In the digital age, commercial entities collect, process, store, and disclose unprecedented quantities of often sensitive, granular information about every one of us. But despite quantum leaps in computing power and the growth of the internet, consumer privacy law in Massachusetts has failed to keep pace with our new digital reality.

Without a modern data privacy law, Massachusetts residents lack the ability to control our own lives. Untold numbers of corporations track our locations and our activities, secretly manipulate our opportunities and our choices, and take advantage of our personal information for their own profit.

CURRENT LAW

The few Massachusetts laws that touch on consumer data privacy rights are extremely limited and inadequate to meet the present need. Current laws include: General consumer rights under the state consumer protection law, MGL c.93A; provisions on data security breaches, MGL c.93H; and a general right to privacy, MGL c.214 § 1B (a one-line statement of principle).

The world of digital privacy protection is moving fast, and private companies are moving even faster; the Commonwealth cannot afford to fall behind.

THE SOLUTION

The Massachusetts Information Privacy Act (MIPA) HD.2664 (https://malegislature.gov/Bills/192/HD2664) SD.1726 (https://malegislature.gov/Bills/192/SD1726) would bring consumer privacy law into the 21st century. It would:

• Protect sensitive personal information from unwelcome collection, use, and monetization.

• Encourage individuals to take their consent seriously and prevent corporations for using practices that coerce such consent.

• Prohibit digital discrimination.

• Prevent companies from selling or trading your location information.

• Prohibit companies from collecting your biometric information absent your explicit consent.

• Protect workers from unwarranted electronic monitoring on the job.

• Level the playing field between individuals and corporations.

• Create a new agency, the Massachusetts Information Privacy Commission, with enforcement and regulatory authority.

• Blend the best approaches from other states and jurisdictions, including parts of similar laws passed in California, Illinois, and the European Union.

• Provides protections for workers against abusive workplace surveillance.