Consumer

In keeping with Governor Patrick's commitment to balancing consumer protection with the needs of small business owners, the Office of Consumer Affairs and Business Regulation announced on Aug. 17 adjustments to Massachusetts' identity theft regulations that maintain protections and also reinforce flexibility in compliance by small businesses.

The updated regulations, which took effect March 1, 2010, make clear that their approach to data security is a risk-based approach that is especially important to small businesses that may not handle a lot of personal information about customers. Under a risk-based approach, a business, in developing a written security program, should take into account its size, nature of its business, the kinds of records it maintains, and the risk of identity theft posed by its operations.