In a development that likely occurred after this article went to print, according to the Office of Consumer Affairs and Business Regulation (OCABR), the effective date for compliance with Massachusetts’ data privacy and security regulations has been extended generally to May 1, 2009.

The regulations originally required businesses to be in full compliance on or before January 1, 2009. Attributing the extension to the economic downturn, a November 14, 2008, OCABR press release rescinds the January 1, 2009, deadline and replaces it with a general compliance deadline of May 1, 2009, with additional time allowed for certain aspects of the regulations. Under the extension, businesses will have until January 1, 2010, to obtain certification from vendors concerning their compliance with the regulations and to encrypt portable devices other than laptops.

Even with the extended deadlines, the regulations create a number of new requirements for businesses that will take time to implement, such as the risk assessment, policy preparation and training requirements. Businesses, therefore, should continue to move quickly to comply.

Joseph Lazzarotti, Partner
lazzarottij@jacksonlewis.com
Jackson Lewis LLP

The author really ought to address the Commerce Clause constitutional issue. I doubt Massachusetts can get away with telling every business in the world how they must handle information about Jane Doe just because Jane happens to live in their state. They certainly wouldn't get away with that kind of [nonsense] if Jane were to travel physically to another state; there's no reason for it to be any different if Jane were to 'travel' electronically.

This pretty much kills the iPhone at the enterprise level as there is no way to encrypt the iPhone nor has Apple released the API for 3rd party encryption

As a business owner, Mass. has just shut the doors to my business. Why should I put in special compliance for one of 50 states? I hope that others follow suit. No insurance companies, no healthcare companies, ... Hope that Mass. Unemployment Insurance has large reserves!

Washington and Michigan have similar legislation in the hopper for 2009, and California has a draft ready.