United States of America: Introduced Act establishing the Massachusetts Information Privacy and Security Act (HD 3263)

On 20 January 2023, the Act Establishing the Massachusetts Information Privacy and Security Act (HD 3263) was introduced in the House of Representatives of the Commonwealth of Massachusetts. The Act would apply to data controllers or processors who carry out their activities in the territory of Massachusetts or to those who process personal information (controllers or processors) who are not physically located in the territory of the Commonwealth of Massachusetts or carrying out data processing activities related to targeting or monitoring the behaviour of individuals that take place in Massachusetts. In particular, sections 7 to 17 and section 26 apply only to a controller with annual revenues over USD 25'000'000 or is a data broker or has processed the information of more than 100'000 individuals. The Act establishes the general principles for the processing of personal data, the legal basis for the processing of personal data and the right of consumers to receive a privacy notice. In addition, the right to refuse the processing of one's information for the purpose of sales-targeted cross-contextual advertising and targeted first-party advertising is established. The Act outlines protection for sensitive information, establishes the right to access and transport personal information, the right to erasure and correct personal information, and the right to withdraw consent. Furthermore, the exercise of privacy rights is defined. Unlawful discrimination in data processing is also regulated. The Attorney General is given the power to enforce the proposed Act. In case of non-compliance, entities face a fine of a maximum of USD 7'500 for each violation of the Act.