Bill > S301

This bill establishes the Massachusetts Information Privacy and Security Act (MIPSA), a comprehensive data privacy law that provides Massachusetts residents with significant control over their personal information. The bill requires businesses (called "controllers") that meet certain thresholds to provide clear privacy notices, obtain consent for processing sensitive information, and allow individuals to access, delete, correct, and opt out of the sale of their personal data. Key provisions include requiring businesses to conduct risk assessments before processing personal information, prohibiting discriminatory data processing, and establishing a registration requirement for data brokers. The law applies to companies that conduct business in Massachusetts, process personal information of Massachusetts residents, or voluntarily certify compliance, with specific applicability thresholds based on annual revenue, number of individuals' data processed, or data broker status. Enforcement is primarily through the Attorney General, who can issue civil investigative demands and seek penalties up to $7,500 per violation, with a 30-day cure period for most violations. The bill also creates a limited private right of action for data breaches resulting from inadequate cybersecurity controls. Notably, the law will take effect 18 months after passage, with some provisions taking effect immediately, giving businesses time to adapt to the new requirements.

Business and Industry

https://malegislature.gov/Bills/194/S301