Bill > S2516

This bill establishes the Massachusetts Data Privacy Protection Act and the Location Shield Act, creating comprehensive regulations for how businesses collect, process, and use personal and location data. The Massachusetts Data Privacy Act applies to businesses that collect personal data from at least 25,000 consumers or derive revenue from selling personal data, and provides consumers with several key rights, including the ability to confirm what personal data is being collected, access their data, correct inaccuracies, delete personal data, obtain a copy of their data, and opt out of targeted advertising, data transfers, and certain types of profiling. The bill requires businesses to obtain explicit consent for collecting sensitive data, implement data security practices, and provide clear privacy notices. It also establishes specific protections for minors, health data, and reproductive health information. The Location Shield Act complements this by creating strict regulations around the collection and use of location information, requiring businesses to obtain consent, limit data collection, and protect individuals' location privacy. The bill allows for enforcement by the Attorney General and provides for potential civil penalties and consumer lawsuits, with damages of at least $15,000 per violation. Businesses will need to implement robust data protection practices, with larger data holders facing more stringent requirements. The act will take effect in stages, with most provisions becoming active one year after enactment.

Budget and Finance

Advanced Information Technology, the Internet and Cybersecurity (J)

https://malegislature.gov/Bills/194/S2516