Bill > S45

This bill establishes the Massachusetts Data Privacy Act, creating comprehensive data privacy protections for residents by introducing two new chapters to the state's General Laws. The first chapter (Chapter 93M) establishes broad data privacy requirements for covered entities, defining key terms and outlining specific obligations for businesses handling personal data. Key provisions include requiring clear consent for data collection, giving individuals rights to access, correct, and delete their personal data, and prohibiting deceptive data practices. The bill defines "covered data" as information that can identify an individual, with special protections for sensitive data like biometric information, location data, and data related to minors. The second chapter (Chapter 93N) focuses specifically on location information, creating strict rules for how businesses can collect, process, and disclose an individual's location data. Businesses must obtain explicit consent before collecting location information, can only use it for specific "permissible purposes," and are prohibited from selling or misusing such data. The bill requires businesses to maintain transparent location privacy policies and gives individuals the right to opt out of location data collection and targeted advertising. The legislation provides robust enforcement mechanisms, including a private right of action for individuals and the ability for the Attorney General to bring civil actions. Violations can result in significant financial penalties, with potential fines up to 4% of a company's annual global revenue or $20 million. The bill will take effect one year after its enactment, giving businesses time to adapt to the new requirements. Overall, the bill aims to give Massachusetts residents greater control over their personal data and protect their privacy in an increasingly digital world.

Business and Industry

https://malegislature.gov/Bills/194/S45