An Act relative to the security of personal financial information

HD 3351 requires businesses and government agencies handling Massachusetts residents' personal financial information to implement comprehensive security programs. It defines "personal information" to include Social Security numbers, financial account numbers, and driver's license details, and mandates safeguards to prevent unauthorized access or breaches. Covered entities must conduct risk assessments, design security measures, and oversee third-party service providers. The bill also specifies requirements for notifying residents after a breach, including options for electronic or substituted notice when costs or scale make traditional notification impractical. This applies directly to financial institutions, state agencies, and any organization processing sensitive data of Massachusetts residents.