Law / United States / 
Massachusetts
Security Breach statute, Attorney General enforcement
In force since .
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect ch. 93H's own enforcement clause to arm only the Massachusetts Attorney General; look to 940 CMR 3.16(3), not this section, for the route by which a private plaintiff may sue over a breach-notice violation.
These lines are LexLint's reading of the law's text. Also read by: Massachusetts Office of the Attorney General, Privacy & Responsible Technology Division (guidance, recorded ).
Who enforces it
Enforcement body
Massachusetts Attorney General, who may bring an action under ch. 93A sec. 4 to remedy a violation of chapter 93H
Settledness
- As of
- Guidance link
- https://www.mass.gov/privacy-responsible-technology-division
- Guidance body
- Massachusetts Office of the Attorney General, Privacy & Responsible Technology Division
- Open questions
- Does the phrase 'or otherwise' in section 6 of chapter 93H let the Attorney General remedy a violation of the chapter by a proceeding other than an action under section 4 of chapter 93A?
What it makes you log
Logging duty
Section 6 lets the Attorney General bring an action under chapter 93A section 4, or otherwise, to remedy violations of chapter 93H. It names no log, record, audit or demand power over a record. It has no territorial clause of its own.
- Kind
- None
- As of
What this law does
Chapter 93H's own enforcement clause lets the Attorney General bring an action under ch. 93A section 4 to remedy a violation. On its own face, this section creates no private right of action: it does not deem a ch. 93H violation to be an unfair or deceptive practice actionable by a private plaintiff under ch. 93A section 9. A private right of action for a ch. 93H violation exists only through a separate Attorney General regulation, 940 CMR 3.16(3).
Chapter 93H was added by chapter 82 of the Acts of 2007, approved . The Office of Consumer Affairs and Business Regulation states that the chapter has been in effect since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .