Law Would Strengthen Consumer Protections in Event of Data Security Breach

Subscribe to our free, daily publication for all your Westford news.

State Rep. James Arciero announced today that the Massachusetts House of Representatives has passed legislation to provide added protections and resources for consumers in the event of a data security breach that impacts a credit agency or other business.   

The legislation is currently before the Senate Ways and Means Committee for review before the full Senate takes a vote.

Under this legislation, credit freezes, lifts or removals, must be provided to consumers without a charge being assessed. In addition, credit agencies or businesses must provide one year of free credit monitoring after any breach.  

“This consumer protection legislation will go a long way to protect the citizens of Massachusetts whenever there is a data breach and their most sensitive financial information is put in jeopardy. Given the ever-increasing reports of such breaches over the last few years, I think it was critical for us to act and give consumers more control over the protection of their credit. This is an issue that impacts every individual, organization and business in the Commonwealth,” Arciero said. 

The legislation seeks to upgrade the framework for the implementation of a credit freeze and related communication.  Specifically the bill included provisions to: 

• Modernize the current law by allowing consumers to request credit freezes electronically or by telephone. 
• Require clear and accurate disclosure to consumers of basic information about credit freezes. 
• In the event of a security breach, mandates credit agencies place a security freeze on a consumer report within one day of an electronic or telephone request, and within three days of receipt of a written request.  
• Credit agencies must send confirmation of the security freeze within three days. 
• Credit agencies must lift a security freeze within three days of a written request and 15 minutes of an electronic/ phone request. 
• When a consumer requests a freeze, national credit reporting agencies must inform consumers of other reporting agencies that may have files on the consumer. They must also inform consumers of appropriate websites, toll-free numbers and mailing addresses that would permit the consumer to place additional freezes.  

For the first time in Massachusetts, this legislation establishes specific guidelines for parents and guardians to freeze the accounts of children under the age of 16 and incapacitated individuals.   

 The legislation also updates notification guidelines for breached entities and third party affiliates. This is accomplished by those entities that have been breached being required to immediately notify consumers and continue to give them timely updates. In addition, the Massachusetts Office of Consumer Affairs and Business Regulation will post notification of the breach within 24 hours of its occurrence. Finally, the Massachusetts Attorney General must provide information online to consumers regarding the breach.  

This bill also updates current Massachusetts law to require companies and organizations to obtain consent before running a credit report. 

“I am hopeful in this age of advanced technology that we can stay a step ahead of those individuals who seek to breach security systems and put Massachusetts residents at financial risk. I look forward to this bill becoming law,” said Arciero.