Bill > H78

This bill establishes the Massachusetts Consumer Data Privacy Act, a comprehensive privacy law that provides significant protections for consumers' personal data. The bill defines numerous terms and creates a framework for how businesses (controllers) must handle personal data, giving consumers specific rights such as confirming what data is being collected, accessing their personal data, correcting inaccuracies, deleting data, and opting out of targeted advertising and data transfers. Controllers must obtain affirmative consent for processing sensitive data, which includes information about racial origin, health conditions, genetic data, precise location, and data about minors. The law applies to businesses that collect data from at least 25,000 consumers or derive revenue from selling personal data. Businesses must provide clear privacy notices, establish secure methods for consumers to exercise their rights, and conduct data protection assessments for high-risk processing activities. The Attorney General has enforcement powers, including the ability to bring civil actions with potential penalties of at least $15,000 per violation, and consumers can also sue for damages (except against small businesses). The bill includes numerous exemptions for specific types of data and processing, such as compliance with other laws, protecting against fraud, and conducting scientific research. Notably, the law prohibits discriminatory data processing and targeted advertising to minors, and takes effect 180 days after enactment.

Business and Industry

https://malegislature.gov/Bills/194/H78