IMPORTANT E-ALERT: Identity Theft Regulations Extended to January 1, 2010

Late in the evening on February 12, 2009, the Office of Consumer Affairs and Business Regulation (“OCABR”) announced that it had filed amendments to the identity theft regulations that delay their effective date to January 1, 2010.  This is the second time the regulations have been extended: they were initially slated to take effect on January 1, 2009 and then extended to May 1, 2009. 

The new amendments also modify the standard for third party vendor relationships.  The new language, found in Section 17.03(6) of the amended regulations, provides that businesses must:

Tak[e] all reasonable steps to verify that any third-party service provider with access to personal information has the capacity to protect such personal information in the manner provided for in 201 CMR 17.00; and tak[e] all reasonable steps to ensure that such third party service provider is applying to such personal information protective security measures at least as stringent as those required to be applied to personal information under 201 CMR 17.00. 

Even though businesses have been given a second reprieve, there will likely not be another.  In fact, the OCABR issued a press release announcing the delay and, in it, stated that: “[b]usinesses are becoming more aware of the urgency of this issue. To achieve the full benefit for consumers as quickly as possible, it’s worth making sure every business in the state has time to make the necessary changes to comply with these regulations …We understand the impact of the current business environment, and feel this is an appropriate timeframe for companies to implement the necessary protections.” 

The OCABR’s press release regarding the delay can be read by clicking here.

Because these regulations are so onerous, even with the delay in the effective date, you should begin planning for compliance immediately.  For more information about the amended regulations or for assistance in planning for compliance, please contact Amy B. Royal, Esq. at (413) 586-2288 or at aroyal@rkesq.com.