Clicky

Header graphic for print
InfoLawGroup privacy. security. technology. media. advertising. intellectual property.

Tag Archives: Massachusetts

Massachusetts’s Highest Court Delivers BJ Wholesalers (and other Retailers) a Data Breach Liability Gift

Posted in Damages, PCI

While the proverbial jury is still out concerning retailers’ sales success this 2009 holiday season, Massachusetts’s highest court (the Supreme Judicial Court or “Supreme Court” as referenced herein) delivered retailers a significant holiday gift in the form of an opinion slamming the door on some financial institutions seeking to recover reissuance costs arising out a… Continue Reading

Analyzing the Risk-Based Factors of Massachusett’s Data Security Law

Posted in Massachusetts 210 CMR 17.00

SearchSecurity.com published an article by me yesterday (Interpreting ‘risk’ in the Massachusetts data protection law) concerning the risk-based elements of Massachusetts’ data security regulation (201 CMR 17.00, et. al). The gist of the article is that any company that chooses anything less than “strict compliance” with the specific written information security policy (“WISP”) and control requirements of the regulation must be able to legally support their decision based on the regulation’s risk elements. What this amounts to is developing a legal opinion interpreting and applying those risk-based factors to the organization’s particular circumstances.

Massachusetts’ Revised Personal Information Security Regulation (201 CMR 17.00)

Posted in Data Privacy Law or Regulation

Massachusetts’ Office of Consumer Affairs & Business Regulation (OCABR) recently released a revised version of its “Standards for the Protection of Personal Information of Residents of the Commonwealth” (the “Regulation”). This August 2009 version modifies the February 2009 version of the Regulation. The press release for the new revision is here, and the FAQs released by OCABR appear updated to address some of the changes in the regulations.
For ease of reference, ISC has taken the time to create a REDLINED VERSION showing the revisions in the new Regulation. The redlines indicate changes between the February 2009 version and the August 2009 version of the Regulation. Also included below is a summary of some of the more significant changes.