Security, Privacy and The Law : Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : Boston, Washington D.C.

• Robert Kramer, of the Computing Technology Industry Association (CompTIA) opened public comments with the recommendation that the OCABR's final regulations clarify what is meant by "reasonable steps" in the context of selecting third-party service providers capable of maintaining appropriate security measures.  According to Mr. Kramer, this provision of the regulations "provides little practical guidance" to businesses on what they must do in retaining service providers.  This comment was echoed by other comments from members of CompTIA.
   
• Jacob Braun of Waka Digital Media and a member of CompTIA praised regulators for adopting regulations "based on a flexible, risk-based assessment," but raised two concerns.  First, speaking on behalf of companies that manage and secure the data of their clients, Mr. Braun suggested that the definition of who "owns" the personal information should be clarified to focus on the "true owners" of the data and not necessarily to sweep in companies that merely help manage that data.  Second, Mr. Braun asked that the safe harbor cut-off date for contracts with third-party service providers, currently set at March 1, 2012, be clarified so it is clear whether companies in fact have a two year grace period after the 2010 deadline to comply with the new regulations. 
   
• Tammi Salmon of the Investment Company Institute (ICI) indicated that the ICI supports adoption of the revised regulations.  She further commented that the members of the ICI support "strong protections" but oppose "prescriptive measures that dictate the means" of implementing those protections.  Also, the ICI seeks revisions to the definition of who "owns or licenses" personal information to exclude those companies that merely reveice and process personal information.  The ICI also asked regulators to limit the definition of "person" under the regulations to exclude the government agencies of other states.
   
• Bradley A. MacDougall of the Associated Industries of Massachusetts (AIM) echoed support for the revisions to the Massachusetts regulations, which he described as "taking a significant step towards a reasonable and balanced approach."  Speaking for AIM, Mr. MacDougall did recommend greater clarity with respect to the provision requiring contracts with service providers.  In particular, MacDougall indicated that the current draft of the regulations does not indicate whether service providers themselves must agree to comply with the Massachusetts regulations, or whether less specific contract provision would comply with the requirements for service providers. [AIM's written testimony is available from AIM's website (login required)]
   
• Anne Dougherty Johnson of Tech America commented that Tech America supports the revision to the regulations' definition of "encryption" which adds flexibility to companies' compliance.  She stated that "technology neutrality will enable companies to take advantage of new technologies." 
  
  
   
• John Hearst of the Retailers Association of Massachusetts (RAM) indicated that he is "especially appreciative of the changes in the current version" of the regulations, but that RAM continues to believe that "if we are applying standards to private employers, we should be applying the same standard to government employers."  He also asked regulators to clarify whether the regulations could be enforced by individuals, as opposed to the Attorney General, under the the Massachusetts Consumer Protection Act, ch. 93A.  Finally, Hearst asked that regulators expand "technical feasibility" to expressly include "financial feasibility" so that companies are not required to immediately adopt expensive new security technology the moment it becomes available. 
   
• Socheth Sor of law firm Edwards Angell Palmer & Dodge LLP spoke at the hearing and asked regulators whether the March 1, 2012 deadline to negotiate contracts with service providers was a typo or whether the OCABR was giving businesses 2 additional years to comply with the requirement that they obtain contracts with service providers.  Ms. Sor also commented that regulators need to provide additional guidance on "what encryption means" in the context of portable devices.  She suggested that the OCABR set up a telephone hotline that businesses and individuals can call for additional guidance on complying with the regulations.  "To ensure compliance, the public needs practical guidance."
   
