Massachusetts legislators and civil rights groups want to make the Bay State a leader on data and information privacy policy. But at a hearing at the State House on Thursday, business leaders said proposed legislation will be costly and burdensome.
Bills were filed this session in the Senate and House to establish a Massachusetts information privacy and security act. The act would regulate how technology companies can collect and use the personal information of Massachusetts residents.
Sen. Barry R. Finegold, co-chair of the Joint Committee on Economic Development and Emerging Technologies, presented the Information Privacy and Security Act (S 227 / H 60) in the Senate.
His office said the act would modernize Massachusetts laws by giving residents the ability to opt out of the sale of their data, establishing heightened protections for sensitive personal information and granting the Attorney General’s Office regulatory and enforcement authority.
“Thirteen other states have already done this. And there is a great argument that the federal government should be the ones who are doing this. But I don’t think we can wait around for the federal government to do this,” Finegold said while testifying Thursday to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity.
Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center, said companies track what websites internet users visit, whose cellphones are often near each other and what each of them are searching for, what people buy online and in stores, health and geolocation data, and more.
"We've all had the experience of being creeped out by an ad, right?" said Fitzgerald. "A lot of people think our phones must be listening to us because the ads are so creepy. The reality is even creepier. They don't need to listen to us to know what we're seeing and thinking because that's how much data they're collecting on us."
Claire Teylouni, Reproductive Equity Now’s director of government affairs, spoke in favor of greater privacy protections. Following the Dobbs Supreme Court decision, Teylouni said her organizations is seeing more people traveling to seek abortions in states like Massachusetts. She said legislation could help protect the digital privacy of abortion seekers, including preventing location data from those traveling to Massachusetts for abortion care from falling into the “wrong hands.”
The ACLU of Massachusetts is also pushing for greater data privacy. Kade Crockford, director of the technology for liberty program at the ACLU of Massachusetts, said Massachusetts should stick close to data privacy legislation being drafted at the federal level to avoid conflicts in the future.
While the federal government hasn’t been pushing this legislation lately, Crockford said it's likely that Congress will eventually move forward with a policy focused on data minimization. That means limiting what information companies can collect rather than focusing on an individual’s right to opt out of data sharing.
“The data that we leave behind us online, through our cell phones, is extremely revealing, and the way that companies are using this information along with pretty advanced algorithms these days is to manipulate us, to narrow our choices, to push us in certain directions toward certain kinds of information and away from others is really upsetting and dangerous,” Crockford said.
Concerns over costs
Some organizations, including the Retailers Association of Massachusetts, said they're opposed to Finegold’s bill. Ryan Kearney, the organization’s general counsel, said the legislation would be costly and burdensome for businesses, would potentially impede their ability to do business with customers and could expose them to legal liability.
“The collection of consumer data is an essential part of any retail business,” Kearney said. “The cost, obligations and potential liability created by this legislation will interfere with their ability for retailers to continue to serve their customers.”
Tech companies like ZoomInfo, which provides business intelligence to companies in the B2B space, want to see accommodations made in any legislation for business needs. ZoomInfo has more than 1,600 customers in Massachusetts and an office in Waltham with over 650 employees.
Lindsey Stewart, ZoomInfo's director of government and regulatory affairs, said they want to see this legislation exclude business information, such as work emails and titles. Stewart said this information is nonsensitive and largely public.
“We believe that data sensitivity is real. I think many people here do. But, that deregulation should be proportionate for the type of data being collected and the risk it poses to the consumer,” Stewart said.
Luke Dillon, president of the Life Insurance Association of Massachusetts, was one of several representatives of a variety of industries who opposed the bills on Thursday.
Dillon advocated for life insurance businesses' having a carve-out in the legislation.
"It's important to distinguish the financial services and the life insurance industry from other unregulated businesses which these bills seek to address. The life insurance industry is already highly regulated," he said.
Similarly, a representative of the auto dealer industry said car dealers' use of personal data is already regulated by the Federal Trade Commission.
"We're very confident in the way that we collect data and utilize it, that it's well-protected right now," said Robert O’Koniewski, executive vice president and general counsel for the Massachusetts State Automobile Dealers Association.
Material from the State House News Service was used in this article.
