Eric Ogren is spot on regarding prescriptive data breach legislation going into effect for Massachusetts and Nevada.
Mass., Nev. data protection laws wrong, ineffective
To quote:
These state regulations represent exactly the wrong kind of laws to be passing, but legislators compelled to take on identity theft seem intent on establishing legal requirements for technical solutions.
While Nevada Revised Statutes Title 597, Section 970 (NRS 597.970) calls for personal information to be encrypted when transferred over public networks, Massachusetts 201 CMR 17 Standards for The Protection of Personal Information of Residents of the Commonwealth is even more encompassing. When MA 201 CMR 17 goes into effect in January of 2010, all non-government entities that handle personal information must document and follow a set of security procedures that appears to have been heavily inspired by the PCI DSS.
The security industry can't agree if servers, networks or laptops are the most vulnerable to attack. It is hard to imagine any government regulation dictating how to secure data being enforceable and effective. Government should be looking towards legislating behavior, perhaps extending existing frameworks for fraud, trespassing and trafficking across state and national borders...
Small and midsized organizations have the greatest problems complying with prescriptive "how to" regulations as investments in a complex technical infrastructure can drive the overhead costs per business transaction through the roof. They simply seldom have the skills necessary to fulfill the requirements of the statutes.
I agree. In short, bad regulation begets bad regulation. Worse, legislators appear to be enamored with prescriptive mandates as the path of least resistance; that is, it is tempting just to tell everyone what to do regarding data protection and then audit against the rule.
Prescriptive regulation may indeed be the path of least resistance - the allure is compelling, no doubt - but it is also historically the path of least effectiveness and the progenitor of unintended consequences, unacceptable cost, and perverse incentives.
Massachusetts and Nevada legislators should know better. It is a shame they do not.
Comments