Bill > S227

This bill establishes the Massachusetts Information Privacy and Security Act, which aims to protect individual privacy by regulating how personal information is collected, used, and shared by businesses and other entities. The key provisions of the bill include: - Defining various terms related to personal information, such as "biometric information," "sensitive information," and "data broker." - Outlining lawful bases for processing personal information, including requiring consent for certain sensitive information. - Giving individuals rights to access, correct, delete, and opt-out of the sale or use of their personal information for targeted advertising. - Requiring businesses to conduct risk assessments and implement reasonable security measures to protect personal information. - Prohibiting discrimination against individuals who exercise their privacy rights. - Empowering the Attorney General to enforce the law, investigate violations, and impose penalties. - Creating a private right of action for individuals whose personal information is subject to a data breach due to a company's failure to maintain reasonable cybersecurity controls. The bill will take effect 18 months after passage, with some provisions taking effect immediately or 30 months after passage.