Rep. Jack Lewis Votes to Safeguard Data Protections for Consumers

(Framingham) Representative Jack Patrick Lewis voted in favor of comprehensive legislation establishing essential consumer data privacy rights for residents of the Commonwealth. The Massachusetts Consumer Data Privacy Act provides consumers with greater control over their own data. The bill increases accountability for companies and grants user data privacy protections to residents of and those present in Massachusetts.

“We are living in a moment of extraordinary information-sharing. Our current laws were not created for inventions such as mass social media and artificial intelligence,” expressed Rep. Lewis (Framingham). “This bill would bring our law into the modern age by establishing commonsense consumer safeguards. For example, the bill requires explicit, affirmative consent before companies may sell or share sensitive information, bans the sale of precise geolocation data, and creates special protections for minors.”

Subscribe

"This legislation is about ensuring that the Commonwealth's laws keep pace with the challenges of an increasingly data-driven world, where technology is embedded in nearly every aspect of daily life. Consumers deserve meaningful protections for their personal information and greater control over how that information is collected, used, and sold,” noted House Speaker Ronald J. Mariano (Quincy). “This bill establishes common-sense safeguards for sensitive data, strengthens transparency, and promotes accountability for entities that profit from personal information – striking an important balance between encouraging innovation and protecting the privacy rights of Massachusetts residents. I want to thank Leader Moran, Chair Farley-Bouvier, and all my colleagues in the House for recognizing the importance of these critical reforms, and for voting to advance them."

Limit Collection to What is Reasonably Necessary

The bill requires that personal data collection must be proportionate to providing requested services, and data must be protected and deleted when no longer necessary or required by law.

Data Subject Rights

Under the bill, data subject rights extend to all residents in Massachusetts. These rights include the right to access their personal information, the right to correct inaccurate information, the right to opt out of certain processes such as targeted advertising, the right to transport personal data, and the right to delete certain information.

Protections for Sensitive Data

The bill specifies that sensitive data, as defined below, cannot be sold or shared without a user’s affirmative consent. Companies cannot sell sensitive data without additional unambiguous, affirmative consent from a consumer.

Sensitive data includes information such as biometric or genetic information, precise geolocation data, health and wellness information, reproductive and sexual health data, data of a minor under 18, government-issued identifiers, and data that reveals an individual’s racial or ethnic origin, national origin or citizenship or immigration status, religious beliefs, sex life, sexual orientation, status as transgender or non-binary, union membership, status as a military service member or veteran, and status as a victim of a crime.

Protection for Children and Minors under 18

The bill provides special protections for individuals under 18, including a prohibition on targeted advertising to minors.

Ban on the Sale of Precise Geolocation Data

The bill includes a ban on the sale of precise geolocation data. Restricting the trade of location data helps protect people from surveillance, stalking, and the misuse of sensitive personal information. This protection is extended to both residents of Massachusetts and visitors, which is especially important now to protect people who travel to and within Massachusetts, including for reproductive and gender affirming health care.

Enforcement

The bill grants the Attorney General rulemaking authority and includes a private right of action. A private right of action allows consumers to hold the largest data holders accountable for any violations they may make. Rulemaking authority will allow the Attorney General to keep up with the pace of technological change and provide greater clarity in areas where it is needed.

The bill passed the House of Representatives 146-0 and now goes back to the Senate for further consideration.