An Act establishing the Massachusetts Information Privacy and Security Act

Bill No. S.227

The Massachusetts Information Privacy and Security Act (MIPSA), introduced as Chapter 93M in the General Laws, is a comprehensive legislative framework designed to regulate the processing of personal information, ensuring transparency, consent, and protection of individuals' privacy rights within the state. The legislation, spanning Sections 4 to 30, covers a wide array of aspects related to information privacy and security.

The bill starts by providing an extensive set of definitions for terms crucial to understanding its scope, such as affiliate relationships, biometric information, consent, data brokers, de-identified information, genetic information, health-related terms, and targeted advertising. It establishes that the legislation applies to entities conducting business in Massachusetts, particularly those processing personal information related to goods/services or monitoring behavior within the state.

Notably, the legislation imposes certain obligations on controllers, especially those meeting specific criteria like annual global gross revenues exceeding $25 million, functioning as a data broker, or processing personal information for a certain number of individuals. While offering exemptions for government agencies, nonprofit organizations, and activities regulated by federal laws, the bill ensures that certain sections do not apply to specific contexts, such as professional or commercial activities, employment relationships, emergency contact information, and benefits administration.

The legislation introduces terms like "dark pattern" to address manipulations in user interfaces affecting autonomy and "verifiable request" for individuals exercising their rights. It makes a clear distinction between targeted cross-contextual advertising and targeted first-party advertising, providing precise definitions for these terms.

Sections 4 to 21 focus on fundamental principles, including the right to privacy notice, lawful bases for processing personal information, opt-out rights, protections for sensitive information, access, deletion, and correction rights. The bill emphasizes the importance of controllers providing clear and accessible privacy notices at the point of information collection, restricting the use of personal information for profiling in automated decisions with significant effects, and granting individuals the right to opt out of various processing activities.

Sections 13 to 21 delve deeper into regulations for controllers, introducing the right to revoke consent, mechanisms for individuals to exercise privacy rights, obligations of controllers in responding to requests, non-discrimination clauses, disclosure of methods for exercising privacy rights, and non-waiver of individual rights in contracts. It also addresses the relationships among controllers, processors, and third parties, establishing a data broker registration requirement and mandating risk assessments by controllers.

The final sections, 22 to 30, cover essential aspects such as non-discriminatory processing, limitations on identifiable information, enforcement mechanisms through the Attorney General, the establishment of the Massachusetts Privacy Fund, compliance through reciprocity with other jurisdictions, and specifics regarding the application of the chapter to nonprofit organizations and institutions of higher education. The effective date is set 18 months after passage, with certain sections taking effect earlier or later, ensuring a gradual implementation of the comprehensive privacy regulations.

An Act relative to economic development initiatives

Bill No. S.1826

This bill proposes several amendments to the General Laws related to taxation and corporate incentives in Massachusetts. In Section 1, it suggests amending the tax rate for gains from the sale or exchange of capital assets held for one year or less, taxing them at a rate of 5 per cent.

Section 2 focuses on amending Section 38M of Chapter 63 regarding corporate excise tax credits. It introduces distinctions based on whether a corporation is classified as an eligible semiconductor company. For corporations that do not fall under this category, the credit is limited to a certain percentage of the excise, with a higher percentage applied to amounts exceeding $25,000. For eligible semiconductor companies, a higher credit percentage is proposed for the excise exceeding $25,000. The section also empowers the commissioner to establish regulations for apportioning the $25,000 amount among members of a controlled group.

Section 3 introduces a definition for an "Eligible semiconductor company," specifying criteria related to the company's primary business activities, establishment or expansion of a physical facility in the commonwealth, job creation, and commitment to job retention.

Section 4 mandates that the commissioner of revenue issues new regulations within eight months after the effective date of the act to implement the purposes outlined in Section 38M of the General Laws, ensuring clarity and guidance in the application of the proposed amendments.

An Act relative to fair software licensing

Bill No. S.2007

This bill proposes an amendment to Chapter 7D of the General Laws, introducing a new section titled "Fair Software Licensing." In Section 12, it stipulates that contracts entered into by state agencies for the licensing of software applications, designed for generally available desktop or server hardware, must not impose limitations on the agency's ability to install or run the software on hardware of its choosing.

The bill assigns the responsibility of implementing and enforcing this provision to the secretary of the executive office of technology services and security, who is directed to issue administrative directives in accordance with Section 12.

Furthermore, Section 2 specifies that the provisions outlined in Section 1 of the act apply to any contracts or addenda for the licensing of software applications entered into on or after the effective date of this act. This bill aims to ensure fairness and flexibility in software licensing for state agencies in Massachusetts.

An Act establishing a special commission on blockchain and cryptocurrency

Bill No. S.29

This bill establishes a special commission consisting of 25 members to conduct an investigation on blockchain technology with the aim of developing a master plan for fostering its appropriate expansion in Massachusetts. The commission includes representatives from the legislative, executive, and regulatory branches, as well as industry and academic experts.

The commission is tasked with examining various aspects of blockchain technology, including its feasibility, risks, and benefits in government and business applications. Specifically, it will explore the use of blockchain in government records, service delivery, court proceedings, registries, and elections. The commission will also consider the impact of cryptocurrency on state revenues, the need for tax framework restructuring, and the advisability of accepting cryptocurrency as payment. Additionally, it will assess the feasibility of regulating cryptocurrency's energy consumption, address consumer protection concerns, and identify best practices for enabling blockchain technology to benefit the state and its residents.

The commission is required to take input from a diverse range of stakeholders and, within one year of all appointments, submit a report to the general court detailing its findings and a master plan of recommendations. The report will include draft legislation necessary to implement the commission's recommendations. This bill reflects the state's interest in understanding, regulating, and fostering the growth of blockchain technology within its jurisdiction.