Citing Recession, Massachusetts Bumps To 2010 Its Tough New Data Security Rules
Written by Fred J. AunRevenue-strapped retailers dreading a May 2009 deadline for compliance with Massachusetts’ stringent new data security regulations received a recession-induced breather on February 12, when the deadline was bumped one year to Jan. 1, 2010.
It was the second regulation imposition delay by the state Office of Consumer Affairs and Business Regulation (OCABR) in three months. The tough new rules, announced in September 2008, were originally scheduled to take effect Jan. 1, 2009.
In a rare piece of welcome business news related to the economy, OCABR Undersecretary Daniel Crane said the seven-month-long extension is being granted because the state understands that “the impact of the current business environment” might make compliance by May difficult.
Additionally, reacting to many complaints from affected companies (that would be any firms doing business with Massachusetts residents), the OCABR erased from the regulations a mandate that companies obtain proof from their third-party providers that they are in compliance with the new rules. The softened language says companies must take “reasonable steps to verify that any third-party service provider with access to personal information has the capacity to protect such personal information in the manner provided for” in the new law.
The OCABR might be taking a kinder, gentler approach, but the new rules are still likely to be a headache for many retailers.
For starters, they will require any company “that owns, licenses, stores or maintains personal information” about Massachusetts residents to “develop, implement, maintain and monitor a comprehensive, written information security program applicable to any records containing such personal information.” They must also name one or more employees to maintain the information security programs, and these overseers will be required to identify and assess “reasonably foreseeable internal and external risks” to data security.
Companies will be allowed to collect only enough personal information “reasonably necessary to accomplish the legitimate purpose for which it is collected,” and they will not be allowed to keep the data after it has been used to accomplish that purpose.
Contained in the list of requirements for IT systems, including wireless networks, are these provisions:
“To the extent technically feasible,” encryption must be applied to all transmitted records and files that contain personal information and travel across public networks, including wireless networks, or are stored on mobile devices.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
