[Updated October 15, 2009 for compliance with new amendments to the regulations]

by Stephen E. Meltzer, Esq., CIPP

Breach Notification Requirements

Section 3 of Chapter 93H contains specific reporting requirements for breaches related to personal information. According to the statute, if the possessor or owner of the information knows, or has reason to know that a breach has occurred, a notification requirement is triggered. The notification must be given if there is a breach of security or if there has been an unauthorized use or acquisition of personal information. Specifically, a possessor (who is not an owner) must notify the owner of the information. The owner must notify the Attorney General, the OCABR and the affected Massachusetts resident.

According to the Attorney General website:

“The notice to the Attorney General and the Director of Consumer Affairs and Business Regulation shall include, but not be limited to: (1) the nature of the breach of security or the unauthorized acquisition or use; (2) the number of Massachusetts residents affected by such incident at the time of notification; and (3) any steps the person or agency has taken or plans to take relating to the incident.”  The AG has even provided a sample letter for the notification.

Popularity: 32% [?]

Related posts:

1. Introduction to the New Massachusetts Privacy Laws [Updated October 15, 2009 for compliance with new amendments to the regulations]...
2. New Massachusetts Privacy Laws – Who is Regulated [Updated October 15, 2009 for compliance with new amendments to the regulations]...
3. New Massachusetts Privacy Laws – Computer Security [Updated October 15, 2009 for compliance with new amendments to the regulations]...
4. New Massachusetts Privacy Laws – Data Destruction [Updated October 15, 2009 for compliance with new amendments to the regulations]...
5. New Massachusetts Privacy Laws – The WISP [Updated October 15, 2009 for compliance with new amendments to the regulations]...
6. Blue Cross Blue Shield Breach Notification – Any delay is unreasonable! The Connecticut Attorney General has requested more information from Blue Cross Blue...