Bill > H4514

This bill establishes the Massachusetts Information Privacy and Security Act, which sets forth various requirements and protections related to the processing of personal information. Key provisions include: - Defining terms like "personal information," "sensitive information," "controller," "processor," and "data broker." - Establishing general principles for processing personal information, such as requirements for lawfulness, transparency, data minimization, accuracy, and security. - Granting individuals rights to know, access, delete, and correct their personal information, as well as opt out of the sale of their personal information and limit the use of their sensitive information. - Prohibiting discrimination against individuals who exercise their privacy rights in good faith. - Imposing obligations on controllers and processors, including conducting risk assessments for certain types of processing. - Requiring data brokers to register with the Attorney General. - Authorizing the Attorney General to enforce the law, including through civil investigations and penalties. - Creating the Massachusetts Privacy Fund to support the Attorney General's enforcement efforts. The bill also establishes a private right of action for individuals whose personal information is subject to a breach of security due to a controller's failure to implement reasonable cybersecurity controls.

Health and Social Services

Advanced Information Technology, the Internet and Cybersecurity (J)

https://malegislature.gov/Bills/192/H4514