Law / United States / 
Massachusetts
Security Breach statute, credit monitoring offer required
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Offer at least 18 months of free credit monitoring to a Massachusetts resident whose Social Security number was disclosed, or reasonably believed disclosed, in a breach of security.
- If you are a consumer reporting agency that experienced the breach, offer not less than 42 months of free credit monitoring instead of 18.
- Do not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer.
These lines are LexLint's reading of the law's text. Also read by: Massachusetts Office of Consumer Affairs and Business Regulation (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P8Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent withdrawal, data alteration or deletion) to address impacts of problematic data actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Massachusetts Attorney General, who may bring an action under ch. 93A sec. 4 to remedy a violation of chapter 93H; this chapter's own enforcement clause (sec. 6) does not itself deem a violation actionable under ch. 93A sec. 9
Settledness
Section 3A(c) lets the department of consumer affairs and business regulation promulgate regulations interpreting and applying the section, and the guidance for this row comes from the Office of Consumer Affairs and Business Regulation rather than the Attorney General.
- As of
- Guidance link
- https://www.mass.gov/info-details/requirements-for-data-breach-notifications
- Guidance body
- Massachusetts Office of Consumer Affairs and Business Regulation
- Open questions
- Does 'compromised', the word the Office of Consumer Affairs and Business Regulation's guidance uses for when the 18-month credit monitoring offer is owed, mean the same as a Social Security number that 'was disclosed' or 'is reasonably believed to have been disclosed' in the breach of security under section 3A(a) of chapter 93H?
What it makes you log
Logging duty
Section 3A requires a person whose breach of security includes Social Security numbers to contract with a third party to offer each affected resident credit monitoring at no cost for at least 18 months (42 months for a consumer reporting agency), with the information needed to enroll and to place a security freeze, and bars requiring a waiver of the right to sue. It states no log, record or audit duty. Section 3(b) separately has the breaching person file a report with the Attorney General and the Director certifying that its credit monitoring complies with this section, which is a filing and is not part of this row's cited text. The section reaches residents whose Social Security number was disclosed.
- Kind
- None
- As of
What this law does
If a resident's Social Security number was disclosed or reasonably believed disclosed in a breach, the person or agency that experienced the breach must contract with a third party to offer that resident credit monitoring services at no cost for not less than 18 months. If the entity that experienced the breach is itself a consumer reporting agency, it must instead offer not less than 42 months of free credit monitoring.
The entity may not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer. Section 3A was added by chapter 444 of the Acts of 2018, approved . The Office of Consumer Affairs and Business Regulation states that the act takes effect 90 days later, on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .