Data security regulations: more strict and widespread?

Nevada and Massachusetts have tightened regulations for safeguarding personal information of state residents. Expectations are that more states will follow their lead.

Hacking compromised the personal information of millions of customers of the Framingham, Massachusetts-based parent company of retail stores that included TJ Maxx and Marshalls. The company was the victim of one of the largest data security breaches ever in the United States.

Probably, by now readers have readers or heard that the perpetrator, computer hacker Albert Gonzalez, was sentenced in Boston federal court to 20 years in prison. Gonzalez was charged in two cases with stealing 40 million debit and credit card numbers from national retailers and a restaurant chain. Gonzalez, 28-years-old, is a former Secret Service informant from Miami. He received two concurrent 20-year sentences, one for each of the two cases, plus three years of supervised release without any access to computers, and a $25,000 fine.

In response to the breach and its possible effects, the Massachusetts legislature developed regulations that established minimum requirements for safeguarding the personal information of Massachusetts residents.

A similar law took effect in Nevada in February. The Massachusetts law, similar to the Nevada law, was originally scheduled to take effect in January, 2009, but took effect March 1, 2010. To many, these laws signal that other states will also initiate new, stricter regulations concerning data security that most national companies will need to heed.

More Stringent Regulations

Currently approximately 40 states require companies to notify customers when a security breach occurs. The Nevada and Massachusetts laws go further by trying...