Bill > S2770

This bill establishes the Massachusetts Data Privacy Protection Act. It sets requirements for how covered entities (businesses that collect, process, or transfer personal data) must handle covered data (information that identifies or is linked to an individual). The key provisions include: - Duty of Loyalty: Covered entities may only collect, process, or transfer covered data for specific, enumerated purposes, and cannot engage in deceptive advertising or marketing. - Sensitive Data Restrictions: Covered entities are prohibited from collecting, processing, or transferring sensitive data (e.g. Social Security numbers, genetic information) without consent, with limited exceptions. - Individual Rights: The bill gives individuals the right to access, correct, delete, and export their covered data, and to opt out of targeted advertising and profiling. - Service Providers: The bill regulates the relationship between covered entities and service providers that process data on their behalf. - Enforcement: The bill establishes a private right of action and allows the Attorney General to bring civil enforcement actions, with penalties up to 4% of global revenue. The bill aims to protect individual privacy and provide transparency and control over the collection and use of personal data.

Budget and Finance

Advanced Information Technology, the Internet and Cybersecurity (Joint)

https://malegislature.gov/Bills/193/S2770