EdLaw
Massachusetts — security breaches (G.L. c. 93H)
Chapter 93H of the Massachusetts General Laws governs the security of residents' personal information: it directs the Office of Consumer Affairs and Business Regulation to adopt safeguarding regulations (§2), requires notice of a breach of security or unauthorized acquisition or use of personal information (§3), requires credit monitoring when Social Security numbers are involved (§3A), and is enforced by the Attorney General (§6). It binds any "person" or "agency", so it reaches a school vendor and a school district alike. The chapter was inserted by section 16 of St. 2007, c. 82, approved by the Governor on 2 August 2007; the act has no emergency preamble and sets a date only for section 17 (chapter 93I, 3 February 2008), so §§1–6 took effect ninety days after approval under Mass. Const. amend. art. 48, The Referendum, I — on 31 October 2007 (§3A was added later).
Applicability to EdTech
- A vendor that stores a school's data must notify the school. "A person or agency that maintains or stores, but does not own or license data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay ... to the owner or licensor", and must cooperate with the owner, including by informing it of the date and nature of the incident and the steps taken (§3(a)).
- Who is bound. "Person" is "a natural person, corporation, association, partnership or other legal entity" (§1(a)); "Agency" includes any political subdivision of the commonwealth (§1(a)), which covers school districts.
- Narrow definition of personal information. Name combined with a Social Security number, driver's licence or state ID number, or a financial account or card number (§1(a)). Biometric data and student records are not on the list, so a breach of class recordings or student data alone does not trigger the chapter; FERPA and contract terms govern those.
- Safeguarding regulations. §2(a) directs regulations "relative to any person that owns or licenses personal information about a resident" designed to "insure the security and confidentiality of customer information in a manner fully consistent with industry standards" (§2(a)). Those regulations (201 CMR 17.00) are not extracted here.
Contents
| Document | Covers |
|---|---|
| SECURITY-BREACH.md | G.L. c. 93H, §§1, 2, 3, 3A, 4, 5 and 6, the whole chapter, in full |
Key obligations at a glance
- Maintaining or storing another's data: notify the owner or licensor as soon as practicable and cooperate with it — §3(a).
- Owning or licensing data: notify the Attorney General, the Office of Consumer Affairs and Business Regulation and affected residents — §3(b).
- Breach involving Social Security numbers: contract with a third party to offer credit monitoring — §3A.
Enforcement
"The attorney general may bring an action pursuant to section 4 of chapter 93A against a person or otherwise to remedy violations of this chapter and for other relief that may be appropriate" (§6).
Licence
The corpus reproduces G.L. c. 93H verbatim from the General Court of Massachusetts' General Laws pages.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."
The General Laws pages end with the footer "Copyright © 2026 The General Court of the Commonwealth of Massachusetts". That notice can cover the site's own design and content, but not the statutes the General Court enacts, which the doctrine places outside copyright; the section catchlines are the General Court's own, made in the course of its legislative duties.
Conditions: none attach to the statute text. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Massachusetts — student records (G.L. c. 71, §34D and 603 CMR 23.00) — the student-records layer that governs third-party access to school records
- Iowa — personal information security breach protection (Iowa Code ch. 715C) — a comparable breach statute with a similar on-behalf-of notification duty
- Missouri — data breach notification (RSMo 162.1475 and 407.1500) — likewise
Sources
- General Court of Massachusetts — G.L. c. 93H
- General Court of Massachusetts — Acts of 2007, chapter 82 — "Approved by the Governor, August 2, 2007"; SECTION 16 inserts chapter 93H; "SECTION 19. Section 17 shall take effect on February 3, 2008."; no emergency preamble (read through the Internet Archive capture of 13 October 2010)
- General Court of Massachusetts — Constitution of the Commonwealth — art. 48, The Referendum, I: "No law passed by the general court shall take effect earlier than ninety days after it has become a law, excepting laws declared to be emergency laws and laws which may not be made the subject of a referendum petition" (read through the Internet Archive capture of 1 October 2026)