Photo: WBZ NewsRadio Archive
BOSTON (State House News Service) — More than eight months after the Senate passed its data privacy bill, House leadership on Wednesday said it will follow suit with its own this week, touting a proposal that strikes "an important balance between encouraging innovation and protecting the privacy rights of Massachusetts residents."
The House Ways and Means Committee proposal (H 5472) would give consumers the "rights" to confirm whether their personal data is collected, processed or accessed, and to "opt out" of the collection and processing of personal data for the purposes of targeting advertising, the sale of data or "profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer," according to the bill.
"This legislation is about ensuring that the Commonwealth's laws keep pace with the challenges of an increasingly data-driven world, where technology is embedded in nearly every aspect of daily life. Consumers deserve meaningful protections for their personal information and greater control over how that information is collected, used, and sold," House Speaker Ron Mariano and House Ways and Means Chair Aaron Michlewitz said in a statement. "This bill establishes common-sense safeguards for sensitive data, strengthens transparency, and promotes accountability for entities that profit from personal information."
The bill cleared the Ways and Means Committee Wednesday on a 20-0 vote and Mariano and Michlewitz said they look forward to "passing this critical legislation tomorrow."
The bill defines "sensitive data" to include data revealing a consumer's racial or ethnic origin, religious beliefs, sexual orientation, health data, personal data of a minor, and more. It prohibits the collection and processing of said data without obtaining the consumer's affirmative consent, according to a fact sheet.
The Senate unanimously passed a data privacy bill (S 2619) in September. The House Ways and Means redraft of the Senate bill prohibits the sale of "precise geolocation data" and prohibits the collection or processing of personal data "for targeted advertising or selling personal data if the controller has actual knowledge or willfully disregards that the consumer is a minor."
The bill would apply to any company but exempts banks, educational nonprofits and government entities.
Asked Tuesday why they carved out those entities, Michlewitz said it was to "level the playing field" between public and private schools, "particularly on the university side."
"If you just did government entities and not educational nonprofits, because you have public schools and private schools and they would be living under different rules, and we felt that was not necessarily the right direction to go," he said.
He added that they were "hearing from many folks through this process" about it.
A reporter asked Michlewitz if he had heard concerns from arts and cultural organizations about the impacts of targeting advertising restrictions.
"We heard those concerns. That was a conversation that we had throughout the process," he said. "We're still having those conversations, and I'm sure there will be some amendments filed to this bill, and we'll discuss those amendments as they come, probably in the next 24 hours."
The bill grants the attorney general authority to bring a civil action against any controller or processor other than a "large data holder" for violations. The attorney general would also "create, maintain and monitor a mechanism" for consumers to report potential violations and issue a report on any enforcement actions taken and their outcomes, according to the bill.
[Sam Drysdale contributed reporting]
Written by Ella Adams/ State House News Service