Bill > H93

This bill updates Massachusetts' data protection law by expanding and clarifying definitions related to personal information and security breaches. The bill introduces new definitions for sensitive types of data, including biometric information (such as retina scans, fingerprints, and facial geometry), genetic information, health insurance information, and medical information. It broadens the definition of "personal information" to include specific identifiers like geolocation data, biometric details, and online account credentials. The bill modifies the definition of a "security breach" to include unauthorized acquisition of unencrypted or improperly encrypted electronic data that compromises the security or confidentiality of personal information. It also adds requirements for breach notifications, including specifying the date of the breach, types of compromised information, contact details, and providing information about security freezes and mitigation services. The bill mandates that organizations notify both the Attorney General and the Federal Bureau of Investigation in case of a data breach, and requires detailed consumer notifications with specific information about the breach and steps to protect personal information. Importantly, the bill aims to provide more comprehensive protection for individuals' sensitive data by creating more precise and inclusive definitions of what constitutes personal information and a security breach.

Budget and Finance, Business and Industry

https://malegislature.gov/Bills/194/H93