Data Security and Privacy in Massachusetts

Description

Preliminary Pages ACKNOWLEDGMENTS ABOUT THE EDITOR ABOUT THE AUTHORS TABLE OF CONTENTS TABLE OF EXHIBITS Chapter 1 Conceptions of Privacy and Security in a Digital World § 1.1 INTRODUCTION § 1.2 PRIVACY AND SECURITY: PROMISES AND DANGERS OF “BIG DATA” § 1.2.1 Distinguishing Privacy and Security (a) Privacy (b) Security § 1.2.2 The Challenges of Cyberspace (a) Security Challenges (b) Privacy Challenges § 1.3 SOURCES AND HISTORY OF THE LAW OF INFORMATION PRIVACY AND SECURITY § 1.3.1 Foundations § 1.3.2 Civil Rights and Consumer Protection § 1.3.3 Credit Expansion § 1.3.4 Computerization and Security § 1.3.5 Electronic Health Records § 1.3.6 Financial Institution Reform § 1.3.7 Addressing Web Abuses § 1.3.8 Identity Theft § 1.3.9 Summary of the Framework Chapter 2 The Electronic Communications Privacy Act § 2.1 INTRODUCTION § 2.2 THE ELECTRONIC COMMUNICATIONS PRIVACY ACT § 2.3 THE WIRETAP ACT § 2.3.1 Interception of Communications § 2.3.2 Exceptions § 2.3.3 Communications in Transit Versus Stored Communications § 2.3.4 Video Surveillance § 2.4 MASSACHUSETTS ELECTRONIC SURVEILLANCE STATUTE § 2.4.1 Oral Communications—No “Expectation of Privacy” Requirement § 2.4.2 Consent of All Parties § 2.4.3 Video Surveillance § 2.5 THE STORED COMMUNICATIONS ACT § 2.5.1 Why the SCA Exists § 2.5.2 Prohibition on Unauthorized Access § 2.5.3 Entities Regulated by the SCA § 2.5.4 Providers “to the Public” Versus Nonpublic Providers § 2.5.5 Content Information Versus Noncontent Information § 2.5.6 The Privacy Protections of the SCA (a) Compelled Disclosure Rules (b) Voluntary Disclosure Rules (c) Voluntary Disclosure Versus Compelled Disclosure § 2.5.7 Interplay with Massachusetts Constitution § 2.5.8 Interplay with Fourth Amendment § 2.5.9 Consent and Discovery Under the SCA § 2.6 CONCLUSION EXHIBIT 2A—Wiretap Report 2016 Chapter 3 Computer Fraud and Abuse Act § 3.1 INTRODUCTION § 3.2 KEY TERMINOLOGY § 3.2.1 Protected Computer § 3.2.2 Computer § 3.2.3 Access § 3.2.4 Unauthorized Access and Exceeding Authorized Access § 3.2.5 Damage or Loss § 3.3 CRIMINAL PROHIBITIONS § 3.3.1 18 U.S.C. § 1030(a)(1)—Espionage § 3.3.2 18 U.S.C. § 1030(a)(2)—Confidentiality § 3.3.3 18 U.S.C. § 1030(a)(3)—Trespass to Government Computers § 3.3.4 18 U.S.C. § 1030(a)(4)—Computer Fraud § 3.3.5 18 U.S.C. § 1030(a)(5)—Malware, Viruses, and Damage to Data § 3.3.6 18 U.S.C. § 1030(a)(6)—Password Trafficking § 3.3.7 18 U.S.C. § 1030(a)(7)—Extortion § 3.4 PRIVATE RIGHT OF ACTION § 3.5 CRITICISM AND CALLS FOR REFORM § 3.5.1 Internet Advocacy and Hacktivism § 3.5.2 Cyber Bullying § 3.5.3 Use of Employer Resources for Personal Use § 3.5.4 Proposed Reforms § 3.6 LEGISLATIVE HISTORY § 3.6.1 H.R. 5616 § 3.6.2 The 1984 Act: The Counterfeit Access Device and Computer Fraud and Abuse Act § 3.6.3 The 1986 Amendments § 3.6.4 The 1994 Amendments: The Computer Abuse Amendments Act of 1994 § 3.6.5 The 1996 Amendments: The National Information Infrastructure Protection Act of 1996 § 3.6.6 The 2001 Amendments: The USA PATRIOT Act § 3.6.7 The 2002 Amendments: