Law note · Massachusetts
Security Breach statute, credit monitoring offer required
If a resident's Social Security number was disclosed or reasonably believed disclosed in a breach, the person or agency that experienced the breach must contract with a third party to offer that resident credit monitoring services at no cost for not less than 18 months. If the entity that experienced the breach is itself a consumer reporting agency, it must instead offer not less than 42 months of free credit monitoring.
The entity may not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer.
What it asks of an app
- Offer at least 18 months of free credit monitoring to a Massachusetts resident whose Social Security number was disclosed, or reasonably believed disclosed, in a breach of security.
- If you are a consumer reporting agency that experienced the breach, offer not less than 42 months of free credit monitoring instead of 18.
- Do not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Massachusetts General Laws text, Massachusetts Legislature