Bill > S132

This bill, titled "Relative to the security of Personal Financial information," amends existing Massachusetts law (Chapter 93H) to strengthen protections for consumers' financial data. Key provisions include defining terms like "access device" (e.g., credit or debit cards), "breach of security" (unauthorized access or use of data that risks identity theft or fraud), and "personal information" (which includes Social Security numbers, driver's license numbers, or financial account/card numbers when combined with other identifying data). The bill prohibits businesses that accept payment cards from retaining sensitive data like card security codes, PIN verification numbers, or full magnetic stripe data after a transaction is authorized, with a slightly longer retention period allowed for PIN debit transactions. Furthermore, if a data breach occurs, businesses and their service providers are required to reimburse financial institutions for costs associated with protecting cardholders, such as reissuing cards, closing accounts, or notifying customers. The bill also clarifies that while compliance with federal data security laws can satisfy some state requirements, businesses must still notify affected Massachusetts residents, the Attorney General, and the Director of the Office of Consumer Affairs and Business Regulation of any breach. Finally, the Attorney General is empowered to take legal action to address violations of these provisions.