The Cyber Security Enhancement Act of 2002 § 3.6.8 The 2008 Amendments: The Identity Theft Enforcement and Restitution Act of 2008 § 3.6.9 Scope and Application of the CFAA Today EXHIBIT 3A—18 U.S.C. § 1030, Fraud and Related Activity in Connection with Computers Chapter 4 Fair Credit Reporting Act; Fair and Accurate Credit Transactions Act § 4.1 OVERVIEW: FCRA AND FACTA § 4.1.1 History of the FCRA and FACTA § 4.1.2 Addressing Incorrect Information on Consumer Reports and CRA Liability § 4.2 WHAT THE FCRA AND FACTA PROTECT AND RENDER PRIVATE § 4.2.1 Truncation of Credit and Debit Card Numbers and Expiration Dates on Printed Receipts § 4.2.2 Consumers Can Request a Truncation of the First Five Digits of Their Social Security Numbers § 4.2.3 Restrictions on Medical Information Appearing in Consumer Reports § 4.2.4 Restrictions on Employers’ Use of a Consumer Report § 4.2.5 Red Flag Guidelines § 4.2.6 Restrictions on Issuance of an Additional or New Card when Change of Address Notification Filed § 4.2.7 Address Discrepancies § 4.2.8 Reports Must Be Used for a Permissible Purpose § 4.2.9 CRAs Must Use Reasonable Procedures to Assure Maximum Possible Accuracy § 4.3 WHAT HAPPENS IF THE PRIVATE DATA IS USED AND HOW TO DEAL WITH CONSUMER REPORTING PROBLEMS § 4.3.1 What Identity Theft Is and Why It Is a Problem § 4.3.2 Information Available to Identity Theft Victims § 4.3.3 Fraud Alerts (a) Initial Fraud Alert or One-Call Fraud Alert (b) Extended Fraud Alert (c) Active Duty Alert (d) Effects of the Three Alerts on Users (e) Liability of CRAs and Users and Preemption (f) Security Freezes § 4.3.4 Blocking Fraudulent Information (a) CRAs (b) Furnishers Chapter 5 The Gramm-Leach-Bliley Act (GLBA) § 5.1 OVERVIEW OF THE GRAMM-LEACH-BLILEY ACT § 5.2 RULE MAKING § 5.2.1 The Safeguards Rule § 5.2.2 The Financial Privacy Rule § 5.2.3 The Pretexting Rule § 5.3 SCOPE OF THE GLBA § 5.3.1 Entities Subject to the GLBA § 5.3.2 Information Protected Under the GLBA—Nonpublic Personal Information (NPPI) § 5.3.3 Individuals Protected Under the GLBA—Consumers and Customers § 5.4 NOTICE, DISCLOSURE, AND SAFEGUARDING REQUIREMENTS UNDER THE GLBA § 5.4.1 Notice, Disclosure, and Safeguarding Requirements § 5.4.2 Consent Requirements § 5.4.3 Limits of Reuse of NPPI § 5.4.4 Restrictions on Disclosing NPPI to Third Parties § 5.4.5 Data Security Requirements § 5.4.6 Data Breach Notification Requirements (a) FFIEC Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice Components of a Response Program When Customer Notice Should Be Provided Customer Notice Delivery of Customer Notice (b) FTC Guidance on Breach Notification § 5.5 PRETEXTING § 5.5.1 Overview § 5.5.2 Prohibition on Obtaining or Soliciting Customer Information Using False Pretenses § 5.5.3 Exceptions to Pretexting Rule § 5.5.4 Enforcement of Pretexting Rule § 5.5.5 Criminal Penalty for Violation of Pretexting Rule § 5.6 GLBA ENFORCEMENT § 5.6.1 Enforcement § 5.6.2 Sanctions and Other Liability (a) Judicial and CFPB Enforcement (b) FTC Enforcement EXHIBIT 5A—Regulatory Enforcement Authority for the Privacy, Safeguards, and