Six Ideas to Help Small Businesses with the Massachusetts Data Security Regulation
I recently had breakfast with my good friend, Cherie Hafford, and we talked about the Massachusetts Data Security Regulation and how much of a burden it creates, especially for small businesses (more on the Regulation here and here). The Regulation is supposed to be scalable – that is, the degree of compliance should be proportionate to the size of the business and its resources. But for small businesses, even the most stripped-down, basic plan will still require considerable time and money—time and money that most business owners simply do not have or will not spend.
The Regulation likely affects millions of businesses around the country and perhaps the world. Read literally, the law is not confined only to Massachusetts businesses; it applies to any business wherever located that has customers or employees in Massachusetts. So if a small crafts shop in Santa Fe accepts a check from a customer in Cambridge, the shop must implement a written information security policy, or WISP. And a gas station in Orlando that accepts a credit card from a tourist who lives in Quincy would have to comply with the Regulation even if they had no idea where the customer lived.
Did the state go too far? Setting aside the constitutional and enforcement challenges, was there perhaps a simpler way to achieve the goals that would not impose such a burden on small businesses that are already struggling?
Here are six ideas on how to fine tune the law to make compliance easier and achieve the same objectives:
- Many businesses that accept credit cards never store the account numbers. They simply swipe them in a POS device and hand the card back to the customer. Why not make that activity compliant with the Regulation without the need for any written plan?
- Same thing with checks. Most businesses that accept checks want to get the money into their accounts as quickly as possible. How about a rule that says businesses are compliant if they deposit checks within two business days and keep the un-deposited checks under lock and key until they are deposited?3) Focus the regulations on the banks, credit card companies and the businesses that provide the POS devices and connections. Require that the data be locked down tightly and impose substantial penalties for a breach. The standards already exist – i.e. PCI (Payment Card Industry) standards.
- Businesses that have employees need to have their social security numbers on file for payroll, benefits and other purposes. Just as with checks, if they are kept under reasonable security and only employees with a need to know or see the information are permitted access, then this should be deemed to be in compliance without the need for any further written plan. The Regulation could set forth a simple plan that if adopted and followed will be deemed to be compliance.
- Work within the parameters of the Fair Credit Reporting Act to reinforce the rights of victims of identity theft. There are far fewer victims than there are businesses who need to protect the information from possible misuse.
- Do more to educate businesses about the various practices that reduce the risks of identity theft. For years, we have seen signs in restaurants telling employees to wash their hands before going back to work. Maybe there should be similar signs in the human resources and finance departments advocating safe practices with sensitive financial information?
Of course no matter what is done, there will still be dishonest people who will take advantage of a situation and cause harm to others. This is not to excuse careless or negligent business practices –enforcement should still require a reasonable degree of caution and vigilance. But the new Regulation ignores the practical reality of small business and imposes too many requirements that may be unnecessary.
Please share your own ideas on the Regulation by posting a comment below.
Learn how contract drafting and negotiation in Dedham, MA safeguard business interests. Explore key clauses, negotiation tactics, and enforcement strategies.
Understand real estate law in Westwood, MA for smooth property transactions. Learn about purchase agreements, title issues, and closing procedures.
Learn how to form an LLC in Westwood, MA and draft solid first contracts — a step-by-step local guide from filing to signing your first client agreement.
Navigate commercial real estate in Westwood, MA with legal insights. Learn about lease negotiations, zoning compliance, and property due diligence.
Resolve business disputes in Norwood, MA with effective strategies. Learn about mediation, litigation, and contract enforcement to protect your interests.
Learn creditor and collector rights in Dedham, MA under federal and state law. Discover collection strategies, legal remedies, and compliance requirements.
We all know how to eat an elephant. One bite at a time at a time, of course. Implementing a comprehensive data security program is no different – for many it’s a monumental task. It can only be accomplished by setting out a manageable, step-by-step plan. Easier said than done? Probably, but that doesn’t mean a process that is impossibly difficult. The new Massachusetts data security regulation goes into effect on Monday, March 1. If you have not yet begun to plan for the deadline, then likely either you are unaware of the requirements, or you are feeling overwhelmed by them. And who would blame you in light of the seemingly endless list of tasks: Develop a written information security plan (WISP); Identify all foreseeable risks in your organization by examining every nook and cranny where data enters, leaves or is stored; Implement security policies and procedures and train your employees Secure all paper and electronic records; provide encryption Obtain written assurances from all vendors that they are compliant Regularly monitor and review to insure compliance You know that it is vitally important, both because it’s legally required and because it’s the right thing to do to protect your customers. But where to begin? Do you need professional assistance – a lawyer or specialized IT firm to accomplish this task? That really depends on the size and nature of your business, the data that requires protection and how much time and energy you are willing to devote to the process. Many businesses are probably capable of accomplishing a lot on their own. For the most part, the regulation is a straightforward recitation of the tasks needed to comply. But is that the best use of your time? Noted author and business consultant Andy Birol would caution business owners to judge very carefully those tasks that they choose to do by themselves and those that are properly delegated. Consider the learning curve required to become proficient in an area that is not a part of your core business. While security is an ongoing and continuous process, monitoring and maintaining a plan is far less cumbersome and time consuming than creating it in the first place. Most businesses will prefer the comfort and efficiency of working with outside professional assistance at least to get the plan created and implemented. Even if you hire professionals, you will still need to be involved in the process. They cannot do it without your participation and that of your senior management and department leaders. And responsibility will not stop there; security needs to be an integral part of your corporate culture from top to bottom, which means it must become the responsibility of everyone in the organization. So pull out the regulation, review it, create an action plan and start in on the list. Otherwise, hire the professionals. Either way, the time is now.
