Legal Requirements: Acme Data Breach Notification in MA & RI

This assignment addresses the legal requirements for Acme Bath & Plumbing following a data breach impacting Massachusetts and Rhode Island residents. It examines the specific notification obligations under Massachusetts and Rhode Island law, including timelines, content requirements, and notifications to relevant authorities. The analysis covers the requirements for notifying impacted consumers, the content of the notices, and whether different language is required for each state. The document also outlines the legal steps Acme must take, including notifying the attorney general and credit reporting agencies when a breach affects a certain number of residents. The assignment emphasizes the importance of clear and personalized communication with clients to mitigate the impact of the breach and maintain a sense of responsibility.

Running Head: MIS
MIS
Name
Institution

MIS 2
1. What does Massachusetts law require Acme to do with respect to notifying its
impacted resident consumers regarding the December-January security incident?
According to the Massachusetts’ law, any breach of personal information that affects the
residents of the commonwealth and is managed or stored by any (legal) person must be reported,
by way of notice, to the residents of the commonwealth within a practical time and without
unreasonable delay. ("General Law - Part I, Title XV, Chapter 93H, Section 3", 2019).
Furthermore, the content of the notice must include the approximate date and time of the breach,
the information accessed and any steps taken in relation to the breach. ("General Law - Part I,
Title XV, Chapter 93H, Section 3", 2019).
2. Does Massachusetts law require Acme to make any other notifications (other than to
the impacted MA residents)?
The legislation continues to provide that should such a breach be detected, the company must
notify the attorney general and the director of consumer affair and business regulations.
("General Law - Part I, Title XV, Chapter 93H, Section 3", 2019) The content of the same must
include; the nature of the breach, the number of residents affect as of the time of notification and
the steps taken to remedy the breach and its affects thereof. ("General Law - Part I, Title XV,
Chapter 93H, Section 3", 2019) (Journal, 2019)
3. What does Rhode Island law require Acme to do with respect to notifying its
impacted resident consumers regarding the December-January security incident?
The Acme Company is compelled by law to notify any and all persons whose personal
information has been unlawfully accessed. According to the Identity Theft Protection Act of

MIS 3
2015, the company is required to make notification within 45 days without delay. ("11-49.3-4",
2019) The notification must detail the manner in which the breach occurred, the date or dates the
breach occurred, the information gathered, the number of people affected, the date the breach
was discovered and any steps taken to remedy the situation including any services the company
offers to help the affected people. ("11-49.3-4", 2019) (Journal, 2019)
4. Does Rhode Island law require Acme to provide any other notifications (other than to
the impacted RI residents)?
The Identity Theft Protection Act of 2015 continues to provide that should the breach have
affected more than 500 residents of Rhode Island, and then the company is compelled to notify
the attorney general and the major credit reporting agencies about the content, number of
individuals affected and the timing of the incident without delay to the people affected. ("11-
49.3-4", 2019)
5. Please provide the specific language you recommend that Acme use in its notice to the
Massachusetts consumers to describe the incident itself and whether Acme should revise
that language in any way for its notice to the Rhode Island consumers.
With regard to the format and language that a notice should take, the company should use
formal language in the form of a personalized letter bearing the name of the affected client at top
of the letter. As opposed to a standard letter generally addressed to the clients/customers, a
formal personalized letter bearing apologetic language will be better received. A data breach can
and does often make the clients/customers feel vulnerable and violated. Formatting the notice in
a personalized fashion creates and maintains a sense of responsibility and bond with the client.

MIS 4
The same language and format should be used on the letters sent to the residents of Rhode Island.
This personalized format shall inculcate in the clients/customers in Rhode Island that they are of
value. The language in both letters must be clear and simple enough for the client to understand.

MIS 5
References
11-49.3-4. (2019). Retrieved from http://webserver.rilin.state.ri.us/Statutes/TITLE11/11-
49.3/11-49.3-4.HTM
General Law - Part I, Title XV, Chapter 93H, Section 3. (2019). Retrieved from
https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3
Journal, H. (2019). New Massachusetts Data Breach Notification Law Enacted. Retrieved
from https://www.hipaajournal.com/new-massachusetts-data-breach-notification-law-enacted/