Bill > H5479

This bill establishes the Massachusetts Consumer Data Privacy Act, creating new rights for consumers regarding their personal data and imposing obligations on businesses that collect and process this data. Key provisions include granting consumers the right to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of targeted advertising, the sale of their personal data, and profiling for automated decisions that have significant legal or similar effects. The bill defines terms like "personal data," "sensitive data" (which includes health, genetic, and biometric information), and "dark patterns" (deceptive user interface designs). It outlines specific requirements for businesses, such as limiting data collection to what is necessary, obtaining affirmative consent for processing sensitive data, implementing data security practices, and providing clear privacy notices. The act also includes exemptions for certain entities like government agencies, financial institutions, and healthcare providers covered by HIPAA, and sets a deadline for the Attorney General to promulgate regulations and for businesses to comply with certain provisions. Additionally, the bill mandates a study on regulating data brokers in the Commonwealth.