Massachusetts House Committee Releases Strong Privacy Bill

The House members of the Massachusetts Legislature’s Joint Committee on Advanced IT, Cybersecurity, and the Internet have given a favorable report to a redrafted version of the Massachusetts Consumer Data Privacy Act (“MCDPA”). If enacted, MCDPA would be the strongest state privacy law in the nation.

The MCDPA (H. 4746) builds on a bill unanimously passed by the Senate in September. Both bills include strong data minimization rules that set meaningful limits on the personal data that companies can collect and the sensitive data they can use, offer enhanced protections for minors’ personal data, ban the sale of precise geolocation data, and have strong civil rights language to prohibit digital discrimination. The House bill also includes:

• A private right of action under Massachusetts’ Consumer Protection law (chapter 93A) for large data holders, offering a critical enforcement option against the most powerful companies who collect large volumes of personal data;
• A requirement that the processing of non-sensitive personal data be consistent with the consumers’ reasonable expectations;
• A stronger definition of “affirmative consent” and narrows the exemption for publicly available information;
• The addition of union membership and veteran status to the definition of “sensitive data”;
• A strong data security rule that requires companies to delete personal data when it is no longer necessary for the purpose for which it was collected; and
• A requirement that browsers offer a global opt-out signal to consumers, mirroring a protection just enacted in California;

“EPIC commends Speaker Ron Mariano, Chair Tricia Farley-Bouvier, and the members of the Advanced IT Committee for advancing a bill that, if enacted, would provide Massachusetts residents with the privacy protections they need to stay safe online,” said EPIC Deputy Director Caitriona Fitzgerald. “We urge the House to quickly take up the Massachusetts Consumer Data Privacy Act to put a stop to the data abuse that is harming individuals’ wallets, rights, and opportunities.”