{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Foley Hoag LLP","Colin Zick"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Massachusetts"]
["Key Legislation Overview"]
["What is the key legislation?","Massachusetts has three general privacy statutes: \nMass. Gen. L. ch. 93H, 93I and \n214, § 1B, as well as regulations under \n201 Code of Massachusetts Regulations 17.\nNote: “Personal information” is defined and protected under \nMass. Gen. L. ch. 93H (“\nSecurity Breaches”), \nch 93I (“\nDisposition and Destruction of Records”) and \n201 Code of Massachusetts Regulations 17, as well as \nMass. Gen. L. ch. 214, § 1B (“\nRight of Privacy”).  \nUnder \nch. 93H, § 2, “The department of consumer affairs and business regulation shall adopt regulations relative to any person that owns or licenses personal information about a resident of the commonwealth. Such regulations shall be designed to safeguard the personal information of residents of the commonwealth and shall be consistent with the safeguards for the protection of personal information set forth in the federal regulations by which the person is regulated.”\nUnder \nch. 214, § 1B, “A person shall have a right against unreasonable, substantial or serious interference with his privacy.” This statute permits a plaintiff to bring a claim for damages for invasion of privacy.\n\n\n \n"]
["Key Data Protection Provisions"]
["What data is protected?"," Ch. 93H protects the “personal information” of a Massachusetts resident. \n\n Note: “Personal Information” is defined as: \n\n \n\t A person’s first name and last name (or first initial and last name) plus any one of the following:\n\t \n\t\t Social Security number; \n\t\t Driver’s license number (or other state-issued ID card number); or \n\t\t A financial account number, or credit or debit card number, with or without any required security code, access code or PIN that would allow account access. \n\t \n\t \n \n"]
["Who is subject to privacy obligations?","Any person or agency that holds “personal information” is subject to the Massachusetts privacy obligations.\nNote: Per \nch. 93H, § 3(a), “A person or agency that maintains or stores, but does not own or license data that includes personal information about a resident of the commonwealth” has obligations to report security breaches or unauthorized use of personal information.\n"]
["What are the principles applicable to personal data processing?","The collection of personal information is regulated on a case-by-case basis.\nNote: How the collection of personal information is regulated varies on a case-by-case basis; it is usually regulated by the Office of the Attorney General or the Office of Consumer Affairs and Business Regulation.\n"]
["How is the processing of personal data regulated?","The use and disclosure of personal information are regulated on a case-by-case basis.\n\n\n \nNote: The use and disclosure of personal information are regulated on a case-by-case basis, usually by the Office of the Attorney General or the Office of Consumer Affairs and Business Regulation.\n"]
["How are storage, security and retention of personal data regulated?","Mass. Gen. L. ch. 93H and 93I regulate security and storage and data retention.\nNote: Per \nch. 93H, § 1(a), “Breach of Security” is defined as: “An unauthorized acquisition or unauthorized use of personal information of Massachusetts residents that creates a substantial risk of identity theft or fraud against a Massachusetts resident.”  \nThose holding personal information are required to: (1) Designate employees to manage the program, (2) identify internal and external risks, (3) develop security policies for employees, including off-site access to information, (4) impose disciplinary measures for violations, (5) prevent terminated employees access, (6) require third-party compliance certification, (7) request only necessary information, (8) conduct routine data inventories, (9) create procedures for limiting physical access, (10) monitor and update their security program, (11) audit annually, (12) document responsive actions, (13) establish secure user authentication, (14) impose user-based restrictions on access to files containing personal information, (15) encrypt all transmitted files containing personal information, (16) encrypt all laptops and portable devices, (17) monitor systems for unauthorized access, (18) have “reasonably up-to-date” firewall protection, (19) have a “reasonably up-to-date” operating system, and (20) have “reasonably up-to-date” virus and “malware” protection set to receive the most current security updates on a regular basis.\n\n\n \n"]
["What are the data subjects' rights?","Massachusetts does not provide data subjects with rights to access or correction of privately held personal data.\nNote: Massachusetts does not provide data subjects with rights to access or correction of privately held personal data.\nGovernment data is subject to the \nMassachusetts Fair Information Practices Act, ch. 66A, which does impose obligations to correct certain data.\nHealth records containing personal data are governed by statutes and regulations, including \nMass. Gen. L. ch. 111, § 70, 70E, and \n243Code of Massachusetts Regulations 2.07."]
