United States of America: Introduced Massachusetts Data Privacy Protection Act (SD 745) including data protection regulation measures

On 18 January 2023, the Massachusetts Data Privacy Protection Act (SD 745), including data protection regulation, was introduced in the Massachusetts Senate. The Act would apply to entities with sufficient revenue or personal information processing volume. The Act sets out a “duty of loyalty” requiring the collection, processing, or transfer of personal data to be limited to what is reasonably necessary and proportionate to carry out certain defined purposes. Certain categories of sensitive personal data would be subject to further restrictions. The Bill would also establish a number of data subject rights, including the right to access information, data correction, and data deletion, among others. Further, the Act would require covered entities to publish a privacy policy. The Act would also regulate consent practices regarding personal data including the right of data subjects to withdraw consent. Finally, the Act would place a number of restrictions on electronic monitoring of employees by employers.