• Up to $50,000 per improper disposal
• Maximum of $5,000 per violation
• The Massachusetts Attorney General can come after you
• Above penatlies don't include lost business, dealing with irate customers, mailing out letters, and other associated costs

What are the financial ramifications of violating Massachusetts 201 CMR 17.00?  You may be familiar with some of the aspects of this law, dubbed the "Massachusetts Encryption Law" by many (although, it goes far beyond the encryption of computers via the use of laptop encryption software such as AlertBoot endpoint security systems).  Supposedly, the new law has more "teeth" than other state laws regarding personal information privacy because it allows for monetary fines.

So, the natural question is how much?  Nobody knows yet because it has to be tested, although the law gives us a clear idea of the potential damages.

201 CMR 17.00 - Penalties and Fines

I've noticed in my research that the figures of $50,000 and $5,000 per violation are bandied about quite a bit.  I've attempted to track down where these figures come from.  Looks like I'll need an actual lawyer to figure out what's what, but here are my findings to the best of my knowledge:

• Mass. General Law 93I
  
• $100 per person affected with a maximum cap of $50,000 for each instance of improper data disposal.
• There is no definition of what an "instance" is, though.  If you send two unencrypted computers with sensitive information to the curb at the same time, is that one instance of disposal or two?
  
• Mass. General Law 93H
  
• Maximum $5,000 per violation, although it is not yet known what "per violation" means, exactly.  It could be based on, at least:
• Per case, per person, or per file.
• So, if an unencrypted computer is lost, and it contains two files with 50,000 personal data each, the maximum penalty could be $5,000 (violation itself), $10,000 (two files), or $250,000,000 (enough to bankrupt any company).  This clearly ties to the criticism that the laws are not as clear as they could be.
  
• Mass. General Law 93A
  
• Failure to comply with either 93H or 93I (or both) will allow the Massachusetts AG to file suit with the company.
• Courts can order treble the damages if it's concluded that there was a willful or knowing violation. (Whatever that means, it doesn't sound good.  Treble of what damages, exactly?)
• Massachusetts residents may possibly file suit as well, leading to fines of actual damages or $25, whichever is greater.

All of the above is in addition to the other costs of a data breach: mailing letters alerting of the breach, lost revenue, setting up call centers, etc.  Sounds like signing up for encryption services like AlertBoot might be a smart move.