617.938.6200
Below is the copy of the Release from the Commonwealth of Massachusetts Office of Consumer Affairs & Business Regulation (OCABR).
For Immediate Release, Aug. 17, 2009
Changes balance consumer protections with business concerns
BOSTON - Aug. 17, 2009 - In keeping with Governor Deval Patrick's commitment to balancing consumer protection with the needs of small business owners, Massachusetts Undersecretary of the Office of Consumer Affairs and Business Regulation Barbara Anthony today announced adjustments to Massachusetts' identity theft regulations that maintain protections and also reinforce flexibility in compliance by small businesses.
The updated regulations will take effect March 1, 2010. The regulations make clear that their approach to data security is a risk-based approach that is especially important to small businesses that may not handle a lot of personal information about customers. Under a risk-based approach, a business, in developing a written security program, should take into account its size, nature of its business, the kinds of records it maintains, and the risk of identity theft posed by its operations.
"In listening to the concerns of small business leaders, we understand there were issues regarding the impact these regulations have on those companies," said Undersecretary Anthony. "These updated regulations feature a fair balance between consumer protections and business realities."
New language in the regulations recognizes that the size of a business and the amount of personal information it handles plays a role in the data security plan the business creates. The new language requires safeguards that are appropriate to the size, scope and type of business handling the information; the amount of resources available to the business; the amount of stored data; and the need for security and confidentiality of both consumer and employee information.
The changes, Anthony said, make clear the regulations are risk-based in implementation, not just in enforcement as had been the case in earlier versions of the regulations. In addition, the regulations are technology neutral and acknowledge that technical feasibility plays a role in what many businesses, especially small businesses can do to protect data. The overall approach is more consistent with federal law, she said.
"Whether it's a small amount of employee paperwork, or a large amount of consumer information kept on an electronic database, each requires its own appropriate level of security and protection," Anthony said. "The changes we are making reflect that reality without exposing companies or consumers to a heightened risk of theft."
The regulations are a product of the identity theft prevention law signed by Governor Deval Patrick. Governor Patrick signed an executive order last September requiring all state agencies to implement security measures consistent with the requirements in the regulations.
The Office of Consumer Affairs and Business Regulation today sent to the Secretary of State notice of public hearing on the changes. That hearing will be held on Tuesday, Sept. 22, at 10 a.m. at the Transportation Building, 10 Park Plaza, Boston.
For more information about identity theft protection, visit the Office of Consumer Affairs and Business Regulation website, www.mass.gov/consumer.
###
For Help with your identify theft protection technology decisions contact:
NSK Inc.
75 Kneeland St.
Boston, MA 02110
617-303-0480
Redline changes to MGL 93H 201CRM17.00
Your Timeline for Compliance with MGL 93H 201CMR17.00
NSK Inc Offers MPICA for compliance with the 201CMR17.00 Regulation - Let us handle the technology side of the Regulation