When do I have to vacate my apartment? Can I leave in the middle of my lease? Can I stay few days longer if I need time before my new space is ready? My landlord says I have to get out before noon on the 31st because he needs time to clean the apartment for the new tenants - can he do that? I am a landlord - can I start showing the apartment before my tenant’s lease is up? Do I have to give notice? Whether you are a landlord or tenant, it is important to know your rights and responsibilities when it comes to ending your lease or occupancy agreement. Under a written lease, the tenant is entitled to occupy the premises until midnight on the last day of the lease; likewise, the tenant is obligated to pay rent through that date. Setting aside various special circumstances (such as active military duty, breach of the lease or other violations by the landlord, or you are a victim of domestic violence) there is no right to leave early unless it was negotiated as part of the written lease. And there is no right to stay longer, just because it might be more convenient. If you are a month-to-month tenant at will, things are little bit different. Either the landlord or tenant can terminate the tenancy, but typically that needs to be done at least a full month in advance. Thus, notice on March 7 would not terminate the tenancy until April 30. And as with the lease, the tenant is entitled to stay until midnight on the final day of the occupancy. Generally speaking, a landlord has the right to enter an apartment to inspect, make repairs and to show prospective tenants. Except in cases of emergency, such as a water leak or fire, this should only be done during normal business hours. Also, as a matter of best practices, it is a good idea for the landlord to contact the tenant and arrange for a mutually convenient time to enter. Tenants do not like surprise visits. But tenants should also understand that there are many circumstances where a landlord cannot easily arrange a visit in advance. The best situation for both landlords and tenants is to do your best to speak with one another and coordinate the end of lease together, in advance. The landlord will want to know as soon as possible when the tenant will be out so that he can get the apartment ready for the next occupant. And tenants want to know that the landlord will not be bothering them needlessly. There is also value in having a brief walk through ahead of time to know if there is damage (even if not caused by the tenant, the landlord wants to know so that he can fix anything before the next tenancy begins), make arrangements for cleaning, trash disposal, and so forth. Of course, as with most legal issues, there are always exceptions to the general rules. For instance, all of this assumes that there are no significant problems—the rent was paid on time, the apartment was in good condition and the parties left each other alone as much as possible.
As of this past Monday, the nation’s “most comprehensive data protection law” went into effect, yet many questions remain as to how the regulation will be interpreted and enforced. The law was promulgated by the Office of Consumer Affairs and Business Regulation. While OCABR put it together, the Massachusetts Attorney General is charged with enforcement. As of this writing, I found nothing posted on the AG’s web site that addresses interpretation or enforcement. So business owners and their legal and technical advisors are left to their own best guess. More surprising, many business owners are not even aware of the new law or mistakenly believe that it does not apply to them. For instance, here are several myths surrounding the new law: Myth 1 – “Businesses located out of state do not need to comply.” This is false. The regulation applies to any business wherever located that has access to “Personal Information.” Personal Information, or PI, is a Massachusetts resident’s name in combination with certain identity or financial data, such as a social security number, driver’s license, bank or credit card account number, etc. The regulation does not distinguish between an in-state or out-of-state business. Myth 2 – “The regulation only applies to bigger businesses with several employees and volumes of Personal Information. It doesn’t apply to small Mom and Pop businesses.” This is false. The regulation applies even if you have just one employee or customer as long as you have access to Personal Information. Myth 3 – “I am in a health care or financial services business that is already regulated under federal privacy laws (i.e. HIPAA or GLBA), so we are already covered.” This is false. The federal laws are extensive but they do not perfectly overlap with the Massachusetts regulation. For instance, those laws are geared toward patients and customers, but Massachusetts also includes employees. And the requirements for the written information security plan (WISP) are not identical. That said, there are similarities in the requirements, so an organization that is already comfortable with HIPAA or GLBA probably will not have to do very much to achieve compliance in Massachusetts. In my next article I will explore additional myths.
I recently had the opportunity to talk with Nick Fishman, co-founder of EmployeeScreenIQ who interviewed me on the Massachusetts Data Security Regulations and what they mean to businesses. Here's a copy of the interview. Check out the EmployeeScreen blog at https://blog.employeescreen.com/ to learn more about pre-employment screening and the comprehensive methods EmployeeScreenIQ uses to ensure thorough, accurate checks to meet global risk management needs of businesses. EmployeeScreenIQ Podcast with Nick Fishman