New Massachusetts Law Creates More Stringent Notification Requirements For Data Breach Incidents

While we've all been busy keeping an eye on California's CCPA mess and the brewing federal privacy legislation, Massachusetts enacted some amendments to its already stringent consumer-protection oriented privacy laws. (See MGL c.93H)

As a result of the amendments, effective April 11, 2019, Massachusetts' general breach notification statute will include the following new requirements:

1. Consent to Access Credit Reports – Before getting hold of a consumer's credit report for most non-credit purposes, third parties must obtain the consumer's consent. In the process, they also need to disclose the reason they're seeking access.
2. Security Freezes – Consumer reporting agencies can no longer charge a fee to consumers to place, lift, or remove a security freeze on their credit reports.