Vote Smart's Synopsis:

Vote to pass a bill that establishes the Massachusetts Data Privacy Act.

Highlights:

• Establishes a consumer’s right to (Sec. 4): 

• Confirm whether a controller is collecting or processing a consumer’s personal data;

• Obtain from a controller a list of third parties to which the controller has transferred the consumer’s personal data; 

• Correct inaccuracies in the consumer’s personal data;

• Delete personal data provided by or obtained about the consumer;

• Obtain a copy of the consumer’s personal data collected or processed by the controller in a portable and readily usable format that allows the consumer to transfer the data to another controller without hindrance; and

• Opt out of the collection and processing of the consumer’s personal data for targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. 

• Requires the controller to respond to the consumer without undue delay and not more than 45 days after the receipt of the request (Sec. 4). 

• Specifies that if a controller declines to take action regarding the consumer’s request, the controller must inform the consumer without undue delay and not more than 45 days after the receipt of the request, with a justification as to why the controller is declining to take action (Sec. 4). 

• Requires the controller to establish a process for a consumer to appeal the controller’s refusal to take action on a request (Sec. 4). 

• Prohibits a controller from conditioning, effectively conditioning, attempting to condition, or attempting to effectively condition the exercise of rights described in Section 4 through the use of any false, fraudulent, or misleading statements or representations or through the use of dark patterns or deceptive designs (Sec. 4). 

• Prohibits the controller from collecting, processing, or transferring personal data in a manner that discriminates against or threatens to discriminate against any individual or class of individuals (Sec. 4). 

• Requires the controller to (Sec. 5): 

• Limit the collection of personal data to what is reasonably necessary to provide or maintain a specific product or service requested by the consumer; 

• Not process personal data for a purpose that is neither reasonably necessary to, nor compatible with, the disclosed purpose for which the personal data is collected;

• Not collect, process, or transfer sensitive data concerning the consumer except when such collection, processing, or transfer is strictly necessary to provide or maintain a specific product or service; 

• Not sell sensitive data;

• Not transfer sensitive data concerning the consumer without the consumer’s consent; 

• Not collect or process the personal data of the consumer for targeted advertising;

• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and access to personal data;

• Provide an effective mechanism for a consumer to revoke their affirmative consent that is at least as easy to use as the mechanism provided for the consumer to give affirmative consent; 

• Not to discriminate or retaliate against any consumer exercising their rights under Section 4; and

• Not sell the precise geolocation data of any consumer within the Commonwealth of Massachusetts. 

• Requires the controller to provide consumers with a reasonably accessible, understandable, clear, meaningful, and not misleading privacy notice that indicates what personal data will be collected, for what purpose it will be collected, how consumers may exercise their rights, and the identity of the controller (Sec. 5). 

• Requires the controller to allow the consumer to opt out of any collection or processing of the consumer’s personal data for targeted advertising (Sec. 5). 

• Prohibits a controller from conducting processing that presents a heightened risk of harm to the consumer without conducting a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to the consumer (Sec. 7). 

Full Bill Text