Mass. House unanimously passes data privacy bill

The House on Thursday unanimously passed a major data privacy bill that would give consumers new rights and impose restrictions on companies' use of personal information.

Representatives voted 146-0 in favor of the bill, which would require affirmative consent before sensitive information can be sold or shared, ban the sale of precise geolocation data, create special protections for minors, and authorize enforcement by the attorney general and, in some cases, private individuals.

The bill's passage sets the stage for an effort to form a consensus bill with the Senate, which passed its version of the bill (S 2619) by a 40-0 vote in September.

"Data privacy is the underpinning of all future tech bills. We have to do data privacy first," Advanced Information Technology, the Internet and Cybersecurity Committee Co-chair Rep. Tricia Farley-Bouvier told reporters when asked about where the proposal lands in the larger environment of tech bills, including ones the House has passed regulating artificial intelligence in campaign advertisements and youth social media.

During floor remarks, Farley-Bouvier framed the bill as the latest chapter in a Massachusetts privacy tradition dating back to Samuel Warren and future U.S. Supreme Court Justice Louis Brandeis, who argued in an influential 1890 Harvard Law Review article that Americans have a "right to be let alone." She said the legislation responds to a modern economy built on the collection and sale of personal data and puts consumers at the center of decisions about how that information is used.

The bill would apply to companies that control or process personal data on at least 100,000 consumers and includes a carveout designed to shield loyalty programs from some enforcement provisions.

"It allows for the AG to take civil action on anybody, but it gives the AG exclusive rights on everybody but the large data holders, so other people privately can have a private right of action against the large data holders," Farley-Bouvier said.

That private right of action is important because "we want to be clear that we want to protect the small businesses, the local businesses, but it's those big, that big tech industry that we want to give more teeth to on the enforcement," she clarified.

Several lawmakers made similar arguments on the House floor. Rep. David Vieira said the measure builds on prior bipartisan privacy efforts grounded in the principle that privacy is a fundamental right.

Farley-Bouvier said Attorney General Andrea Campbell's office provided "a lot of input" to her office.

The House bill (H 5472) would prohibit the sale or sharing of sensitive data without affirmative consent, and defines sensitive data as including biometric and genetic information, precise geolocation data, health and reproductive health information, data belonging to minors, government-issued identifiers, and information revealing characteristics such as race, religion, immigration status, sexual orientation or union membership.

"We're just looking for a balanced bill, right? And so we think with affirmative, informed, clear, unambiguous consent, that it has a lot of protections for our consumers," the Pittsfield Democrat said.

Asked what that looks like for the average user, Farley-Bouvier said it could be a button they press, "but it has to be a lot clearer than what we experience now."