House Passes Landmark Data Privacy Legislation with Strong Consumer Protections

The Massachusetts House of Representatives today passed comprehensive legislation establishing essential consumer data privacy rights for residents of the Commonwealth. The Massachusetts Consumer Data Privacy Act provides consumers with greater control over their own data. The bill increases accountability for companies and grants user data privacy protections to residents of and those present in Massachusetts. Highlights include strong privacy protections for minors and a blanket ban on the sale of precise geolocation data.

"This legislation is about ensuring that the Commonwealth's laws keep pace with the challenges of an increasingly data-driven world, where technology is embedded in nearly every aspect of daily life. Consumers deserve meaningful protections for their personal information and greater control over how that information is collected, used, and sold,” said House Speaker Ronald J. Mariano (D-Quincy). “This bill establishes common-sense safeguards for sensitive data, strengthens transparency, and promotes accountability for entities that profit from personal information – striking an important balance between encouraging innovation and protecting the privacy rights of Massachusetts residents. I want to thank Leader Moran, Chair Farley-Bouvier, and all my colleagues in the House for recognizing the importance of these critical reforms, and for voting to advance them."

“This bill is first and foremost a consumer protection bill,” said Representative Michael Moran (D-Brighton), Majority Leader. “This bill is an important step forward to ensure data privacy and gives consumers control of how their personal information is collected and used by companies and the right to access, correct, and delete their data.”

“The Massachusetts Consumer Data Privacy Act centers the consumer and is a must for the 21st century. Through the technology that we have come to rely on daily, companies collect and legally sell our data, including sensitive data, without our knowledge or consent,” said Representative Tricia Farley-Bouvier (D-Pittsfield), House Chair of the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity.  “The Massachusetts Consumer Data Privacy Act is a critical step to hold companies accountable, protect minors, and establish strong consumer protections. It is the result of public hearings and thoughtful deliberation with privacy experts, advocates, and industry representatives.”

Limit Collection to What is Reasonably Necessary

The bill requires that personal data collection must be proportionate to providing requested services, and data must be protected and deleted when no longer necessary or required by law.

Data Subject Rights

Under the bill, data subject rights extend to all residents in Massachusetts. These rights include the right to access their personal information, the right to correct inaccurate information, the right to opt out of certain processes such as targeted advertising, the right to transport personal data, and the right to delete certain information.

Protections for Sensitive Data

The bill specifies that sensitive data, as defined below, cannot be sold or shared without a user’s affirmative consent. Companies cannot sell sensitive data without additional unambiguous, affirmative consent from a consumer.

Sensitive data includes information such as biometric or genetic information, precise geolocation data, health and wellness information, reproductive and sexual health data, data of a minor under 18, government-issued identifiers, and data that reveals an individual’s racial or ethnic origin, national origin or citizenship or immigration status, religious beliefs, sex life, sexual orientation, status as transgender or non-binary, union membership, status as a military service member or veteran, and status as a victim of a crime.

Protection for Children and Minors under 18

The bill provides special protections for individuals under 18, including a prohibition on targeted advertising to minors.

Ban on the Sale of Precise Geolocation Data

The bill includes a ban on the sale of precise geolocation data. Restricting the trade of location data helps protect people from surveillance, stalking, and the misuse of sensitive personal information. This protection is extended to both residents of Massachusetts and visitors, which is especially important now to protect people who travel to and within Massachusetts, including for reproductive and gender affirming health care.

Enforcement

The bill grants the Attorney General rulemaking authority and includes a private right of action. A private right of action allows consumers to hold the largest data holders accountable for any violations they may make. Rulemaking authority will allow the Attorney General to keep up with the pace of technological change and provide greater clarity in areas where it is needed.

The bill passed the House of Representatives 146-0 and now goes back to the Senate for further consideration.

###