Law / United States / 
Massachusetts
Consumer Protection General Regulations, deeming a data-security violation an unfair practice
940 CMR 3.16(3); Mass. Gen. Laws ch. 93A, §§ 2, 9
In force.
An enforcement supervision rule binding private bodies.
- Obligation class
- Security, Breach notice
- Audit expectation
- none
What it requires
- Comply with ch. 93H's breach-notice duty and 201 CMR 17.00's information security program mandate. Noncompliance with either is a ch. 93A section 2 unfair or deceptive practice under 940 CMR 3.16(3), and any injured person may sue for damages, trebled if knowing, plus attorney fees, under ch. 93A section 9.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Ch. 93A sec. 4: the Attorney General may recover a civil penalty of up to $5,000 for each violation the court finds a person knew or should have known violated ch. 93A sec. 2, plus investigation and litigation costs including attorney's fees; a further civil penalty of up to $10,000 per violation applies to violating an injunction or order issued under sec. 4. 940 CMR 3.16(3) routes a data-security violation into this mechanism by deeming it a sec. 2 violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
Ch. 93A sec. 9(1): a private plaintiff recovers actual damages or $25, whichever is greater; the court trebles the award, or at minimum doubles it, for a willful or knowing violation, plus attorney's fees and costs under sec. 9(4). Sec. 9(2) permits a class action for similarly injured persons.
- As of
- Currency
- USD
- Per person minimum
- 25
- Class action available
- Yes
Who enforces it
Enforcement body
Massachusetts Attorney General (a civil penalty of up to $5,000 per violation and injunctive relief under ch. 93A sec. 4) and, privately, any person injured by the deemed unfair practice under ch. 93A sec. 9.
Settledness
- As of
- Open questions
- Is chapter 93H or 201 CMR 17.00 an 'existing statute, rule, regulation or law' that is 'meant for the protection of the public's health, safety, or welfare' and 'intended to provide the consumers of this Commonwealth protection' under 940 CMR 3.16(3), so that a violation of either is itself a violation of section 2 of chapter 93A?
What it makes you log
Logging duty
940 CMR 3.16(3) makes an act or practice a violation of chapter 93A section 2 when it fails to comply with an existing statute, rule or regulation meant to protect the public's health, safety or welfare. It is a rule of decision that borrows other laws' duties and states no log, record or audit duty of its own. The data security regulation it reaches, 201 CMR 17.00, does carry record duties (17.03(2)(j) requires documenting responsive actions taken in connection with an incident involving a breach of security, and 17.04(4) requires reasonable monitoring of systems for unauthorized use or access), but it is a separate instrument that this row does not cite. The cited text has no territorial clause.
- Kind
- None
- As of
What this law does
A private right of action for a Massachusetts data-security violation opens through a separate Attorney General consumer-protection regulation, not through ch. 93H or 201 CMR 17.00 directly.
940 CMR 3.16, promulgated under ch. 93A section 2(c), provides that an act or practice violates ch. 93A section 2 if, among other things, it fails to comply with an existing statute, rule, or regulation meant for the protection of the public's health, safety, or welfare and intended to provide Massachusetts consumers protection.
A failure to comply with ch. 93H's breach-notice duty or 201 CMR 17.00's WISP mandate is therefore a ch. 93A section 2 violation, which ch. 93A section 9 arms any injured person to sue on for damages, trebled if the violation was knowing, plus attorney fees. Chapter 93H section 6 alone does not open this route; the mechanism is entirely this separate regulation. The regulation text carries no history note, and no day on which 940 CMR 3.16(3) came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .