• Like


Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

State Data Breach Laws - A National Patchwork Quilt


Since the days of California's pioneering data breach notification law, virtually all states have implemented some form of consumer ID theft protection law. In 2008, the focus shifted to the east …

Since the days of California's pioneering data breach notification law, virtually all states have implemented some form of consumer ID theft protection law. In 2008, the focus shifted to the east coast, when Massachusetts took it beyond notification, and issued their regulations for the protection of personal information, viewed by many as the most proscriptive in the US. This presentation will provide a general overview of state law, but focus on how the MA regulations evolved from the version issued in Sept 2008 to what became effective March 2010, how organizations are responding, and some potential implications for the future.

Allison Dolan, Program Director, Protecting Personally Identifiable Information, Massachusetts Institute of Technology

Allison F. Dolan is currently Program Director, Protecting Personally Identifiable Information at the Massachusetts Institute of Technology. This program is co-sponsored by the Institute Auditor and Vice President for Information Services and Technology (IS&T). Previously, Allison spent 10 years in IS&T, including roles as Director of Shared Services - Finance, Administration and HR, and as Director of Telephony Services. Allison’s MIT experience was preceded by 20 years of combined information systems, operational, and leadership experience at Eastman Kodak. Allison holds a BA degree from the University of Delaware, with a double major in Computer Science and Economics.

Published in Technology , Business
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads


