Massachusetts debate centers on comprehensive privacy framework, opt‑out vs. minimization and enforcement

The Joint Committee on Advanced Information Technology spent several hours considering multiple proposals for statewide consumer data privacy, with testimony ranging from small‑business concerns to privacy‑rights advocacy.

Supporters of strong, comprehensive privacy proposals told the committee that modern consumer technology has outpaced current laws and that a statutory framework is needed to limit what companies may collect and how they may share or sell sensitive personal data. “Privacy is a fundamental human right,” a sponsor told the committee when describing a comprehensive bill that would limit collection to what is reasonably necessary and give individuals rights to access, correct and delete their data.

Key policy disputes heard at the hearing: - Data minimization: Consumer advocates and academic experts urged a legal standard that limits collection to data “necessary and proportionate” to provide the product or service requested, saying notice and consent has failed consumers who do not read dense privacy policies. - Private right of action: Privacy groups and some consumer advocates pressed for an individual private right of action alongside civil enforcement by the attorney general, saying only that combination provides meaningful accountability. Industry groups and some business representatives warned that private enforcement risks abusive litigation and urged exclusive AG enforcement. - Entity‑level vs. data‑level exemptions: Financial and health industry representatives asked for entity‑level exemptions (for firms already regulated under federal laws such as GLBA and HIPAA) to avoid duplication and unintended consequences; privacy advocates urged careful data‑level exemptions to prevent broad carve‑outs that would leave sensitive categories unprotected. - Interoperability: Industry witnesses advocated a model—HB80/S33—that is already used in other states and argued it reduces compliance costs for businesses operating across state lines. Privacy advocates countered that some states’ laws have weak minimization or enforcement provisions and urged Massachusetts to adopt strong protections rather than the “lowest common denominator.”

What legislators heard about enforcement and harms: Several witnesses recounted investigative reporting and regulatory actions showing location and health‑related datasets being sold to third parties; consumer groups and technologists urged the committee to prioritize rules that protect children, reproductive patients and marginalized populations.

Next steps: The committee solicited additional technical briefings and written comments; multiple witnesses offered to help craft interoperable language that retains strong data‑minimization and sensitive‑data protections while addressing compliance concerns for small businesses.