Pretexting Rules EXHIBIT 5B—Model Privacy Notice Form: Opt Out EXHIBIT 5C—Model Privacy Notice Form: No Opt Out Chapter 6 Information Security in Health Care: HIPAA and HITECH § 6.1 INTRODUCTION § 6.2 STATUTORY AUTHORITY FOR THE ORIGINAL PRIVACY AND INFORMATION SECURITY RULES AND THE HITECH AMENDMENTS § 6.3 BRIEF OVERVIEW OF THE HIPAA PRIVACY RULE AND HOW IT RELATES TO INFORMATION SECURITY § 6.4 THE HIPAA INFORMATION SECURITY RULE § 6.4.1 Key Concepts (a) Protected Health Information (b) Covered Entities and Business Associates (c) The Security Rule Applies Only to Electronic PHI (d) Scalable (e) Technology Neutral (f) Relationship to Industry Standards (g) Required and Addressable Specifications § 6.4.2 The Core Requirement § 6.4.3 The Centrality of Risk Assessment § 6.4.4 Administrative Safeguards § 6.4.5 Physical Safeguards § 6.4.6 Technical Safeguards § 6.4.7 Information Security Guidance § 6.5 ENFORCEMENT AND PENALTIES: THE IMPACT OF HITECH § 6.5.1 Overview of the Enforcement Process § 6.5.2 Penalties Under the Original HIPAA Statute § 6.5.3 Penalties After HITECH § 6.5.4 Vicarious Liability for the Acts of Business Associates § 6.5.5 Enforcement of the HIPAA Regulations by the Office of Civil Rights § 6.5.6 Open Issues and Questions Under HITECH and the Enforcement Rule § 6.6 BREACH NOTIFICATION AND INFORMATION SECURITY § 6.6.1 Brief Overview of the Breach Notification Rule § 6.6.2 Impact on Information Security and Enforcement (a) Are Breaches Violations of the Security Rule? (b) Publicity, Enforcement, and Private Litigation EXHIBIT 6A—HIPAA Security Standards Matrix Chapter 7 Congressional Response to the Internet § 7.1 INTRODUCTION § 7.2 COMMUNICATIONS DECENCY ACT § 7.2.1 Anti-indecency and Antiobscenity Provisions § 7.2.2 Section 230—Online Service Providers Sheltered from Liability § 7.2.3 Defamation (as Opposed to Intellectual Property) Liability Shield § 7.2.4 Who Qualifies for Protection Under the Statute? § 7.2.5 “Source of the Content at Issue”—Room for Argument § 7.2.6 Other Illegal Content § 7.3 DIGITAL MILLENNIUM COPYRIGHT ACT § 7.3.1 DMCA Safe Harbor § 7.3.2 Who Qualifies? § 7.3.3 Designation of Agent § 7.3.4 Requirements for Valid Takedown Requests § 7.3.5 Responding to Takedown Requests § 7.3.6 Clarification About Secondary Liability Safe Harbor § 7.3.7 Anticopyright Management Circumvention § 7.3.8 DMCA Anticircumvention Exemptions § 7.3.9 Notable Anticircumvention Cases § 7.4 CHILDREN’S ONLINE PRIVACY PROTECTION ACT § 7.4.1 Privacy Policy § 7.4.2 Not Just Notice, but Choice and Access § 7.4.3 Initial Notice to Parent Required § 7.4.4 What Are the Consequences for Failure to Comply? § 7.4.5 Security and Data Retention § 7.4.6 Student Privacy § 7.5 CAN-SPAM ACT § 7.5.1 E-mails Covered by CAN-SPAM Act § 7.5.2 Compliance Requirements § 7.5.3 Consequences for Noncompliance Chapter 8 The Federal Trade Commission( § 8.1 THE FEDERAL TRADE COMMISSION § 8.2 OPERATION OF THE FTC (CONSUMER PROTECTION) § 8.3 FTC IMPLEMENTATION OF DATA SECURITY STATUTES § 8.3.1 Fair Credit Reporting Act (FCRA) (a) Original Regulation of Dissemination of