Ok! This sounds to me like a great idea. I don't see why anyone here would oppose this or be upset by this requirement. No one should be storing anyone's "personal data" unencrypted in the first place. Roger Williams [2/27/2009 10:50 AM] wrote: > >>>>> Scott Reed <sreed at avacoda.com> writes: > > > What is the definition of "personal data"? > > 201 CMR 17.00 defines it as: > > a Massachusetts resident's first name and last name or first initial and > last name in combination with any one or more of the following data elements > that relate to such resident: (a) Social Security number; (b) driver's > license number or state-issued identification card number; or (c) financial > account number, or credit or debit card number, with or without any required > security code, access code, personal identification number or password, that > would permit access to a resident's financial account; provided, however, > that "Personal information" shall not include information that is lawfully > obtained from publicly available information, or from federal, state or > local government records lawfully made available to the general public. > >