BOSTON — Sen. John Cronin, who represents Westford, joined the Massachusetts Senate to unanimously vote in favor of Bill S.2608 on Thursday, which he described as “what would be the nation’s most robust data privacy law.”
The bill was approved during Thursday’s Senate session on a bipartisan vote of 40–0.
“Massachusetts residents have a right to be online without companies trying to exploit their private data for financial gain,” Cronin said. “The Senate’s bill puts control back in the hands of consumers and ensures that bad actors can’t leverage sensitive information to hurt real people. I’m proud to join my colleagues to stand up to big tech companies to put residents first and defend the values that our Commonwealth is built on.”
According to Cronin, the bill, known as the Massachusetts Data Privacy Act, provides Massachusetts residents with expansive protections over their personal data and online activity, by creating clear rights for residents to know what information is being collected online and who that information is shared with, as well as allowing them to opt-out of having their personal data being used for targeted advertising or sold to other companies.
Additionally, Cronin said the bill protects a wide variety of consumer data, including that related to medical information, face scans and fingerprints, geolocation data, and information on a person’s religion or ethnicity, and immigration status. The bill also provides specific, more stringent protections for minors, including a complete ban on the sale of children’s personal data, and will also allow for residents to correct inaccurate data, delete personal information, and prevent their data from being sold.
The sale of sensitive data is also banned in the new bill and data transfers will only be allowed if residents specifically provide affirmative consent.
“When Massachusetts residents’ personal information is being offered up for sale to the tech billionaire with the highest bid, it is imperative that we act decisively to protect individuals and families,” Senate President Karen Spilka said. “As part of our ongoing effort to protect our residents, defend our values and lead Massachusetts during a time when those values are under attack, I am proud of the Senate for passing this visionary legislation which will offer some of the best data privacy protections in the country. I am deeply grateful to Majority Leader Creem for her leadership on this topic, Chair Rodrigues for stewarding the bill to the floor, and to all the Senators who contributed components to this bill.”
Further details from the bill include:
- Guarantees the Consumer’s Right to Know. Specifies that people have a right to know if their personal data is being collected, allows them to see what data was collected, and allows them to find out who their data has been shared with.
- Gives Control to Consumers. Gives Massachusetts residents control over their personal data through new guaranteed rights to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others.
- Creates Strong Enforcement Powers. Gives the Office of the Attorney General broad regulatory authority to enforce the provisions of the Massachusetts Data Privacy Act.
- Curtails Data Collection. Constrains companies’ unfettered collection of personal data by limiting them to only collecting what is reasonably necessary in order to provide their product or service. For certain sensitive types of data, including biometrics, precise GPS location, and health care data, businesses could only collect the information if it is strictly necessary.
- Bans Sensitive Data Sales. Prohibits any kind of entity, including businesses and nonprofits, from selling a person’s sensitive data. Protected categories of sensitive data include precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child.
- Limits Data Transfers. Limits entities from transferring sensitive data unless they first obtain the consumer’s affirmative consent.
- Creates Opt-Out Rights for Targeted Advertising. Gives consumers the right to opt out of having their personal data collected or processed for the purpose of targeted advertising or for sale to third parties.
- Bans the Sale of Children’s Data. Prohibits all entities from selling minors’ personal data.
- Blocks Targeted Ads for Minors. Prohibits companies from collecting or processing a child’s personal information for the purposes of targeting ads.
During Thursday’s session, senators also voted to adopt amendments to the bill which include:
- Amendment 4: Extends the ban on sales of geolocation data to cover anyone who visits Massachusetts for any reason, including travel to the state to pursue personal health care.
- Amendment 52: Ensures that businesses cannot sell sensitive data, regardless of whether they are otherwise exempt under the act.
The bill was originally drafted by the Senate Committee on Ways and Means on Sept. 18 on a 16-0 vote, and a revised version of a bill which was approved on May 12 by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on a 5-0 vote. This came after the joint committee invited public testimony on the proposed legislation during a hearing in April.
As the bill has been approved by the Senate, it must now be taken to the House of Representatives for a vote of approval, before it can be sent to Governor Maura Healey, who can then sign it into law or veto it.
