Data Security: Does the new law apply to you? (4/21/10)

Over the past few weeks I've mentioned this new law (Massachusetts Chapter 93H, implemented by regulation 201 CMR 17.00) to a variety of people, and I've noticed that:

Almost no one has heard about it.
Almost no one wants to hear about it.
Almost everyone thinks it doesn't apply to them.

Does the law apply to you? Take this quick test
As I wrote in last month's newsletter, if your organization (whether a business, nonprofit, or informal group):

Receives payment by check from any Massachusetts resident or organization, or
Has any Massachusetts employees on the payroll, or
Pays any Massachusetts contractors

then the new law applies to you. Why? You're handling names, bank account numbers (on those checks), Social Security numbers or Taxpayer Identification Numbers (TIN) or Employer Identification Numbers (EIN) on your 1099s and W-9s, exactly the kind of "Personal Information" specifically covered by this law.

If your organization also handles Driver's license numbers, credit or debit card numbers, or any other financial account numbers for any Massachusetts resident, then this law applies to you as well.

See "Data Security: The new Massachusetts law you can't ignore" (http://kadansky.com/files/newsletters/2010/2010_03_17.html) for details.

Resistance vs. Acceptance
The resistance to this law reminds me of Dr. Elisabeth Kübler-Ross' theory on the stages of grief:

Denial: "This law can't apply to me!" "I'll ignore it, they'll never catch me."
Anger: "Why should I have to deal with any of this?" "I'm busy!" "Can't someone else just do this for me?"
Bargaining: "What's the absolute minimum I can do?"
Depression: "I'm never going to get through this, it's impossibly complicated."

These reactions are understandable. I experienced all of them too, but the sooner you can work through to Acceptance ("Ok, let's break these requirements into smaller, manageable pieces and get moving; this will result in better protection for me and my customers"), the sooner you can get started on this important work.

As I learn about these issues and how to address them, I will share with you what I've learned and what changes I'm making in my own business and my habits.

If you know someone who might find this helpful, please feel free to forward it.
If you have any comments about this article, send me a reply!
If you have a topic that you'd like me to write about, I'd love to hear about it!