Senator Brian A. Joyce announced this week that the Senate has passed legislation that provides Massachusetts consumers with greater protection from identity theft. The Senate legislation increases requirements on companies and agencies to report security breaches and protect personal information. It also gives consumers the tools necessary to protect their credit information. This bill was drafted in the Consumer Protection and Professional Licensure Committee, of which Senator Joyce is a member.  

“It is of the utmost importance for Massachusetts to protect the rights and identities of the consumers who fuel its economy,” said Senator Joyce.  

“It is time for Massachusetts to protect consumers from identity theft,” said Senate President Murray. “This law empowers consumers and increases the responsibility of companies and agencies that store consumers’ personal and credit information.” 

The legislation allows consumers to dictate who has access to their personal information from credit reporting agencies by allowing them to apply a security freeze on their information. The consumer would be required to send notifications to the reporting agencies requesting the freeze. Once the reporting agency receives the request, they will send individual confirmation as well as an ID and passcode. This passcode will allow the consumer to temporarily unfreeze or completely remove the freeze from the account.  

There will be a maximum of a $5 fee to implement, remove, or lift a freeze. The charges, however, will not apply to a victim of identity theft of a victim’s spouse. 

In addition to empowering consumers, the legislation also clearly defines the requirements and responsibilities of businesses and agencies. Specifically, businesses, government agencies and non-profits are required to inform individuals of any security breach where there is the potential that personal information has been accessed and might be used for unlawful activities. The business or agency would provide a written notice, or depending on the number of consumers affected, an appropriate means of notification to the affected individuals.  

Businesses and agencies are also directed to properly dispose of personal information, either electronic or paper formats, by measures that include redaction, pulverizing, burning, erasure of electronic data or shredding. Any entities failing to properly dispose of personal information can be fined up to $100 for each data subject affected, but not exceeding $50,000. 

The Federal Trade Commission estimates that 9 million people each year are victims of identity theft. The legislation is now on its way to the Governor’s desk to await his signature.