Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
standards for the protection of state residents' personal information.
 |
||||
|
|
|||
|
||||
The law attempts to achieve its purpose by requiring two general activities of companies that "own or license" personal Information:
- The establishment of a written information security program (201 CMR 17.03).
- The implementation of specific computer system security controls (201 CMR 17.04).
The regulation varies significantly from other laws that, rather than requiring specific controls, more generally require the implementation of "appropriate," (e.g. "GLBA") "reasonable" (e.g. Cal AB 1950) or "adequate" (e.g. "SOX") information security controls. In an attempt to assuage angry small-business owners, the latest version of the Massachusetts data protection law utilizes a "risk-based" approach and mandates specific requirements and controls. As such, one could say the regulation represents a hybrid approach: Specific controls and policies are required, but those requirements are tempered by the amount of risk an entity poses. The question for security pros and lawyers is: What does this mean in practice?
One of the key practical issues is how to interpret the regulation's "risk-based" language, and how to apply it to an organization's particular set of circumstances. This is ultimately a legal question, making it extremely important for a company's security team to engage its legal team when developing a compliance plan. Without legal training, it will be difficult for security professionals to know how the courts, regulators and potential plaintiff's attorneys will interpret and apply the regulation. Let's look at key risk-based aspects of the regulation that your compliance and legal teams will need to be prepared for.
Interpreting risk-based language
The Massachusetts data protection law provides little guidance on how to interpret and apply its risk-based terms. This exercise is complex because interpretations may vary, and the application of these factors may differ from one organization to the next. The following legal issues demonstrate the difficulty in applying the risk-based language:
Size, resources and the amount of stored data can all be considered in determining the amount of risk a company poses. If a company is small and without resources, but has a lot of stored personal information, what is the more important "risk" factor: the size of the company, or the volume of data? The regulation does not say, and this is where significant legal analysis and positioning are required.
|
||||
|
|
|||
|
||||
Before an enterprise begins to craft its compliance strategy, it should establish attorney-client privilege with in-house or outside counsel in order to establish confidential communications between the legal team and security professionals working on compliance. While not foolproof, and sometimes subject to erosion in court, the attorney-client privilege will allow the organization to prevent certain communications between legal and security concerning compliance from getting into court. For example, let's say a company is sued and the issue is whether its written information security program was robust enough to comply with the Massachusetts's regulation. Discussions between the attorney and security pro concerning the decision to go with a less robust written information security program might not be accessible by the plaintiff's attorney that sued, and would not get in front of a jury or judge. This could significantly lower the company's risk of being found liable.
Ultimately, if a company chooses to do what some may interpret as less than the regulation strictly requires, it must develop a security-based rationale for the decision and use that to craft a legal position explaining why -- based on the risk-based factors in the law -- the choice poses less risk. Years later (sometimes after key personnel have moved on), in the event a breach occurs and its compliance with 201 CMR 17.00 is called into question, this documentation can assist the organization in establishing that it was in compliance, and it will serve as the basis of any defense should one be necessary.
Generally speaking, a 201 CMR 17.00 compliance exercise should be thought of more in terms of developing a defensible legal position. Nonetheless, in most cases a solid security foundation, combined with an in-depth compliance analysis, will yield the best results for the organization from an operational and legal standpoint.
Compliance with any law is a difficult process, and it is made even more difficult when dealing with a complex subject matter such as information security. For laws like the Massachusetts regulation (as well as a host of others, including GLBA, HIPAA, the EU Data Protection Directive and Nevada's Security of Personal Information Law), it is more important than ever for attorneys and security professionals to work together. These professionals must come up with a shared understanding of the risk their organizations are subject to, and jointly develop a plan that reduces the risk to an acceptable level and satisfies the specific criteria of these "risk-based" laws. A failure to do so can get a company in severe legal trouble, especially when non-lawyers attempt to interpret the law.
This was first published in November 2009