["Are there restrictions on cross-border data transfers?","N/A\n"]
["Are there any notification requirements for data breaches?","Yes.\nMass. Gen L. ch. 93H sets forth two sets of data breach reporting requirements depending upon whether Social Security numbers are included in a data breach. The general notification provision, \nMass. Gen. L. ch. 93H, § 3, requires an entity that “maintains or stores but does not own or license data that includes personal information” to report a data breach “to the owner or licensor” of the data. Entities that do “own or license” personal data are required to report data breaches “as soon as practicable and without unreasonable delay” to the affected individuals, the Attorney General and the Office of Consumer Affairs and Business Regulation. Upon receipt of such notice, the Office of Consumer Affairs and Business Regulation may designate additional agencies – such as consumer credit reporting agencies – who must also receive notice. The breach notification to the Attorney General requires not only information about the breach, but also information about the data security practices of the entity, such as whether the entity maintains a written information security program and the steps it has taken relating to the incident.  \nWhere a breach also involves Social Security numbers, and notice under \nMass. Gen. L. ch. 93H, § 3 is required, in addition to the obligations set out above, the entity must provide credit monitoring services for affected individuals for at least 18 months (unless the entity experiencing the breach is a credit reporting agency, in which case the period is at least 42 months).\n\n\n \n"]
["Who is the privacy regulator?","There are two regulators: the Office of the Attorney General and the Office of Consumer Affairs and Business Regulation, that regulate personal privacy.\nNote: The Office of the Attorney General and the Office of Consumer Affairs and Business Regulation are the primary regulators of personal privacy in Massachusetts. In 2020, Massachusetts Attorney General Maura Healey announced the creation of a Data Privacy and Security Division within her office, with the stated goal of “protect[ing] consumers from the surge of threats to the privacy and security of their data in an ever-changing digital economy.”\n"]
["What are the consequences of a privacy breach?","Consequences of a privacy breach may include injunctive relief and civil penalties.\nNote: The Office of the Attorney General has the authority to enforce statutes and may bring an action under \nChapter 93A to remedy violations of the statute and/or seek injunctive relief. There are civil penalties of up to USD $5,000 per violation. The breaching party may also be responsible for the costs of the investigation, including attorneys’ fees.   \nNothing in the statutes authorizes a private right of action, but conversely, such actions are not expressly forbidden under state law.\n"]
["How is electronic marketing regulated?","The Office of the Attorney General regulates electronic marketing on a case-by-case basis.\nNote: In April 2017, a digital advertising company that was hired to use mobile geofencing technology to target women entering reproductive health facilities has been prohibited from doing so in Massachusetts pursuant to a settlement announced by Attorney General Maura Healey.\nThe settlement resolved allegations that advertising practices would violate consumer protection laws in Massachusetts by tracking a consumer’s physical location near or within medical facilities, disclosing that location to third-party advertisers, and targeting the consumer with potentially unwanted advertising based on inferences about his or her private, sensitive, and intimate medical or physical condition, all without the consumer’s knowing consent.\nThe settlement assured that the advertiser would not use geofencing technology at or near Massachusetts healthcare facilities to infer the health status, medical condition, or medical treatment of any individual. \n\n\n \n"]
["Are there any recent developments or expected reforms?","The modifications regarding breach notifications involving Social Security numbers went into effect on April 10, 2019: \nhttps://malegislature.gov/Laws/SessionLaws/Acts/2018/Chapter444.\nSeveral Massachusetts cities (Boston, Springfield, Worcester and Somerville) prohibit the use of facial recognition technology by their city governments. \n"]