The Equifax/Massachusetts Attorney General Consent Judgment: A Guide For Privacy And Security Compliance

What do businesses need to do to comply with privacy and data security laws? The first place to look is to relevant statutes. If you store or process the personal information of Massachusetts residents, then you will at least be subject to the Massachusetts Data Breach Notification Statute and related security regulations. These are important guides that require certain operational activities, such as maintaining a written information security program, or WISP, an often-overlooked requirement that demands a minimally-robust set of security practices.

But statutes and regulations only provide part of the story. In the absence of a comprehensive federal privacy law (despite repeated, and quixotic, Congressional efforts), agencies charged with enforcing against consumer protection violations have used their broad authority to protect individual personal information, especially following a breach. The most important of these agencies is the Federal Trade Commission; the