posting their files among the records of 90 million deceased Americans.

 

WHOOPS, sorry 'bout that. Thanks for telling us though.... Oh, you didn't tell us? You don't tell us? You're not required to tell us?

Apparently the SSA takes the position that they're not required to tell those people erroneously listed that their personal information has been made available to the public, by accident. A data breach by my definition. The article doesn't clearly say that, nor do the quotes from Social Security Officials, but what other conclusion can you draw?

I know, I know, the Social Security Administration didn't KNOW that the mistake happened, otherwise, logically speaking, it wouldn't have happened. And since they didn't KNOW it happened, how could they possibly have informed the people involved?

If you read any of the pending Federal legislation regarding data breach notification requirements, you'll find that constant monitoring is required. If you have the data, it's your job to KNOW if it's been erroneously released.

If the Feds want to place these regulations on businesses across America, they should really clean up their own house first.

Yesterday, the US Senate voted to approve three bills that deal with data privacy, security and breach notification. All three would preempt the existing state laws that deal with data breach notifications, so ya, this matters.

Senator Leahy’s bill, S. 1151, “Personal Data Privacy and Security Act of 2011”, passed on party line votes with no Republican support. A few amendments were passed during the hearing, none of them fundamentally changing the original bill, but rather “tweaking” it.

Senator Feinstein’s bill, S. 1408, “Data Breach Notification Act of 2011”, also passed on party lines with no Republican support. An amendment proposed by Sen. Grassley, the Chairman of the Committee debating this bill was defeated. His amendment sought to direct all fees and fines collected due to violations of the law to lower the deficit. How dare he tell Washington what to do with the money. (Should I pay my VISA card of go buy a new pair of shoes?)

Senator Blumenthal’s bill, S. 1535, “Personal Data Protection and Breach Accountability Act of 2011”, also passed on party lines with no Republican support. One amendment proposed again by Sen. Grassley failed. It proposed to limit the ability and authority of the FTC to expand the definition of “Personal Information”, or as the Senator calls it, “Sensitive Personally Identifiable Information” (SPII).

So, no Republican support huh? Currently the Dems have 51 senators, the Republicans 47 and two independents. All things held constant we have a new law, but it’s not that simple, is it?

Blumenthal’s bill tries to do too much (102 pages). Feinstein’s bill is narrow (31 pages) and only deals with breach notifications. Leahy’s bill is somewhere in between (65 pages).

Recently the US Chamber of Commerce, a pretty influential group, wrote letters to the Senate and gave their position on the three bills. They didn’t like any of them. Of course they “lauded” the Senate’s efforts to protect the consumers, but their “client” is business not people. (oh wait, didn’t Romney just say that corporations are people?)

The Chamber dismissed Blumenthal’s bill out of hand, and rightfully so. It’s definition of personal information is about 400 words long! It gives a private right of action to the public, and as much as I can envision a million attorneys lining up to file suits and get their third, it’s not appropriate. I simply cannot see this bill getting anywhere without major revisions. Check out the Chamber's letter here: (US Chamber lett 2.pdf)

The Chamber addressed the other two in a little more detail.  They took issue with several parts of Leahy’s bill, nine sections to be specific. With regard to Feinstein’s bill, they only addressed a couple. You can read the Chamber's letter here: (US Chamber lett 1.pdf)

What’s the major differences between Leahy’s and Feinstein’s? A data security program requirement. There are other differences, and some may say they matter more, but essentially the debate will come down to whether or not the law is going to require business to have a data security program of some sort.

Leahy’s bill is very similar to Massachusetts. It discusses a “data privacy and security program”, but does not specify, as Massachusetts does, a specific required company policy (WISP in Massachusetts).

Feinstein’s bill doesn’t concern itself with any “data privacy program”, it merely requires the business to notify. Where’s the motivation to protect the data? Fear of bad press? Fear of lawsuits? Both of those fears can be easily mitigated, probably cheaper than implementing a robust data security program.

Now there are other, substantive, differences, but generally speaking the question is this: does government have to legislate business’ treatment of data or just require them to tell us when they’ve lost it?

The answer probably involves a discussion about “objective” and “motivation.” The objective seems clear, too much of individuals’ personal information is out in the wild, so let’s take better care of it. But what creates the proper motivation for businesses to do just that?

I am not a fan of having government run businesses. Government is too slow and is rarely produces cost effective results. Occasionally, however, government does have to regulate (speed limits for example). The profit motive can easily cause harm to both the economy as a whole and individuals in particular. The recent credit crisis is an excellent example.

