Amy Crafts - Not-For-Profit/Exempt Organizations Blog http://nonprofitlaw.proskauer.com/amy-crafts.html Amy Crafts is an associate in the Litigation Department, and focuses on commercial litigation, including intellectual property, anti-trust, government investigations and corporate governance. She represents a wide variety of clients, ranging from public and private companies to government entities and individuals, in all phases of litigation, including pre-litigation strategy and negotiation, state and federal trials and appeals, arbitrations and mediations. Amy is a member of the Boston office’s hiring committee and represents the Boston office on the Firm’s women’s affinity group. Amy is also a member of the Firm’s pro bono committee and received the Firm’s Golden Gavel award in 2008. Her pro bono efforts are focused on urban youth and victims of domestic violence. She is a board member of the Youth Advocacy Foundation and serves as pro bono counsel for YouthBuild Boston. In addition, Amy spearheaded and facilitates the Firm’s successful 209A Initiative in collaboration with the Middlesex District Attorney’s Office, for which she has been recognized by the Firm and the Middlesex District Attorney. In addition, Amy serves on the Event Committee for the Victims' Rights Law Center. Amy is a member of LeadBoston’s class of 2009, and graduated from Williams College and the University of Connecticut School of Law. During law school, Amy was a legal intern at the General Electric Company, was the Commentary Editor for the Connecticut Law Review, and was a moot court teaching assistant. Amy is admitted to practice in New York (2004) and Massachusetts (2006), the Southern and Eastern Districts of New York and Massachusetts District Court. Prior to joining Proskauer in 2005, Amy was a litigation associate at Hunton & Williams in New York. Amy was selected as a “Massachusetts Super Lawyers Rising Star” in 2009. en-us Copyright 2011 Tue, 01 Jun 2010 11:40:00 -0500 Wed, 16 Feb 2011 13:01:09 -0500 http://www.movabletype.org/ http://blogs.law.harvard.edu/tech/rss Out-of-State Exempt Organizations May be Affected by New Massachusetts Data Security Regulations Massachusetts's new data security regulations, effective March 1, 2010, currently set forth the country’s most stringent requirements for protecting data. Extending beyond what is required by other states, Massachusetts specifies that, for example, covered entities, including exempt organizations, must implement a written information security program and must encrypt personal information that will be transmitted over the Internet, or that is kept on laptops and other portable devices.  Out-of-state exempt organizations working with Massachusetts residents should determine whether they have to comply with these new regulations. 

Massachusetts regulators and enforcement agencies would likely make the following three arguments that certain out-of-state exempt organizations, like in-state exempt organizations, must comply with the new regulations.

]]>First, Massachusetts would likely argue that, in order to determine whether an exempt organization is subject to the regulations, the threshold inquiry involves an assessment of information owned or licensed by the exempt organization – not an assessment of where that exempt organization is located. The regulations pertain to legal entities that own or license personal information of Massachusetts residents, which is defined as a Massachusetts resident’s first and last name, or first initial and last name in combination with any one or more of the following data elements related to the resident: (1) social security number; (2) driver’s license number or state-issued identification card number; or (3) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account. Thus, Massachusetts would likely contend that any exempt organization that owns or licenses personal information of Massachusetts residents – regardless of where that exempt organization is located – is a covered entity under the regulations.

Second, based on discussions that occurred before the regulations went into effect, it is safe to expect that Massachusetts regulators will assert the right to enforce the regulations against out-of-state exempt organizations. While no litigation has been filed as of yet – the regulations have been in effect for just over two months – Massachusetts regulators have made clear that they intend to vigorously enforce the regulations to the extent required to protect Massachusetts residents from identity theft, the very purpose for which these regulations were promulgated.

Third, Massachusetts would likely argue that owning or licensing personal information is sufficient for jurisdictional purposes. Specifically, Massachusetts would contend that, by owning or licensing personal information of Massachusetts residents, the out-of-state exempt organization purposefully availed itself of the privilege of conducting business in Massachusetts. Alternatively, Massachusetts would contend that owning or licensing personal information of Massachusetts residents constitutes sufficient contacts with Massachusetts. While no precedent currently exists on this issue, Massachusetts would attempt to convince the courts that owning or licensing a Massachusetts resident’s personal information satisfies one or both of these jurisdictional tests.

Because we expect that Massachusetts will aggressively enforce these new regulations, we encourage out-of-state exempt organizations that own or license personal information of Massachusetts residents to work towards compliance with the new regulations by implementing administrative, technical, and physical safeguards to protect the personal information they own or license.

]]> http://nonprofitlaw.proskauer.com/2010/06/articles/privacy/outofstate-exempt-organizations-may-be-affected-by-new-massachusetts-data-security-regulations/ http://nonprofitlaw.proskauer.com/2010/06/articles/privacy/outofstate-exempt-organizations-may-be-affected-by-new-massachusetts-data-security-regulations/ Massachusetts data security breach lawPrivacy Tue, 01 Jun 2010 11:40:00 -0500 Amy Crafts