Bill > H5472

This bill, titled the "Massachusetts Consumer Data Privacy Act," establishes new regulations for how businesses, referred to as "controllers," collect, process, and sell personal data of Massachusetts residents, who are defined as "consumers." Key provisions include granting consumers rights such as confirming data collection, accessing and deleting their personal data, correcting inaccuracies, and opting out of targeted advertising, the sale of their data, or profiling for automated decisions that have significant legal or similar effects. The bill defines important terms like "personal data," "sensitive data" (which includes health, genetic, and biometric information), "affirmative consent" (requiring a clear, deliberate action from the consumer), and "dark patterns" (deceptive user interface designs). It sets thresholds for which businesses are subject to these rules, generally based on the volume of data processed or revenue from data sales. The bill also outlines specific requirements for data security, privacy notices, and how consumers can exercise their rights, including through authorized agents and opt-out preference signals. It exempts certain entities and types of data, such as protected health information under HIPAA and data collected for research or in employment contexts. Violations are considered unfair or deceptive trade practices, with the Attorney General having enforcement authority, including imposing civil penalties. The bill also includes provisions for data protection assessments for processing activities that pose a heightened risk of harm to consumers, with a delayed enforcement date for these assessments.