Massachusetts Regulators Propose Amendments to Information Security Regulations, Delay Enforcement Until March 1, 2010

On Monday, August 17, 2009, the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) indicated that it will be modifying some provisions of the strict Massachusetts information security regulations first promulgated last year, 201 CMR 17.00 et seq. Of most immediate concern to many businesses, OCABR will extend the deadline to comply with the regulations from January 1, 2010 to March 1, 2010.

The Massachusetts identity theft regulations affect any individual or business that receives, maintains or otherwise has access to personal information, but the proposed amendments limit the scope of the regulations to individuals and businesses that receive personal information in connection with the provision of goods or services or in connection with employment. This excludes anyone not engaged in commerce. As in prior versions of the regulations, personal information includes the Social Security numbers, state drivers license, identification card numbers