Bill > H4807

This bill updates Massachusetts law regarding the security of personal information by expanding and clarifying several key definitions and requirements. The bill introduces new definitions for terms like "access device" (a card or device storing personal information), "biometric indicator" (unique biological attributes used for identification), "information security program" (safeguards for handling personal information), "neural data" (information measuring nervous system activity), and "precise location information" (highly accurate geographic data). It broadens the definition of "personal information" to include more types of sensitive data such as medical information, neural data, biometric indicators, and precise location information. The bill requires the Department of Consumer Affairs and Business Regulation to adopt regulations that safeguard residents' personal information, taking into account the size and resources of businesses. It also modifies notification requirements for data breaches, specifying that notices to residents must include information about obtaining police reports, the timeframe of exposure, how to request a security freeze, and available mitigation services. Additionally, the bill provides an exemption from notification requirements for inadvertent disclosures that are unlikely to cause harm, with a requirement to document such determinations in writing and potentially report them to the Attorney General if over 500 residents are affected.

Budget and Finance

Joint Committee on Consumer Protection and Professional Licensure (Joint)

https://malegislature.gov/Bills/194/H4807