• Daniel J. Foley, Jr. made a statement on behalf of the Massachusetts Association of Insurance Agents (MAIA) indicating that the group believes that "protecting personal information is very important," but that there "should be a reasonable balance."  He asked that regulators hold government agencies to the same standard as it holds individuals and companies.  In addition, Foley asked the OCABR to revise the regulations to permit companies that are already in compliance with parallel federal regulations to be "deemed in compliance" with Massachusetts regulations.  He also asked that the regulations be revised to strike any requirement that companies obtain specific contractual agreements from service providers.  "Simple verification of service providers' compliance should be sufficient."  In the alternative, Foley asked that there be a special exemption granted to insurance agents so that they not be required to enter into new contracts with the insurance companies they represent.  Finally, Foley asked that the regulations expressly adopt the "risk-based approach" that is described in the OCABR FAQ released with the revised regulations.
   
• Mary Ann Clancy, commenting on behalf of the Massachusetts Credit Union League, Inc., indicated that credit unions have been subject to "more onerous" federal regulation under the Gramm Leach Bliley Act since 2001 and voiced support for the revised regulations.
   
• Jack Daniels, self-professed privacy advocate (and director of the National Information Security Group), spoke on his own behalf in criticizing the Massachusetts regulations as providing little real security.  "If the regulations are not substantially making us safer, they are an undue burden on small businesses."  He then itemized of list of deficiencies in the regulations, from failure to take an appropriate stance on encryption (the regulations having "eviscerated [the definition of encryption] to the point of being confused with password protection"), monitoring, and locating sensitive information ("if you don't know where it is, you can't secure it.").  Ultimately he indicated that "there is enough wiggle room [in the regulations] that there is now more burden than benefit."
   
• MacDonnell Ulsch of Zeropoint Risk Research, LLC observed that the requirement in the Massachusetts regulations that companies adopt information security programs that are "consistent with . . . any state or federal regulation" requires clarification.  "Does this mean that companies in Massachusetts must assess all other state laws to be in compliance?  Do we need to monitor changes in all other states' laws?" 
   
• John Murphy also raised an interesting question when he asked "Is an agent a 'third-party service provider?'"  Speaking on behalf of the American Insurance Association, he commented that forcing insurance companies to renegotiate contracts with thousands of independent insurance agents would be expensive and time-consuming.
   
• Michael Ripple of the Providers' Council, a group of healthcare organizations, indicated his support for the risk-based approach adopted by the OCABR, but also stated that many members of the Provider's Council "don't have the money" to comply and asked that the industry be exempted from the regulations.  In the alternative, he asked that the OCABR provide "an abundance of technical assistance" to help community health organizations attempting to weather the current financial crisis.
   
• Sarah Cortez, a network security engineer, spoke on her own behalf in support of technology neutral regulations.
   
• Stuart Zimmerman, also representing himself, admonished regulators that pushing the compliance deadline back was having a negative affect.  "The more the date pushes back, the less serious businesses take them."  He expressed a need for "more safe harbors and models."

[Eds. Note: the conditions at the hearing were such that many comments became inaudible the moment someone sneezed or coughed, opened the door or when the HVAC engineer (and his chirping radio) came to inspect the thermostat as the temperature climbed above 80 degrees.  We are more than happy to post attendees' written comments to clarify their intended messages.]

Scott D. Schafer is the Chief of the Consumer Protection Division of the Massachusetts Attorney General, the division charged with enforcing the laws and rules governing breach notification and information security programs.  Here are some of the highlights from his presentation:

• Mr. Schafer confirmed that he is the one that reads and responds to notification letters directed to the Attorney General.  (Having spoken with Mr. Schafer on the eve of filing such letters, I find it useful to copy him on the notification letter itself.)  He underscored that businesses should give him as much advance notice as possible when making a breach notification to help his office prepare to field calls from consumers.
   
• When discussing ch. 93H, the Massachusetts law requiring notification when there is a security breach, Mr. Schafer indicated that "[e]ssentially it applies to everyone." 
   
• A "security breach" under Massachusetts law does not need to involve "personal information" if there is a substantial risk of harm.  In other words, a security breach that does not disclose a person's Social Security number or bank account number, may need to be reported if it creates a real risk to consumers.
   