Credit Reports (b) Fair and Accurate Credit Transactions Act § 8.3.2 Gramm-Leach-Bliley Act (a) Subtitle A: Safeguarding of Nonpublic Personal Information (b) Subtitle A: Disclosure of Nonpublic Personal Information (c) Subtitle B: Pretexting § 8.3.3 Health Insurance Portability and Accountability Act (HIPAA) § 8.4 OTHER PRIVACY STATUTES ADMINISTERED OR ENFORCED BY THE FTC § 8.4.1 Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act, 15 U.S.C. §§ 7701–7713 § 8.4.2 Telemarketing and Consumer Fraud and Abuse Prevention Act § 8.4.3 Do-Not-Call Legislation § 8.4.4 The Children’s Online Privacy Protection Act (COPPA) § 8.5 FTC ACTIONS AGAINST “UNFAIR OR DECEPTIVE ACTS OR PRACTICES” EXHIBIT 8A—Red Flags Rule Guidelines EXHIBIT 8B—GLBA Safeguards Rule Information Protection Program Elements EXHIBIT 8C—FTC Health Information Breach Notification Rule Chapter 9 Survey of State Data Security and Privacy Law § 9.1 STATE LAW FOUNDATIONS § 9.1.1 Federal and State Constitutions § 9.1.2 State Common Law § 9.2 STATE STATUTES § 9.2.1 State Data Security Breach Statutes § 9.2.2 State Personal Data Security Statutes (a) Driver’s License Information (b) Social Security Numbers (c) Security and Disposal of Records (d) Internet Collection of Personal Information § 9.2.3 State Laws Against Internet Intrusion (a) State Antispam Legislation (b) State Antispyware and Antiphishing Statutes (c) Employer and School Coercion of Access to Social Media (d) Cyber-Bullying (e) “Revenge Porn” § 9.3 DATA SECURITY AND PRIVACY LITIGATION Chapter 10 Massachusetts Data Security Law and Regulations* § 10.1 OVERVIEW § 10.2 THE BREACH NOTICE LAW § 10.2.1 Personal Information § 10.2.2 Covered Entities § 10.2.3 Triggers for Notice § 10.2.4 Timing of Notice § 10.2.5 Content of the Notice (a) Licensors and Owners (b) Maintainers/Storers § 10.2.6 Penalties and Enforcement § 10.2.7 Compliance with Federal Law § 10.2.8 Court Cases § 10.2.9 Practical Aspects of Responding to a Breach (a) Secure and Preserve (b) Investigate (c) Prepare Required Notices (d) Develop a Public Relations Approach (e) Evaluate Relevant Contracts (f) Consider Offering Credit Monitoring (g) Conduct a Postincident Review § 10.3 THE DATA DESTRUCTION/DISPOSAL LAW § 10.3.1 Basic Requirements § 10.3.2 Penalties and Enforcement § 10.3.3 Practice Tips § 10.4 THE DATA SECURITY REGULATIONS § 10.4.1 Major Requirements § 10.4.2 The WISP (a) Data Security Coordinator (b) Risk Assessment and Improvement of Safeguards (c) Employee Policies, Training, and Discipline (d) Terminated Employees (e) Third-Party Service Providers (f) Overall Restrictions § 10.4.3 Computer System Security Requirements (a) “Secure User Authentication Protocols” (b) “Secure Access Control Measures” (c) Encryption (d) Monitoring (e) Security Protections § 10.4.4 Practice Tips (a) The Assessment (b) Create a Data Security Binder EXHIBIT 10A—Frequently Asked Questions Regarding 201 C.M.R. § 17.00 EXHIBIT 10B—A Small Business Guide: Formulating a Comprehensive Written Information Security Program EXHIBIT 10C—Standards for the Protection of Personal Information of