Total Views
On SlideShare
From Embeds
Number of Embeds



Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

    No notes for slide


  • 1. State Data Breach Laws
    ….A National Patchwork Quilt
    Allison Dolan
    Program Director, Protecting Personally Identifiable Information
    Massachusetts Institute of Technology
  • 2. Breach law history
    Massachusetts and other states
    What’s on the horizon
    Presentation Overview
    Rochester Security Summit 2010
  • 3. Key Take-aways
    • Laws and regulations continue to abound – and are becoming more proscriptive
    • 4. Know what state(s) are relevant
    • 5. Know what industry(s) are relevant
    • 6. Know what processes you have
    Rochester Security Summit 2010
  • 7. Laws & Regulations
    FERPA - Family Educational Rights and Privacy Act
    Gramm-Leach-Bliley Act
    HIPAA - Health Insurance Portability and Accountability Act
    FACTA/Red Flags Rule
    PCI DSS - Payment Card Industry Data Security Standards
    HITECH Act - Health Information Technology for Economic and Clinical Health
    State data breach laws, regulations
    Rochester Security Summit 2010
  • 8. State Laws
    2002 – California SB-1386 – consumer notification if unauthorized access to unencrypted electronic records with personal information
    2005 – New York data breach law GBL 899-aa
    2007 – Massachusetts MGL 93H/I
    39th state with breach law; 5th to include paper
    1st to require “written information security program”
    2007 – California AB 1298 added medical and health insurance information to definition of PI
    2010 – 47 states, Puerto Rico, Virgin Islands, DC, NYC with laws
    Rochester Security Summit 2010
  • 9. Massachusetts Data Breach Law
    (M.G.L. c.93H & 93I)
    • Personal information (PI) = last name (with first name or initial), along with one or more of Social Security Number; Driver’s License # or Mass. ID#; Financial Account # or Credit/Debit Card #
    • 10. Defines obligations re: notification, if paper or electronic files exposed (irrespective of encryption)
    • 11. Includes what must be in notification letter
    • 12. When destroyed, must be done such that PI cannot be practicably read or reconstructed
    • 13. Data protection regulations initially issued 9/08;
    ultimately effective 3/1/2010
    Rochester Security Summit 2010
  • 14. Massachusetts Data Protection Regulations (201 CMR 17)
    If you have Personal Information, then you have a “duty to protect” and need to follow “standards to protect”, including:
    • “Develop, implement, maintain and monitor a …written information security program” (WISP)
    • 15. Limit access and ensure user authentication & authorization
    • 16. “Oversee” 3rd parties
    • 17. Encrypt transmitted records and personal information stored on laptops or other portable devices.
    • 18. Maintain up-to-date versions of system security including malware protection, patches and virus definitions
    • 19. …plus other requirements
    Rochester Security Summit 2010
  • 20. Massachusetts Data Protection Regulations Evolution
    • Office of Consumer Affairs and Business Regulation promulgated regulations; Attorney General responsible for enforcement
    • 21. Draft regulations 2/08
    • 22. Included technical detail for encryption requirements
    • 23. A lot of feedback
    • 24. Issued 9/08, with 1/1/09 effective date
    • 25. No technical requirements for encryption
    • 26. “Certification” of 3rd parties
    • 27. Implied requirement to inventory PI
    • 28. Standards were ‘one size fits all’
    Rochester Security Summit 2010
  • 29. Massachusetts Data Protection Regulations Evolution con’t
    • 4 postponements with revisions
    • 30. Added emphasis on risk based approach – small business with little PI have different risk than large company
    • 31. Made more explicit that ‘written program’ could consist of compilation of existing written policies/practices
    • 32. Need to “oversee” 3rdparties by taking “reasonable steps” to ensure 3rd party can protect information
    • 33. Entire IT section prefaced with “to the extent technically feasible”
    Rochester Security Summit 2010
  • 34. California redux
    • 2007 – AB 1298 added medical information and health insurance information to the definition of PI
    • 35. 2010 – SB 1166
    • 36. Additional information in notification letters, including
    • 37. Type of personal information exposed
    • 38. Description of incident, including date
    • 39. Steps organization is taking to protect individuals
    • 40. Steps consumers can take to protect themselves, including contact information for credit reporting agencies
    • 41. Breach affecting >500 must review notification letter with AG
    Rochester Security Summit 2010
  • 42. State comparisons
    • All(?) focus on state residents (not company residence)
    • 43. Most focus on electronic records; few include paper/other media
    • 44. Most include SSN, Driver’s License/state issued id, CCN, financial account numbers; some limit only if PID/PIN included
    • 45. Some include mother’s maiden name, date-of-birth, etc
    • 46. Many exempt ‘protected’ or encrypted records
    Rochester Security Summit 2010
  • 47. State comparisons
    • State agency notification varies – e.g. AG, others, none
    • 48. Template for notification letter varies – e.g., some require details of breach (when, how, #), others preclude details
    • 49. Timeframe varies – “without unreasonable delay”, “5 days”; often exception for police investigation
    • 50. Harm threshold varies – no threshold thru “reasonably believed to have been acquired by an unauthorized person”
    • 51. Quantity threshold varies – 1 to 1,000 (also, maximum for personal notification)
    • 52. Penalties vary, some with maximums
    • 53. Private right to action varies
    Rochester Security Summit 2010
  • 54. Federal Trends
    • HITECH (2/2009)
    • 55. notification requirements for HIPAA Covered Entities and Business Associates
    • 56. national database
    • 57. HHS AND State AG enforcement
    • 58. Data Breach Notification Act (introduced 1/2009)
    • 59. Authorize AG to bring civil action if notification did not occur
    • 60. Extends notification requirement to government agencies
    • 61. Personal Data Privacy and Security Act (introduced 7/2009)
    • 62. Set criminal penalties for willful concealment of breach
    • 63. Require preventative security standards
    Rochester Security Summit 2010
  • 64. Federal Trends
    • 2010 Data Security Act SB 3579 (2007, reintroduced 7/2010)
    • 65. preempt state laws;
    • 66. modeled after GLBA;
    • 67. establish “appropriate standards” for administrative, technical and physical data protection
    • 68. Data Security and Breach Notification Act of 2010 S.3742
    • 69. Require protection of PI (FTC to set national standards)
    • 70. Require notification within 60 days
    • 71. Require offering 2 years of credit protection
    • 72. Up to $5 million in civil penalties
    • 73. Exemption for entities covered by FCRA
    Rochester Security Summit 2010
  • 74. In Our Future?
    • More European-style controls?
    • 75. More items to be protected?
    • 76. Photographs
    • 77. Biometrics
    • 78. IP addresses
    • 79. More contractual requirements between organizations?
    • 80. More definition of how information is to be protected?
    Rochester Security Summit 2010
  • 81. Summary
    • Know the states(s) represented in your business (employees, customers, vendors, affiliates)
    • 82. Know the industry(s) represented in your business (health, insurance, finance, retail)