I like Leahy’s bill because of it’s “data privacy program” requirement. It addresses the breach notification issue and once notified the government, if it chooses, could ask to see their program. In this way the business either has an answer or it doesn’t. It could make the enforcement options much easier. Did the business have a robust program, an “ok” program or none at all. I think the sanctions ordered by government would be in line with the business' level of security for the data. Oh, you didn't have a security program....POW!

The fear that Senator Grassley suggestshas little basis in fact. He says that businesses required to have a data privacy program will incur massive costs and force layoffs. I disagree. The requirements are necessary and in many instances are simply changing behavior not buying new technologies. If you’re in the business of collecting, using, or simply passing along our personal information, then you have an obligation to protect it. Didn’t we learn anything from the mortgage situation?

It would have been nice if we didn’t have to get to this point, but we are, and without swift government intervention things will not get better.

Compromise is key in politics. The Senate should not compromise our data any further than it already is…

PS – maybe the recent arrests of the LulzSec hackers will motivate the hacking to stop, and then again, maybe not.

Today, I’d like to have a look at a Federal Data Breach notification statute that’s been getting some attention. There are, by my count, five, bills pending in Washington, D.C. Want a list?

• Representative Bobby Rush – “DATA” – currently in subcommittee (Commerce, Manufacturing and Trade)
• Representative Mary Bono Mack – “SAFE Data Act” – currently in Committee (House Energy and Commerce)
• Senators Pryor and Rockefeller – “Data Security and Notification” – currently in Committee (Commerce, Science and Transportation)
• Senator Pat Lahey – “Personal Data Privacy and Security Act” – currently in Committee (Judiciary)
• The Whitehouse -  Cybersecurity Legislative Proposal 

Representative Bono Mack’s bill is the one we’re discussing today. Why? Because it’s likely to make it to at least a full House vote. Whether the Senate takes it up and the President signs it are too far off to predict. As an aside, Representative Rush’s bill, that competes with Bono Mack’s, was recently referred to the subcommittee that just approved Bono Mack’s bill. She chairs the committee, so Mr. Rush, try again next session. I can’t see Bono Mack calling for a vote on a bill that covers the same issues as hers.

The bill is known as the SAFE Data Act. It basically requires certain businesses to employ certain safeguards designed to protect data. Those requirements are eerily similar to the Mass regulations found at 201 CMR 17. The bill also requires certain businesses to inform the Federal Trade Commission and citizens of a data breach, in certain circumstances. Finally, the bill preempts certain state laws.

OK, I used the word “certain”, five times in that paragraph. I did so because the bill only applies to those companies engaged in interstate commerce. The security regulations only apply to those companies engaged in interstate commerce who are not already regulated by HIPAA or GLBA (Federal regulations for healthcare and banking industry respectively). And finally the preemption of the various state laws will affect its application to businesses… let’s briefly touch on that…

The preemption clause, in relevant part:

 …This act supersedes any provision of a statute, regulation or rule of a State…, with respect to any entity subject to this Act, that contains:

(1) requirements for information security practices or treatment of data similar to those under section 2; or

(2) requirements for notification of a breach of security similar to the notification required under section 3.

 ** Please note the “any entity subject to this act” statement. We will talk about this again.

Let me sum up the Massachusetts Data Law for you:

• Massachusetts put in place strict regulations regarding the handling of Personal Information (PI), as well as notification triggers and requirements. The law and regulations apply to ALL Massachusetts businesses. In short, if you own PI, and it’s on a mobile device, got to be encrypted. If you realize that some data went missing, and there is a SUBSTANTIAL risk of identity theft, you must report it to the Attorney General and the various citizen’s whose data went missing.

Now let me sum up the SAFE Data Act (presuming you as a company possess PI):

• If you are engaged in interstate commerce and you are not already regulated by HIPAA or GLBA, you have to have the required security safeguards in place.
• If you are regulated by HIPAA or GLBA, this law doesn’t apply to you.
• If you are not engaged in interstate commerce, then this law doesn’t apply to you.

• If you are engaged in interstate commerce, not regulated by HIPAA/GLBA, and you lose data and you make the determination that “there is no reasonable risk of identity theft, fraud or other unlawful conduct… no notification necessary.   But if you do find a “REASONABLE risk” of identity theft then you must notify the Federal Trade Commission within 48 hours, and the affected citizens within 45 days.
• If you are regulated by HIPAA or GLBA, this law doesn’t apply to you.
• If you are not engaged in interstate commerce, then this law doesn’t apply to you.

