Massachusetts privacy law calls for tighter information security
November 25th, 2008 by Peet Rapp[NOTE: New information is available at this link about the Massachusetts Privacy Law, which has evolved since this original post.]
The Commonwealth of Massachusetts enacted a law in September protecting state citizens’ personal information. Originally scheduled for January 1, 2009, the law will now take effect for all Massachusetts businesses and third party providers beginning May 1, 2009, with other requirements coming into effect January 1, 2010. The law intends to protect employee personal information from unauthorized access and possible exploitation.
Personal information to be protected includes a person’s name and address, combined with complete social security number, driver’s license or other state-issued number, complete credit card or bank account numbers.
Companies that do keep this information will need to take some prescribed steps towards compliance. They must:
1. Establish written policies and procedures for the protection of these files, both in the electronic and physical formats.
2. Be able to justify the need for all such information kept in house. Obviously employee data is needed to for tax, 401K, and insurance withholdings. But for client records is it possible to only maintain the last four digits of a credit card number?
