Makes justice decisions, in Massachusetts

Mass. Gen. Laws ch. 93I, sec. 2 · Read the law's page

• This binds each agency or person that disposes of records containing personal information.
• Dispose of paper documents containing personal information by redacting, burning, pulverizing or shredding them so that personal data cannot practicably be read or reconstructed.
• Destroy or erase electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed.
• If you are a third party hired to dispose of material containing personal information, implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation and disposal of personal information.

201 CMR 17.00

• Maintain mandatory information security standards for personal information of Massachusetts residents that you own or license.
• Cover AI vendors that process Massachusetts residents' personal data with written data processing agreements.
• Map data flows through AI systems that process Massachusetts residents' personal data.
• Meet the regulation's risk management standards with AI-related security controls.

201 CMR 17.01-17.05 · Read the law's page

• This binds any person that owns or licenses personal information about a Massachusetts resident, meaning any person or business that receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment; it reaches a business outside Massachusetts that holds a Massachusetts resident's personal information the same as one located here.
• Develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size, scope, resources, amount of stored data, and the sensitivity of the personal information you hold.
• Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.
• For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.
• There is no compliance runway left to build against: every covered person has been required to be in full compliance since March 1, 2010.

Mass. AG Advisory (April 16, 2024); auth. Mass. Gen. Laws ch. 93A; 201 CMR 17.00; Mass. anti-discrimination statutes

• Do not use AI to deceive consumers.
• Do not market AI products or services while concealing known deficiencies.
• Do not use AI in ways that discriminate against people in protected classes.
• Safeguard personal information processed by AI systems under the state's breach notification framework.

Mass. S.2619 (Senate text of S.2608 as amended), proposed G.L. c. 93M, s. 4(a)(vi)(C) and (b); House amendment H.5479, s. 4(a)(6)(iii), 194th Gen. Ct. · Read the law's page

• This bill has not been enacted and binds no one yet, and its Senate and House texts differ; as either chamber passed it, a controller would have to honor a consumer's request to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
• If the Senate text is enacted, when you profile a consumer's personal data in furtherance of a decision that produces legal or similarly significant effects, let the consumer question the result, tell the consumer why the profiling resulted in the decision and what the consumer might have done, or might do in future, to secure a different decision where feasible, and let the consumer review the personal data used.
• If the Senate text is enacted and the decision turns out to rest on inaccurate personal data, correct the data and reevaluate the profiling decision based on the corrected data.

Mass. SD.3007 / HD.4827, 194th Gen. Ct. (filed June 25, 2025)

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not deploy an automated decision system that has the effect of discriminating against individuals based on a protected characteristic in employment, housing, credit, education, or another fundamental-opportunity context.
• Audit covered automated decision systems every 90 days.
• Publicly disclose information about the design and training data of covered automated decision systems.
• Let individuals opt out of covered automated decision systems.
• Give individuals access to human review of decisions made by covered automated decision systems.