Bill > S2608

This bill establishes the Massachusetts Data Privacy Act, a comprehensive law that provides consumers with significant rights regarding their personal data and imposes strict obligations on companies (controllers and processors) that collect and process such data. The bill applies to organizations that collect data from at least 60,000 consumers or derive 20% of their revenue from selling personal data, with notable exemptions for certain government entities, financial institutions, and healthcare organizations. Consumers are granted specific rights, including the ability to confirm what personal data is being collected, access and correct their data, delete their data, obtain a copy of their data in a portable format, and opt out of targeted advertising, data sales, and certain automated profiling. The law requires controllers to limit data collection, obtain affirmative consent for sensitive data processing, implement robust data security practices, and provide clear, understandable privacy notices. Companies must establish secure mechanisms for consumers to exercise their rights and are prohibited from discriminating against consumers who do so. The Attorney General is granted exclusive enforcement authority, with the ability to issue violations, impose civil penalties up to $5,000 per violation, and seek damages and restitution. The law is set to take effect on January 1, 2027, representing a significant step towards enhanced data privacy protections for Massachusetts residents.

Senate Committee on Ways and Means (S)

https://malegislature.gov/Bills/194/S2608