Who does the law apply to then? Companies engaged in interstate commerce who are not in healthcare or banking, I guess.

So, if you are not engaged in interstate commerce, but are a Massachusetts company, where are you? Didn’t the new Federal Law preempt the Massachusetts law, or did it just preempt the law as it applies to those entities engaged in interstate commerce. Recall the “any entity subject to this act” from above. It appears that if you are engaged in interstate commerce you are an “entity subject to this act” and exempt from the Massachusetts law, right?

I am a small accounting firm in Central Massachusetts, I do not engage in interstate commerce. I am subject to the Massachusetts Data Law and the regulations. The neighboring business happens to be involved in interstate commerce, but offers a very similar service. Do we have different regulatory schemes? Yes, it appears you do.

The goal was to make data breach notification simpler. This does it, for the very largest companies in our country. Unfortunately for the small ones in Massachusetts they will end up with a more onerous law than the one that applies to say, Walmart...

PS - Bono Mack appears to have lost the support of Rep. Henry Waxman on this bill. That might be costly. His concerns are legitimate, but big business is happy with the bill.

The Boston Herald recently reported that a whopping FIVE MILLION residents have been the "victim" of a data breach. Of course, it is very likely that in many cases the same person's information was lost several times.

The 2010 United States Census results puts the Massachusetts population at 6,547,629. Five million is 76% of our total. Just ponder those numbers for a minute... while I ask you these questions:

have you ever been a victim of a violent crime?

ever seen a violent crime in progress?

ever been a victim of a property crime?

ever seen a property crime in progress?

Chances are you haven't been a victim of violent crime, nor seen one in progress. They are rather rare events (as a percentage of our population). If you have been a victim, I sincerely hope that you were able to recover and put it behind you; I fully understand how it can impact an individual, both physically and mentally.

Property crimes are different in that they are usually crimes of opportunity. The bad guy sees something he wants, and he takes it - usually when no one is watching (thus the opportunity). There is better chance that you have either been a victim of a property crime or seen one in progress. The numbers just work that way.

We have learned how to protect ourselves, how to avoid risky situations, how to secure our belongings, in the physical world. But what about the digital world?

Do you have the slightest clue how to protect yourself in the digital world? Oh, did you just renew your Anti-Virus software - ya, that should do it...

No, you don't know how to protect yourself in the digital world. I don't, you don't, no one does. The way it is set up, it is, in many ways, beyond our control. Sure, there are "stay safe on the Internet" speeches - but those are for kids. Still important, mind you, but it's for kids. We teach those same kids "not to talk to strangers" and "don't get in a stranger's car". This is good advice, but it's the same advice for a different neighborhood.

Right now the digital world is reminiscent of the Wild West. Who tamed the bad guys back then and where are they now?

Crime in America is on the decline, and has been so for 10 years. Maybe the laws and their enforcement are working? Or maybe it's some statistical anomaly. Whatever it is, crime numbers are down.

That's in the physical world, however. In the digital world, crime is up, way up, and no one's immune. It's like 100,000 of us just parked our new BMW's in a parking lot, left the keys in the car with our GPS device, laptop, camera, and our golf clubs lying in the back seat. Oh, and there were no lights in that parking lot. Would we ever do that? Not in the physical world, but definitely in the digital one.

It's really not our fault. And not a fair comparison. In the physical world we lock our cars and hopefully put our possessions out of sight because we "know" that we risk losing them if we don't take certain precautions.

In the digital world, we just "go on the Internet" and go about our business having no idea what, if anything, is happening in the background. Have you noticed lately how long certain websites take to load? Ever watch the lower left hand corner and see what is "loading"... I assure you it's not the text you were seeking to read...  what about those links that we click... did you hear about the one where "Casey Anthony" supposedly confessed to her attorney, and it was videoed? Oh yeah, just click on the link marked "jaa" to see the confession...

Jaa is Finnish for share. And share you would if you clicked that link. Here's the story from ZDNet (and not the bad link).

Let's find a comparison in the physical world:

 "yessir, I am the valet, I know, its not usual to have a valet at McDonald's, but we're testing out a new service... great, I'll park it right over there, pal..."

