Those who click through those popup agreements online and worry about future repercussions may find relief in a bill sponsored by a trio of legislators, including Rep. Andy X. Vargas, and before a committee headed by local legislators.
Dubbed the Massachusetts Information Privacy Act, it targets a common feature of internet life—“click-to-agree” privacy policies and terms of use pages that require users’ consent to often lengthy explanations and disclaimers before they can proceed.
“Who reads them? Nobody,” Rep. Dave Rogers said. “No one, but we want to be on Facebook or we want to be on countless other things, so we just click ‘OK.’”
Rogers said legislation he filed with Vargas and Sen. Cindy Creem would create “bright line rules” around consent and notice for the collection of data and establish clearer standards around how companies collecting that data can use it. The bill and others related to data security are before the legislature’s Committee on Advanced Information Technology, the Internet and Cybersecurity, headed by Sen. Barry Finegold and Rep. Linda Dean Campbell.
Finegold said he expects data privacy to be a “top priority” for the relatively new committee.
Creem called for lawmakers to step in to ensure that individuals are treated “as the owner of their own data.”
“Currently, individuals have little power to access, delete or prevent the sale of our data,” she said. “We practically have no power. We need more rights to control our personal data and how it is used by third parties.”
The bill is backed by the ACLU of Massachusetts, would impose specific protections on the collection of biometric or location information, including a ban on selling that information, and aims to prevent companies from discriminating based on people’s personal information. It would also create a new Massachusetts Information Privacy Commission to create and enforce privacy regulations, and would allow individuals to bring civil actions for alleged privacy violations.
The Retailers Association of Massachusetts strongly opposes including a private right of action, its general counsel Ryan Kearney told the committee.
Kearney said the bill would impose “costly and unworkable requirements” on retail businesses, which collect consumer data for functions like sales, deliveries, returns and loyalty programs. He said retailers could face new expenses to change their policies, invest in new technology and train and hire staff.