Law / United States / 
Massachusetts
Security Breach statute, duty to report breach of personal information
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information.
- Do not rely on ch. 93H to cover a breach exposing only biometric data; its personal information definition does not reach biometric identifiers at all.
These lines are LexLint's reading of the law's text. Also read by: Massachusetts Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Massachusetts Attorney General, who may bring an action under ch. 93A sec. 4 to remedy a violation of chapter 93H; this chapter's own enforcement clause (sec. 6) does not itself deem a violation actionable under ch. 93A sec. 9
Settledness
- As of
- Guidance link
- https://www.mass.gov/service-details/reporting-data-breaches-to-the-attorney-generals-office
- Guidance body
- Massachusetts Office of the Attorney General
- Open questions
- When does an unauthorized acquisition or use of data 'create a substantial risk of identity theft or fraud against a resident of the commonwealth' under the definition of breach of security in section 1 of chapter 93H, so that a person must give notice under section 3(b)?
What it makes you log
Logging duty
Section 3 requires notice of a breach of security: a service provider that does not own the data notifies the owner or licensor, and an owner or licensor notifies the Attorney General, the Director of Consumer Affairs and Business Regulation and the affected resident, with the contents the section lists, a sample consumer notice and a certification about credit monitoring. A duty to notify a breach with no record kept is not a log, and the section does not tell a person to document breaches that are not notified. The notice asks whether the person maintains a written information security program, which is a policy question. The regulation implementing chapter 93H, 201 CMR 17.00, requires documenting responsive actions after an incident (17.03(2)(j)) but is a separate instrument that this row does not cite. The section reaches personal information about a resident of the Commonwealth.
- Kind
- None
- As of
What this law does
Massachusetts's Security Breach statute, Mass. Gen. Laws ch. 93H, first enacted 2007, requires a person or agency that owns or licenses data including a resident's personal information to notify the Attorney General, the Director of Consumer Affairs and Business Regulation, and the affected resident as soon as practicable and without unreasonable delay upon learning of a breach of security or unauthorized acquisition or use.
Personal information is a resident's name combined with a Social Security number, driver's license or state ID number, or financial account or card number, and excludes information lawfully obtained from publicly available sources or government records; it does not define or reach biometric data at all. Chapter 93H was added by chapter 82 of the Acts of 2007, approved .
The Office of Consumer Affairs and Business Regulation states that the chapter has been in effect since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .