09/27/2023

New England State Consumer Data Privacy Bills Currently Under Consideration

Last updated October 17, 2023

This is the latest article in our series highlighting aspects of U.S. privacy laws. For our most recent previous article, click here.

As noted in previous installments in our ongoing series on U.S. privacy laws, the sector-specific and activity-specific model for U.S. privacy regulation is rapidly changing, with individual states recently enacting comprehensive consumer data privacy legislation.

To date, 12 states have enacted generally applicable (not industry-specific or activity-specific) laws that impose affirmative obligations and substantive restrictions on what covered businesses must and cannot do with personal data: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. And similar laws are likely on the horizon, with pending proposals in New England and at the federal level. Numerous comprehensive consumer privacy bills are currently under consideration in state legislatures across New England. Below is list of each state’s pending legislation together with a brief description of the enforcement provisions contained in each bill.

MAINE

Several consumer privacy bills were introduced in the Maine Legislature in 2023 and have been carried over to the Second Regular Session of the 131st Maine Legislature that convenes in January 2024:

  • An Act to Enact the Maine Consumer Privacy Act, L.D. 1973, provides for exclusive enforcement by the attorney general but would designate violations of the bill as unfair business practices.
  • An Act to Create the Data Privacy and Protection Act, L.D. 1977, provides for both government enforcement and a private right of action, with $5,000 statutory damages per violation.
  • An Act to Protect Personal Health Data, L.D. 1902, provides for enforcement by the Attorney General and a private right of action, with statutory damages of $1,000 per violation and $5,000 per violations for reckless or intentional misconduct.
  • An Act to Give Consumers Control over Sensitive Personal Data by Requiring Consumer Consent Prior to Collection of Data L.D. 1705, is a biometric privacy bill.

The Legislature’s Joint Standing Committee on Judiciary will be meeting on October 17, 2023 to hold a public hearing on LD 1977, and to hold work sessions on all four bills immediately thereafter.

MASSACHUSETTS

There are three competing comprehensive consumer data privacy bills currently pending in the 193rd Session of the Massachusetts Legislature. All three bills are currently in committee.

  • The Massachusetts Information Privacy and Security Act (MIPSA), S.227, substantially similar to bills introduced in prior sessions, was introduced on January 20, 2023. Most recently, S.227 was referred to the Joint Committee on Economic Development and Emerging Technologies on February 16, 2023 and a hearing with public comment is scheduled for October 19, 2023. The bill provides for enforcement by the attorney general and a private right of action with a safe harbor against punitive damages for compliant privacy programs.
  • The Massachusetts Data Privacy Protection Act (MDPPA), S.25, was introduced on January 18 and 19, 2023, and is based on the federal American Data Privacy Protection Act, with additional provisions to allow a private right of action and address workplace surveillance. Most recently, S.25 was referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
  • The Massachusetts Internet Bill of Rights, H.1555, was introduced on January 20, 2023 and was most recently referred to the Joint Committee on The Judiciary on February 16, 2023. The bill closely tracks the GDPR and provides for enforcement by the attorney general and a “right to receive compensation” for individuals who “suffered material or non-material damage.”

In the current session, the Massachusetts Legislature has introduced more than 100 other bills related to data privacy, including:

  • An Act to Protect Biometric Information, H.63, introduced on January 20, 2023, and most recently referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
  • An Act to Protect Personal Biometric Data, S.195, introduced on January 20, 2023, and most recently referred to the committee on Advanced Information Technology, the Internet and Cybersecurity on April 6, 2023.
  • An Act Relative to Protecting Biometric Information under the Security Breach Law, S.140, introduced on January 19, 2023 and most recently referred to the Joint Committee on Consumer Protection and Professional Licensure on February 16, 2023.
  • An Act Relative to Internet Privacy Rights for Children, H.80, introduced on January 19, 2023 and most recently referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
  • An Act Relative to Consumer Health Data, S.184, introduced on January 20, 2023 and most recently referred to the Joint Committee on Consumer Protection and Professional Licensure on February 16, 2023.
  • An Act Relative to Student and Educator Data Privacy, S.280, introduced on January 19, 2023 and most recently referred to the committee on Education on February 16, 2023.

NEW HAMPSHIRE

A comprehensive consumer data privacy bill is making progress in both houses of the state legislature.

  • A bill Relative to the Expectation of Privacy, SB255, was introduced on January 19, 2023 and favorably reported out by the Senate Committee on Judiciary on March 16, 2023 with a unanimous vote as amended, and then introduced in the House and referred to the House Committee on Judiciary, which was retained in Committee following an executive session on May 3, 2023. The bill is scheduled to be considered in Committee sessions in October and November 2023. SB255 does not create a private right of action and contemplates enforcement by the attorney general.

RHODE ISLAND

In the current legislative session, all consumer data privacy bills proposed to date have stalled, with committee recommendations to hold pending further study.

  • A comprehensive consumer data privacy bill, S754 was introduced on March 23, 2023 and referred to the Senate Commerce Committee on the same date. A companion bill, H6236, was also referred to the House Innovation, Internet, and Technology Committee on March 30, 2023, and on April 4, 2023 the committee recommended holding for further study.
  • Two other bills faced a similar fate. The Rhode Island Personal Data and Online Privacy Protection Act, H5745, was introduced on February 21, 2023 and was referred to the House Innovation, Internet, and Technology Committee on February 21, 2023, which on March 2, 2023 recommended the measure be held for further study. The Rhode Island Data Transparency And Privacy Protection Act, H5354, was introduced on February 3, 2023 and was referred to the House Innovation, Internet, & Technology, which also recommended holding the measure for further study on March 2, 2023.

VERMONT

  • An act relating to enhancing consumer privacy, H121, was introduced on January 26, 2023 and referred to the House Committee on Commerce and Economic Development. The bill addresses the collection and use of biometric information and provides for both government enforcement and a private right of action with $1,000 in statutory damages and $5,000 for willful or reckless violations, and a $10,000 per day penalty for failing to delete biometric information or obtain consent for collection within 180 days of the law’s effective date. The bill remains in Committee.

As legislative deadlines approach, and the proposed laws make their way through state legislatures in New England, we will continue to monitor the progress of each bill and share news of major developments.

If you have any questions or concerns about consumer data privacy laws, would like to know whether they apply to your business, or if there are particular topics you’d like us to address in the future, please contact Melanie Conroy, Vivek Rao, or Ariel Pardee.