July 31st 2018 BOSTON – The House and Senate have finalized legislation to give Massachusetts residents more control over the use of their personal credit information, along with enhanced protections in the event their information is compromised.
Representative David K. Muradian, Jr. (R-Grafton) and Senator Michael O. Moore (D- Millbury), voted to support House Bill 4806, An Act relative to consumer protection from security breaches, which passed the House and Senate unanimously on July 25. The bill represents a compromise agreed to by a six-member conference committee that worked to reconcile the differences between two earlier versions of the bill previously approved by the two branches.
House Bill 4806 prevents unauthorized access to credit reports by requiring written, verbal or electronic consent from the consumer before their personal information can be accessed. Anyone attempting to access a consumer’s credit report must also disclose their reason for doing so to the consumer.
The bill also institutes new requirements on business entities and credit reporting agencies that experience a data breach. Businesses will now be required to provide a minimum of 18 months of free credit monitoring services to consumers following a breach, while credit reporting agencies will be required to provide these services free of charge for at least 3 ½ years. In addition, breached entities must immediately notify the Attorney General and the Director of the Office of Consumer Affairs whenever a breach occurs and provide details on the extent of the breach and the steps being taken to address it.
“I am confident that this bill will aid in creating a safer climate for credit cardholders in the Commonwealth,” said Representative Muradian. “Credit card agencies should allow for citizens to control their personal information; should the agencies fail, the consumer will now be protected by the state. I feel that this bill will create a positive change in the wake of major past security breaches.”
“As the Chairman of the Special Senate Committee on Cybersecurity Readiness I am keenly aware of the need for stronger consumer protection measures against data breaches and identity theft like those passed in this legislation,” said Senator Moore. “The changes to notification requirements and reducing costs were critical components of the bill.”
House Bill 4806 also eliminates the $5 fee consumers must currently pay to each of the three major credit reporting agencies – Equifax, Experian, and TransUnion – every time they want to freeze their credit report or lift the freeze. The bill is a direct response to a 2017 data breach at Equifax, which resulted in hackers gaining access to the Social Security numbers, birthdates, driver’s license numbers, and tax identification numbers of 145 million Americans, including at least 3 million Massachusetts residents.
The bill is now on Governor Charlie Baker’s desk for his review. He has until August 4 to sign it into law.