Duty LXD-0219
Crawls the web, in Massachusetts
Standards for disposal of records containing personal informationsince 4 lines
Mass. Gen. Laws ch. 93I, sec. 2 · Read the law's page
- This binds each agency or person that disposes of records containing personal information.
- Dispose of paper documents containing personal information by redacting, burning, pulverizing or shredding them so that personal data cannot practicably be read or reconstructed.
- Destroy or erase electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed.
- If you are a third party hired to dispose of material containing personal information, implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation and disposal of personal information.
Standards for the Protection of Personal Information of Residents of the Commonwealthsince 5 lines
201 CMR 17.01-17.05 · Read the law's page
- This binds any person that owns or licenses personal information about a Massachusetts resident, meaning any person or business that receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment; it reaches a business outside Massachusetts that holds a Massachusetts resident's personal information the same as one located here.
- Develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size, scope, resources, amount of stored data, and the sensitivity of the personal information you hold.
- Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.
- For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.
- There is no compliance runway left to build against: every covered person has been required to be in full compliance since .
Unauthorized access to a computer system; penaltiesin force3 lines
Mass. Gen. Laws ch. 266, § 120F · Read the law's page
- Do not access a computer system without authorization, and stop accessing it once you know your access is no longer authorized.
- A password or other authentication requirement is itself notice that access is limited to authorized users, so bypassing or ignoring one exposes you under this section.
- A public page requiring no password or authentication raises no exposure under this section by itself.
Obtaining computer services by fraud or misrepresentation; penaltiesin force2 lines
Mass. Gen. Laws ch. 266, § 33A · Read the law's page
- Do not obtain, or attempt to obtain, a subscription-based or otherwise paid commercial computer service by false representation, false statement, unauthorized account charging, equipment tampering, or any other fraudulent means.
- This section is scoped to a service its proprietor offers to others for monetary consideration, so it does not by itself reach an openly published, unpaid page.
Unfair or deceptive acts or practices (predicate vehicle for scraping claims)in force2 lines
Mass. Gen. Laws ch. 93A, §§ 2, 9 · Read the law's page
- A scraping practice that is separately unfair or deceptive in trade or commerce, such as deceptively circumventing a site's access controls, can expose you to a private chapter 93A claim even where no other Massachusetts statute arms a private plaintiff.
- A willful or knowing violation exposes you to up to three, but not less than two, times the actual damages found.