The Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) announced late last week that it has delayed the effective date of the state's new information security rules. The rules, which were issued in final form on September 22, 2008, had been scheduled to go into effect on January 1, 2009. Most provisions of the information security rules will now go into effect on May 1, 2009.
As discussed in our September 29, 2008 Client Alert, "New Massachusetts Regulations to Mandate Comprehensive Information Security Requirements," these information security rules are written very broadly, specifically referencing "all persons that own, license, store or maintain personal information about a resident of the Commonwealth." The rules, which are available here, have stricter requirements (particularly in the areas of vendor contracts and data encryption) than federal standards or those of other states.
The mandatory compliance date for provisions requiring written certification of compliance from third-party service providers and for the encryption of portable electronic devices other than laptops has been extended to January 1, 2010.
Although the OCABR has granted a temporary reprieve, entities that may be subject to the requirements should continue preparations.
Goodwin Procter LLP is one of the nation's leading law firms, with a team of 700 attorneys and offices in Boston, Los Angeles, New York, San Diego, San Francisco and Washington, D.C. The firm combines in-depth legal knowledge with practical business experience to deliver innovative solutions to complex legal problems. We provide litigation, corporate law and real estate services to clients ranging from start-up companies to Fortune 500 multinationals, with a focus on matters involving private equity, technology companies, real estate capital markets, financial services, intellectual property and products liability.
This article, which may be considered advertising under the ethical rules of certain jurisdictions, is provided with the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin Procter LLP or its attorneys. © 2008 Goodwin Procter LLP. All rights reserved.
