such as a payment card number, financial account number, Social Security number, or any other government-issued identifier. Massachusetts is particularly noteworthy in its explicit requirement for effective service provider management. Before a company can provide its personal information to a service provider, the Massachusetts Data Security Regulation affirmatively requires that the company