HOUSE DOCKET, NO. 2340 FILED ON: 1/14/2009
HOUSE . . . . . . . . . . . . . . . No. 326
|
The Commonwealth of Massachusetts
_______________
In the Year Two Thousand Nine
_______________
An Act relative to identity theft..
Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority of the same, as follows:
SECTION 1. Section 62A of chapter 93 of the General Laws, as inserted by Chapter 82 of the Acts of 2007, is hereby amended in line 103 by inserting after the word “fraud” the following: or the likelihood of fraud.
SECTION 2. Section 1 of chapter 93H of the General Laws, as so appearing, is hereby amended by striking out the definition of “Encrypted” in its entirety and inserting in place thereof the following:
“Encrypted", the transformation of data through the use of an algorithmic process, or an alternate method at least as secure, into a form in which meaning cannot be assigned without use of a confidential process or key, unless further defined by regulation by the department of consumer affairs and business regulation.
SECTION 3. Said section 1 of chapter 93H, as so appearing, is hereby further amended by inserting after the definition of “encrypted” the following:
“Nature of the breach”, information regarding a breach of security whose disclosure would substantially increase the risk of identity theft or fraud.
SECTION 4. Said section 1 of chapter 93H, as so appearing, is hereby further amended by inserting after the definition of “notice” the following:
“Owns or licenses”, retains as part of the person’s or agency’s internal customer account or for the purpose of using that information in transactions with the person to whom the information relates.
SECTION 5. Subsection (a) of Section 2 of chapter 93H of the General Laws, as so appearing, is hereby amended by striking out in the third sentence the words “customer information” and inserting in place thereof the following: personal information
SECTION 6. Said subsection (a) of Section 2 of chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out in the third sentence the words “inconvenience to any consumer” and inserting in place thereof the following: inconvenience to any resident of the commonwealth.
SECTION 7. Subsection (c) of Section 2 of chapter 93H of the General Laws, as so appearing, is hereby amended by striking out in the second sentence the words “customer information” and inserting in place thereof the following: personal information
SECTION 8. In subsection (a) of Section 3 of chapter 93H of the General Laws, as so appearing, is hereby amended by striking out in the first sentence the following:
“or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose”
SECTION 9. Said subsection (a) of Section 3 of said chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out the third sentence and inserting in place thereof: “Such cooperation shall include, but not be limited to, informing the owner or licensor of the breach of security, the date or approximate date of such incident and the nature thereof, and any steps the person or agency has taken or plans to take relating to the incident, except that such cooperation shall not be deemed to require the disclosure of confidential business information or trade secrets, or to provide notice to a resident that may have been affected by the breach of security.”
SECTION 10. Subsection (b) of said section 3 of said chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out in the first sentence the following:
“or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose”
SECTION 11. Subsection (b) of said section 3 of said chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out in the second sentence the following: “or unauthorized acquisition or use”
SECTION 12. Subsection (b) of said section 3 of said chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out in the third paragraph after the words “said notification shall not include the nature of the breach” the following: “or unauthorized acquisition or use”
SECTION 13. Subsection (b) of said section 3 of said chapter 93H of the General Laws, as so appearing, is hereby further amended by striking out in the third paragraph after the words “the number of residents of the commonwealth affected by said breach” the following: “or unauthorized access or use”
SECTION 14. Subsection (c) of said section 3 of said chapter 93H of the General Laws, as so appearing, is hereby amended by striking out “or unauthorized acquisition or use” in both places it appears.
SECTION 15. Section 4 of chapter 93H of the General Laws, as so appearing, is hereby amended by striking out in the third sentence the following: “or unauthorized acquisition or use”