Residents of the Commonwealth—201 C.M.R. § 17.00 EXHIBIT 10D—OCABR 201 C.M.R. § 17.00 Compliance Checklist EXHIBIT 10E—Personal Information: A Graphical Representation EXHIBIT 10F—Action Plan for Complying with Massachusetts Data Security Regulations EXHIBIT 10G—Twelve Practical Tips for Employers EXHIBIT 10H—Helpful Websites Chapter 11 Consumer/Retail Issues( § 11.1 INTRODUCTION § 11.2 CONTRACTING CONSIDERATIONS § 11.3 DRAFTING TERMS § 11.3.1 Privacy Policy or Notice § 11.3.2 Acceptable Use Policy § 11.3.3 Intellectual Property Notices § 11.4 PRIVACY ISSUES—NOTICE CONTENTS § 11.4.1 Data Collected § 11.4.2 Use of Data (Including Sharing) § 11.4.3 User Access and Options § 11.5 CONCLUSION Chapter 12 Network Service Providers* § 12.1 INTRODUCTION § 12.1.1 What Is a Network Service Provider? § 12.1.2 Representing a Business Consumer of Network Services § 12.1.3 Representing a Network Service Provider § 12.2 RELEVANT STATUTES AND REGULATIONS § 12.2.1 Federal Law—The Telecommunications Act of 1996 and the Communications Act of 1934 (a) Common Carriers Under Title II of the Communications Act (b) The Telecommunications Act of 1996—Distinguishing Between and Among the Different Types of Service Providers (c) The FCC and Regulation of the Internet The FCC’s Comcast Order The 2010 Open Internet Order FCC’s Solution—Reclassification of Internet Service Providers as Common Carriers (d) Provisions of the Telecommunications Act Related to Privacy and Security § 12.2.2 Federal Law—Title II of the Electronic Communications Privacy Act, the Stored Communications Act § 12.2.3 Federal Law—Communication Decency Act § 12.2.4 Massachusetts State Law and Regulations § 12.3 NEGOTIATING NETWORK SERVICE PROVIDER CONTRACTS § 12.3.1 Defining Privacy and Data Security Obligations in Service Provider Relationships § 12.3.2 Representing a Business Engaging a Service Provider—Setting the Framework for the Deal (a) Conduct a Data Audit and Engage in Data Mapping (b) Analyze and Understand Relevant Laws, Regulations, and Company Policies (c) Conduct and Document a Technical Assessment and Due Diligence of Service Provider EXHIBIT 12A—Service Provider Data Security Questionnaire Chapter 13 Vendors and Business Associates § 13.1 INTRODUCTION § 13.2 HIPAA OMNIBUS RULE § 13.3 “RED FLAGS” RULE § 13.4 GRAMM-LEACH-BLILEY SAFEGUARDS RULE § 13.5 FEDERAL INFORMATION SECURITY MANAGEMENT ACT § 13.6 MASSACHUSETTS DATA SECURITY § 13.7 PAYMENT CARD INDUSTRY RULE EXHIBIT 13A—HIPAA Privacy and Security Compliance Agreement Chapter 14 Cyber Risk Insurance and Risk Management § 14.1 INTRODUCTION § 14.2 CYBER RISK INSURANCE FORMS § 14.3 FIRST-PARTY CYBER RISK COVERAGES § 14.3.1 Data Breach Response Costs § 14.3.2 Data Loss § 14.3.3 Network Service Interruption / Business Interruption § 14.3.4 Cyber Extortion and Ransom Coverage § 14.3.5 Reputational Damage § 14.3.6 Physical Loss or Damage to Property § 14.3.7 Crime § 14.4 THIRD-PARTY CYBER RISK COVERAGES § 14.4.1 Data Security Liability § 14.4.2 Privacy Liability § 14.4.3 Media Content Liability § 14.4.4 Products Liability § 14.5 FIRST-PARTY CYBER RISK