Yes, you'd be an idiot to give your car to a "valet" at McDonalds, but clicking a link to see the purported confession of Casey Anthony... am I an idiot for just clicking it?

I keep asking myself the following question:

Whose responsibility is safety in the digital world?

Yesterday, May 12, Legal Talk Network aired their talk show, Lawyer 2 Lawyer. The topic: The Sony Data Breach... The host: Bob Ambrogi... The guest: ME. That's right, little 'ol me!

 It was a honor to be asked to discuss the issue. There were two guests, myself and Justin Brookman, Director, Consumer Privacy, at the Center for Democracy and Technology. Mr. Brookman had testified in Congress about data breaches only last week.

OK, the talk show is legit. They discuss real issues and have really good guests. How in the world did I end up on the show?

Maybe it's because I took a shot at the plaintiff's bar and their Sony lawsuits. (and by the way, I got voice mails and emails from people who want in on the suit, how ironic)  Or maybe it's because I try to shoot as straight as I can on these issues.

For whatever reason, I did get the opportunity and enjoyed the experience. If you have some time, have a listen.

What's really strange is that even after all these years of listening to myself try cases and elicit Grand Jury testimony, I still don't like the sound of my voice... I guess some people are just like that.

A Federal Data Privacy law has been lurking for years... and seemingly is pushed back every year due to one crisis or another. Health care reform, credit crisis, international instability, you name it, we got it. What we don't have is a comprehensive data privacy law at the Federal level but rather a bunch of state level data privacy laws leaving businesses confused or even ignorant about what their responsibilities are with regard to securing the data they possess.

Senator John Kerry has proposed a Federal Data Privacy Law, but what does it look like? Back in Decmeber, Hunton and Williams, on their "Privacy and Information Security Law Blog" posted a sneak peek overview of what the bill proposes to do.

Although not official, the hints are interesting... (from Hunton's post referencing Kerry's Senior Advisor's speech)

"...covered entities be accountable..." - does that suggest actual enforcement?

"...three rights as non-negotiable...1) all firms put in procedures in place to secure...information, 2) consumers have right to know what the firms are collecting... 3) consumers can simply opt-out.

"...safe harbor" - likely: encryption of data gets you a free pass

When President Obama instituted Health Care reform and the requirement that all Americans have health insurance did he look to Massachusetts as his model? The Federal requirements look and feel a lot like the requirements in Massachusetts... no health insurance, no tax return (at least not what you expected).

When Senator Kerry put together his Data Privacy bill, did he too look to Massachusetts, his home state, for a model? Massachusetts' Data Privacy Law is rare in that it puts affirmative obligations on businesses to DO something BEFORE a data breach as opposed to doing something AFTER a data breach.

The concern I have is the exemption that Kerry suggests for financial data covered under Gramm-Leach-Bliley Act. That act is not as robust in its protection of data as it should be. Plus, this exemption, and that "ACT (GLBA)" apply to those institutions that are the best targets for the bad guys. Why tighten the screws on the landscapers, but let the banks be "exempt". (because banks have better lobbyist? just a thought) And why didn't he exempt HIPPA?

The Massachusetts Law has language that suggests an exemption as well. Section 5 reads that essentially if your entity is subject to federal laws that have breach notification rules, then you're in compliance here. The actual language says "...maintains procedures for responding to a breach pursuant to Federal laws... is deemed to be in compliance..." So, if  your company "maintains procedures" for responding to a breach in accordance with a Federal Law... My question: how do you define "procedures". Before I grant this section fully exempt status, I'd like to get a ruling by the court.

Most states that bother to have a data privacy law require the businesses that possess certain data, personally identifiable information, to tell those individuals they lost it in the event of a data breach or data "loss". For example:

Dear Sir, I am writing to tell you that we lost certain information personal to you, like your name and social security number. Feel free to contact the 3 credit rating services we list below to see if the bad guys are using it. Sorry about the inconvenience. Signed, Business Owner.

If Senator Kerry really wants to protect individuals' information he should look to Massachusetts as the model law. He should eliminate "exemptions" and instead use the words "in conjunction with" or some other well crafted "lawyer-speak" when trying to get this law to co-habitate with other Federal regulations.

In all likelihood, business owners, industry leaders, and those influential people who "assist" law makers will not want the Massachusetts version. It creates extra work for businesses (see: "extra work = extra cost").

Informing those individuals whose information was lost is a no brainer, keeping it from happening in the first place is real protection.

This is obviously a developing story... so stay tuned.