    • 83. Know the major business processes (HR, procurement, finance, business operations)
    You are prepared when
    - new laws enacted
    - business processes change
    - company changes (acquisition, divestiture, etc.)
    Rochester Security Summit 2010
  • 84. Quiz
    Following examples from http://www.idtheftcenter.org/artman2/publish/itrc-news/Notification_Roulette.shtml
    Paperwork containing personal and financial information was found littering the streets of Buffalo, New York.  The customer records were from Rent-a-Center.  Do they have to notify you?
    In Arizona, thousands of pages of sensitive information reportedly disposed of by The Vine Tavern and Eatery contained people’s names, Social Security numbers and dates of birth from restaurant applications, as well as checks with banking information and also credit card receipts with full card numbers from Vine customers. The receipts revealed a person’s entire credit card number.
    Over 40,000 intact patient records containing personal and medical information were found in a pile described as 20’ long by 20’ wide at Georgetown Transfer Station in Massachusetts. The records, from four hospitals, had reportedly been dumped there by the medical billing service they had used.
    An unknown number of canceled checks bearing Social Security and bank account numbers of Rockland, Massachusetts town employees are missing after wind knocked them from a loaded recycling truck.
    Approximately 30,000 estimated tax payments with checks wound up in the San Francisco Bay after the truck transporting them to the Internal Revenue Service  was involved in an accident and wind blew the mail into the bay.
    Boxes with 1,590 patient records from a Charlotte, North Carolina’s psychologist’s practice were left at a county recycling facility because the psychologist’s sons mistakenly took the wrong boxes to be recycled. The records contained patient names, contact information, Social Security numbers, credit card numbers and medical histories.
    Rochester Security Summit 2010
  • 85. Quiz
    In Illinois, hundreds of sensitive documents that were provided to the law firm of Robert J. Semrad & Associates, also known as DebtStoppers USA, ended up in a trash bin in an area the firm shares with other businesses. The “Client Information Sheets” contained Social Security numbers, full names and addresses, driver’s license numbers and signed debit card authorizations.
    75 legal files were found in a dumpster off Interstate 10 near Boerne, Texas. The files, which included peoples’  names, addresses, bank accounts, social security numbers, driver license numbers, and birth dates, belonged to attorney David Naworski, who readily acknowledged throwing them away unshredded and said he was unaware of any state law on disposal.
    Three small file boxes full of decade-old personal records belonging to customers of the First Federal Savings Bank were found near a residential street in Bryan, Texas. The bank had apparently closed its doors under that name around 2002 and has been acquired by several banks since then. The current owner says that they never assumed ownership of those bank records.
    Credit-card numbers from 17,000 guests at the Emily Morgan Hotel in San Antonio were stolen and used in a three-state shopping spree. Officials say the suspects used stacks of stolen credit-card receipts from a storage room at the hotel in 2006.
    The University of Florida discovered that 2,047 people that their Social Security or Medicaid identification numbers included on address labels affixed to letters inviting them to participate in a research study. The letters were sent through the U.S. Postal Service on May 24, and the information also was shared with a telephone survey company.
    In Maryland, Montgomery County’s Department of Health and Human Services is looking into how numerous Wheaton nursing home papers containing sensitive patient information have made their way into nearby neighbors’ yards over the past few months. The exposed internal documents contained patient conditions, names and Social Security numbers.
    Rochester Security Summit 2010
  • 86. Resources
    Map and other state/Canadian info: http://www.nymity.com/About_Nymity/Nymity_Maps.aspx
    summary of state data breach requirements:
    list of state breach statutes: www.ncsl.org/IssuesResearch/TelecommunicationsInformationTechnology/OverviewSecurityBreaches/tabid/13481/Default.aspx
    "Intersections - Data Breach Consumer Notification Guide” details each state's law, 118 pages, contact info www.intersections.com 888.283.1725 DataBreachServices@Intersections.com
    www.sb-1386.com/Guide to CA regulations
    Breach notification letters:datalossdb.org/incident_highlights/34-data-breach-notification-letters
    NY Guide to handling PII:www.nysconsumer.gov/pdf/protecting/information_privacy/the_new_york_business_guide_to_privacy.pdf
    Summary of US privacy laws, (undated)www.bbbonline.org/understandingprivacy/library/fed_statePrivLaws.pdf
    Rochester Security Summit 2010
  • 87. Questions/other follow-up?
    Feel free to contact:
    Allison Dolan adolan@mit.edu617.252.1461
    Rochester Security Summit 2010
  • 88. Places to look for PII/SSN Employee Processes
    Job Applications
    Background checks
    New hire paperwork - I-9, Federal/State tax withholding, benefit enrollment, other new hire forms
    Payroll, timecards, paychecks,direct deposit forms; wage garnishing requests
    Ongoing benefit and 401(k) processes
    Status changes (e.g. marriage)
    Worker’s compensation, medical leave form
    Employee loan programs
    Specialized certifications (e.g., nurse, engineer)
    Special requirements (e.g. top secret clearance, confidentiality agreement, employment contracts)
    Employee reporting (e.g. annual reviews)
    Union reporting
    Rochester Security Summit 2010
  • 89. Places to look for PII/SSN Customer Processes
    Services that require customer’s PII - e.g., banking and financial services, education services, car rentals, tax preparations, accounting, etc.
    Products/services with check and/or credit card payments
    Services that require PII of others - e.g., 401(k) administrators, benefit providers, underwriters,claim administrators
    Services that may involve access to PII of others - e.g., backup service providers, shredding services, IT application developers and system admins, custodians
    Rochester Security Summit 2010
  • 90. Places to look for PII/SSN - Financial Processes
    Vendor files/vendor payments e.g., independent contractors
    Employee reimbursements (look at form used to request reimbursements, as well as backup to request)
    Employee awards
    Customer rewards, awards, or payments
    Other payments - e.g., payments to ‘one-off’ vendors, research subjects, casual labor
    State or federal government reporting- corporation reports, real estate transactions
    Financial reporting - SEC
    Rochester Security Summit 2010
  • 91. Places to look for PII/SSN - Miscellaneous Processes
    State visits
    Any service that predates non-SSN organizational id (e.g. library, parking, travel, conference attendance)
    Insurance (beneficiaries)
    Legal (subpoenas, court records,etc.)
    Audit (if PII part of the process that was audited)
    Research grants (pre-2009)
    Internal medical
    System backups
    Paper archives
    Printing/scanning with devices that retain information
    PCs after ‘delete trash’; prior to deployment
    Rochester Security Summit 2010