• Encrypting personal information does not excuse a company from the notification requirement.  Massachusetts law requires notification whenever personal information is acquired by unauthorized individuals.  There is no exception when the personal information lost was encrypted.
   
• Massachusetts law requires notification to occur "as soon as practicable and without unreasonable delay."  Several months is generally unreasonable, but "a week or two" is generally warranted when necessary to investigate and provide consumers with accurate information.
   
• When there has been a breach, credit monitoring is not required by Massachusetts law, but it is good practice.
   
• In a notification letter, the Office of the Attorney General looks for a description of what the company is doing to make sure this sort of breach will never happen again.
   
• If a hacked has successfully penetrated a company's security it may not be possible to determine whether the hacker accessed personal information.  In such cases, it is good practice to make a ch. 93H notification.
   
• If you send personal information by mail / FedEx / UPS and the package is misdelivered or lost, it is good practice to make a ch. 93H notification (unless the package is promptly recovered unopened).
   
• In making a notification, businesses should remember to include information on a resident's right to obtain a police report.  Also, be aware of the differences between a "security freeze" and a "credit alert."  Notification letters often confuse the two tools which makes it more difficult for consumers.
   
• With respect to the Massachusetts law requiring secure destruction of documents containing personal information, ch. 93I, Mr. Schafer indicated that the key is to make sure that the information cannot be "read or reconstructed." 
   
• Businesses can use third party vendors to securely destroy personal information, but it is recommended that they obtain written assurances that the vendor is complying with ch.93I.
   
• Enforcement of Massachusetts information security laws and regulations is already taking place.  The Attorney General typically seeks injunctions to force compliance, as well as a range of monetary damages, including attorneys fees.  Mr. Schafer's office is not engaging in "gotcha" litigation, but is attempting to correct dangerous or harmful practices.

David A. Murray is General Counsel to OCABR, the agency that drafted the new Massachusetts identity theft regulations that require many businesses to adopt comprehensive, written information security programs.  He provided an overview of these regulations, primarily directing his presentation from the OCABR compliance checklist (.pdf).  Here are some highlights:

• The Massachusetts identity theft regulations are "currently in force," even though the date for compliance and enforcement is January 1, 2010.  In the view of OCABR, all affected businesses and organizations have a duty to to be taking steps now to comply with these regulations.
  
• The regulations are a minimum standard necessary to effect the goal of the Massachusetts legislation: to "safeguard" the personal information of Massachusetts residents.  In OCABR's view, the regulations are a good balance between consumer protection and burdening businesses.
   
• In drafting the Massachusetts regulations, regulators reviewed and borroed from the standards set by the federal Gramm Leach Bliley Act (GLBA), HIPPA and other state regulations, including California, New Jersey, Rhode Island and Nevada. 
  
• The purpose of the regulations is to "apply special protections to certain kinds of information."  The first step is to Businesses should know where personal information is stored.  "In our experience, most companies know, generally, where it resides."
  
• Training on information security is mandatory.  OCABR "needs to change the way businesses operate."  We "need to change the culture of thinking of data security as a static, one time event."  The regulations specifically require that busineses treat information security as a "dynamic system."
   
• "Access to personal information should be on a 'need to know' basis.  Everyone should not have access to it."
   
• A business "cannot avoid liability by handing over its personal information to a third party vendor."  The regulations require that the business taken "all reasonable" steps to ensure that any third party providers are complying with the new regulations. 
  
• If a business provides personal information to a third party vendor and the vendor suffers a breach, the business "should be fine" if it has complied with its due dilingence requirements.

Mr. Murray did take a few questions, but declined to respond to a number of them on the grounds that his office, OCABR, is not the agency charged with enforcement and is therefore not in a position to comment on what would be considered a violation of the regulations.  While OCABR drafted the regulations, the Office of the Attorney General is charged with enforcing them.  Of course, by the time these questions emerged, Mr. Schafer and his colleagues from the enforcement side had exited, leaving us to speculate on wonder how the Attorney General will be enforcing the the new identity theft regulations.