Privacy And Security Alert: When The Clock Strikes Midnight On January 1, 2009, Will Your Information Security Program Be Ready?

As discussed in earlier alerts ( here and here), starting on January 1, 2009, businesses will be held to a higher standard regarding the protection of Massachusetts residents' personal information and will now be required to implement written programs for the protection of personal information. The regulations set out in detail the required minimum standards to be met by persons or businesses who own, license, store, or maintain personal information about a Massachusetts consumer or employee (the "Standards"). Noteworthy in the scope of data protection regulations, the Standards apply to paper as well as to electronic records.

What You Need to Do

Implementation and development of a written comprehensive security program and establishment of a security system covering businesses' computers are at the heart of the Standards and must be in place by January 1, 2009. The Standards provide a detailed list of comprehensive security program and security