Attorney Kevin Whitaker has been analyzing and criticizing Massachusetts Senate Bill No. 173 (pdf), “An Act ensuring the privacy of certain data.” The bill was proposed in January by Michael W. Morrissey.
The text of the bill is relatively short:
SECTION 1. Section 2 of Chapter 93H of the General 1 Laws, as appearing in the 2006 Official Edition, is hereby amended by striking out subsection (a) and inserting in place thereof the following:- (a) The department of consumer affairs and business regulation may adopt regulations relative to any person or agency that owns or licenses personal information about a resident of the commonwealth. Such regulations shall be designed to safeguard the personal information of residents of the commonwealth and shall be consistent with the safeguards for protection of personal information set forth in the federal regulations by which the person or agency is regulated. The objectives of the regulations shall be to: insure the security and confidentiality of customer information in a manner fully consistent with industry standards; protect against anticipated threats or hazards to the security or integrity of such information; and protect against unauthorized access to or use of such information that may result in substantial harm or inconvenience to any consumer. The department shall not in its regulations, however, require covered persons to use a specific technology or technologies, or a specific method or methods for protecting personal information.
The regulations shall take into account the person’s size, scope and type of business, the amount of resources available to such person, the amount of stored data, and the need for security and confidentiality of both consumer and employee information. Notwithstanding the rules adopted by the department pursuant to the provisions above, said department shall create separate regulations for small businesses covered by this chapter that reflect said small businesses unique situation and resources.
Any person who is required to comply with federal laws, rules, regulations, guidance, or
guidelines safeguarding personal information is deemed to be in compliance with this chapter.SECTION 2. Section 6 of Chapter 93H of the General Laws is hereby amended by adding at the end thereof the following:- A willful violation of this chapter or regulations implementing this chapter, or a written information security plan issued by a person covered by state or federal privacy laws shall provide just cause for the termination of an employee, whether the employee is employed by a private person, public agency or political subdivision of the state.
Whitaker comments, in part:
If SB 173 is enacted, businesses would not have to comply with any state regulations with stricter standards than federal law. While businesses need to comply with federal law, this should not stop states from implementing higher standards to protect their residents. This suggested revision hurts individuals’ privacy rights as compliance is limited to the lowest common denominator and doesn’t aspire to improve safeguards beyond minimum standards.
Maybe Whitaker doesn’t even need four other parts to his analysis, as that criticism alone, if accurate, should be enough to give legislators pause.