Massachusetts Data Privacy Act Approved by Legislative Committee

The Chairs of the Joint Committee on Advanced Information Technology, the Internet, and Cybersecurity of the Massachusetts General Court, Representative Tricia Farley-Bouvier and Senator Michael Moore, announced today that the Massachusetts Data Privacy Act (“MDPA”) had been reported favorably out of Committee. If passed, the MDPA would be the strongest state privacy law in the country.

Last year, EPIC crafted the State Data Privacy and Protection Act, modeled on American Data Privacy and Protection Act (“ADPPA”), to give state legislators the opportunity to use the bipartisan consensus language from ADPPA to strengthen state bills. The MDPA closely follows this model, including key data minimization principles, strong civil rights protections, and robust enforcement mechanisms. The Act’s data minimization requirements include limiting the collection of personal data to what is reasonably necessary for the product or service requested by a consumer, prohibits the sale of sensitive personal data, bans targeted advertising to minors, and prohibits the processing of personal data in ways that discriminate. The Location Shield Act was combined with the privacy bill, banning the sale of precise geolocation data. 

The MDPA includes strong enforcement provisions, which are critical to ensuring privacy laws are complied with. The Attorney General is empowered to enforce the MDPA under its own terms and as a violation of the Massachusetts’ consumer protection law, Chapter 93A. Consumers are also able to bring claims on their own behalf through a private right of action.

EPIC had previously testified in favor of the bill.

Having been approved by the Joint Committee on Advanced Information Technology, the Internet, and Cybersecurity, the bill now will move forward to the Senate and House Committee on Ways and Means for further review.