Law / United States / 
Massachusetts
Massachusetts Data Privacy Act (MDPA), profiling opt-out and consequential-decision rights
Mass. S.2619 (Senate text of S.2608 as amended) proposed G.L. c. 93M, s. 4(a)(vi)(C) and (b); House amendment H.5479, s. 4(a)(6)(iii), 194th Gen. Ct.
In reconciliation between two chambers, dated , as of .
A data subject rights rule.
As of .
Where it has got to
The text described here is Senate print S.2619, the text of S.2608 as amended and passed by the Senate. That print is S.2619, published .
Locally, this stage is committee of conference.
The stage above is recorded at malegislature.gov.
The Senate declined to concur in the House amendment on and appointed conferees; the House insisted on its amendment and appointed its own on . No conference report is recorded. Formal sessions of the 194th General Court ended on , and a bill not enacted before the term of the 194th General Court ends would have to be filed again.
What it requires
- This bill has not been enacted and binds no one yet, and its Senate and House texts differ; as either chamber passed it, a controller would have to honor a consumer's request to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
- If the Senate text is enacted, when you profile a consumer's personal data in furtherance of a decision that produces legal or similarly significant effects, let the consumer question the result, tell the consumer why the profiling resulted in the decision and what the consumer might have done, or might do in future, to secure a different decision where feasible, and let the consumer review the personal data used.
- If the Senate text is enacted and the decision turns out to rest on inaccurate personal data, correct the data and reevaluate the profiling decision based on the corrected data.
These lines are LexLint's reading of the law's text, as of .
What this law does
As the Senate passed it, proposed chapter 93M section 4(a)(vi)(C) gives a consumer the right to opt out of the collection and processing of the consumer's personal data for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
The House amendment, H.5479, section 4(a)(6)(iii), likewise lets a consumer opt out of the collection and processing of their personal data for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
In the Senate text, section 4(b)(1) gives a consumer whose personal data is profiled in furtherance of a decision that produces legal or similarly significant effects the right to question the result of the profiling, to be informed of the reason it resulted in the decision, to be informed of the actions the consumer might have taken to secure a different decision and, where feasible, might take to secure one in the future, and to review the personal data used in the profiling.
In the Senate text, section 4(b)(2) gives a consumer whose decision is determined to have been based upon inaccurate personal data the right to have the data corrected and the profiling decision reevaluated based upon the corrected data.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.