INSURANCE CASE LAW § 14.5.1 American Guarantee & Liability Insurance Co. v. Ingram Micro, Inc. § 14.5.2 Lambrecht & Associates v. State Farm Lloyds § 14.5.3 Apache Corp. v. Great American Insurance Co. § 14.5.4 Principle Solutions Group, LLC v. Ironshore Indemnity, Inc. § 14.5.5 InComm Holdings Inc. v. Great American Insurance Co. § 14.5.6 Taylor & Lieberman v. Federal Insurance Co. § 14.5.7 State Bank of Bellingham v. BancInsure Inc. § 14.5.8 Pestmaster Services Inc. v. Travelers Casualty and Surety Co. of America § 14.5.9 Aqua Star (USA) Corp. v. Travelers Casualty and Surety Co. of America § 14.5.10 American Tooling Center, Inc. v. Travelers Casualty and Surety Co. of America § 14.5.11 Medidata Solutions, Inc. v. Federal Insurance Co. § 14.6 THIRD-PARTY CYBER RISK INSURANCE CASE LAW § 14.6.1 First Bank of Delaware, Inc. v. Fidelity & Deposit Co. of Maryland § 14.6.2 Retail Ventures, Inc. v. National Union Fire Insurance Co. § 14.6.3 State Auto Property & Casualty Insurance Co. v. Midwest Computers & More § 14.6.4 Eyeblaster, Inc. v. Federal Insurance Co. § 14.6.5 First Commonwealth Bank v. St. Paul Mercury Insurance Co. § 14.6.6 Zurich American Insurance Co. v. Sony Corp. of America § 14.6.7 Recall Total Information Management, Inc. v. Federal Insurance Co. § 14.6.8 Travelers Indemnity Co. of America v. Portal Healthcare Solutions, LLC § 14.6.9 Hartford Casualty Insurance Co. v. Corcino & Associates § 14.6.10 Travelers Indemnity Co. of Connecticut v. P.F. Chang’s China Bistro, Inc. § 14.6.11 Travelers Property Casualty Co. of America v. Federal Recovery Services, Inc. § 14.6.12 P.F. Chang’s China Bistro, Inc. v. Federal Insurance Co. § 14.6.13 Camp’s Grocery, Inc. v. State Farm Fire & Casualty Co. § 14.7 CYBER RISK MANAGEMENT § 14.7.1 Evaluation of the Types of Electronically Stored Information § 14.7.2 Evaluation of Current Network Infrastructure and Security § 14.7.3 Media Publication Risks § 14.7.4 Development of Data Security Protocols § 14.7.5 Employee Devices § 14.7.6 Creating a Data Breach Response and Notification Protocol § 14.7.7 Evaluation of Current Insurance Programs and Coverage Gaps § 14.7.8 Employee Training § 14.7.9 Regulatory Compliance Chapter 15 Privacy and Security in M&A Transactions § 15.1 INTRODUCTION § 15.2 DUE DILIGENCE § 15.3 TRANSFER OF PERSONAL DATA IN BANKRUPTCY § 15.4 RISKS OF DISCLOSING PERSONAL DATA DURING DUE DILIGENCE § 15.5 REPRESENTATIONS AND WARRANTIES § 15.6 INDEMNIFICATION AND INSURANCE § 15.7 DEAL STRUCTURE § 15.8 CONCLUSION EXHIBIT 15A—Sample Initial Due Diligence Request List for Privacy and Security M&A EXHIBIT 15B—Sample Agreement Provisions for Privacy and Security Chapter 16 Current Developments § 16.1 INTRODUCTION § 16.2 CONGRESSIONAL ACTIVITY § 16.3 THE FTC FRAMEWORK § 16.4 THE STATES § 16.5 IDENTITY MANAGEMENT § 16.6 CONCLUSION EXHIBIT 16A—House of Representatives Resolution 835 Table of Cases A B C D E F G H I J K L M N O P R S T U V W Y Z Table of Statutes, Rules & References FEDERAL MASSACHUSETTS OTHER STATES ADDITIONAL REFERENCES AND RESOURCES Index A B C D E F G H I K L M N O P R S T U V W