Law / United States / 
Massachusetts
Massachusetts Data Privacy Act (MDPA)
Mass. S.2619 (formerly S.2608); House substitute H.5472/H.5479, 194th Gen. Ct.
In reconciliation between two chambers, dated , as of .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
Where it has got to
The text described here is Senate print S.2619, the text of S.2608 as amended and passed by the Senate. That print is S.2619, published .
Locally, this stage is committee of conference.
The stage above is recorded at malegislature.gov.
The Senate declined to concur in the House amendment on and appointed conferees; the House insisted on its amendment and appointed its own on . No conference report is recorded. Formal sessions of the 194th General Court ended on , and a bill not enacted before the term of the 194th General Court ends would have to be filed again.
What it requires
- Track the Massachusetts Data Privacy Act's conference committee process, since the bill has passed both chambers in different forms.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a person 'produce products or provide services that are targeted to residents of the commonwealth' under section 2 of proposed chapter 93M in the House amendment when its product is offered nationally and is not marketed to Massachusetts residents in particular?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller would have to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm (targeted advertising, sale of personal data, risky profiling, sensitive data, and in the House text processing through a product used mainly by minors). The assessment must identify the categories of data, the purposes and whether data is sold or transferred, and weigh the benefits against the risks as mitigated by safeguards. The House text lets the Attorney General require disclosure of an assessment relevant to an investigation, and the Senate text requires disclosure on the Attorney General's request. Neither text sets a retention period; the House text asks the controller to review and update the assessment as often as appropriate. Both texts let a controller meet a deletion request by retaining a record of it, which is an option and not a duty. The Senate text applies to persons that meet consumer-count or revenue thresholds, with a consumer defined as a resident of the Commonwealth; the House text applies to persons that conduct business in the Commonwealth and produce products or provide services targeted to residents, and also defines a consumer as a resident. The bill is not enacted and the two texts are in conference.
- Kind
- Implicit
- As of
- Provision
- Proposed G.L. c. 93M, House text H.5479 s. 10(b), (c) and (d) (Senate text S.2619 s. 7(a), (b) and (e)): a data protection assessment of each heightened-risk processing activity must be conducted and documented and made available to the Attorney General
- Trigger
- personal_data_processing
What this law does
The Massachusetts Data Privacy Act (MDPA) would establish the state's first comprehensive consumer personal-data regime; it is not enacted and imposes no duty today. Originally S.2608, it passed the Senate 40-0 on , was engrossed as S.2619, and was amended by the House (Ways and Means reported a substitute striking the text and inserting H.5472, itself amended and republished as H.5479) before passing the House 146-0 on .
The Senate non-concurred in the House amendment on and appointed a conference committee; the House insisted on its own amendment and appointed its own conferees on . As of the date shown, the bill remains in conference with no compromise text produced.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .