Consumer Reports and the Electronic Privacy Information Center sent a letter to Massachusetts legislators offering recommendations on how to normalize the two privacy bills that have passed in the House and Senate respectively. Both organizations have worked on privacy legislation in the state for several years and congratulated the policymakers on the remarkable progress that has been made this session.
Specifically, CR and EPIC urge the members of the conference committee to adopt:
- The strict data minimization rules for the collection and processing of sensitive data from S. 2619;
- The private right of action (including class actions under c.93A §§9/11) against large data holders in H. 5479;
- The data minimization rules for non-sensitive data from S. 2619;
- The ban on the sale of sensitive data from S. 2619;
- The broader definition of sensitive data and narrower definition of publicly available data from H. 5479;
- The loyalty program restrictions from H. 5479; and
- A combination of the permissible purposes in Sec. 9 of S. 2619 and Sec. 12 of H. 5479 to ensure the exceptions to the law do not swallow the rule.