This is the latest article in our series highlighting aspects of U.S. privacy laws. For our most recent previous article, click here.

As noted in previous installments in our ongoing series on U.S. privacy laws, the sector-specific and activity-specific model for U.S. privacy regulation is rapidly changing, with individual states recently enacting comprehensive consumer data privacy legislation.

To date, these 12 states have enacted generally applicable (not industry-specific or activity-specific) laws that impose affirmative obligations and substantive restrictions on what covered businesses must and cannot do with personal data: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. And similar laws are likely on the horizon, with pending proposals in New England and at the federal level. Below is an overview of comprehensive consumer privacy legislation currently under consideration in state legislatures across New England.

MAINE

• The Maine Legislature has carried over two consumer data privacy bills that were introduced in May 2023 into future sessions of Maine’s 131st Legislature: An Act to Enact the Maine Consumer Privacy Act, LD1973 and An Act to Create the Data Privacy and Protection Act, LD1977. The first bill provides for exclusive enforcement by the attorney general, but would designate violations of the bill as unfair business practices. The second bill provides for both government enforcement and a private right of action, with $5,000 statutory damages per violation. Both bills will be considered at the Joint Judiciary Committee’s hearing on October 17, 2023.
• A biometric privacy bill, LD1705, was introduced in the First Special Session of Maine’s 131st Legislature on April 18, 2023, and was considered at a public hearing in May 2023 before the Committee on Judiciary, which did not report out the bill for further consideration by the Legislature.

MASSACHUSETTS

There are three competing comprehensive consumer data privacy bills currently pending in the 193rd Session of the Massachusetts Legislature. All three bills are currently in committee.

• The Massachusetts Information Privacy and Security Act (MIPSA), S.227, substantially similar to bills introduced in prior sessions, was introduced on January 20, 2023. Most recently, S.227 was referred to the committee on Economic Development and Emerging Technologies on February 16, 2023. The bill provides for enforcement by the attorney general and a private right of action with a safe harbor against punitive damages for compliant privacy programs.
• The Massachusetts Data Privacy Protection Act (MDPPA), S.25, was introduced on January 18 and 19, 2023, and is based on the federal American Data Privacy Protection Act, with additional provisions to allow a private right of action and address workplace surveillance. Most recently, S.25 was referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
• The Massachusetts Internet Bill of Rights, H.1555, was introduced on January 20, 2023 and was most recently referred to the Joint Committee on The Judiciary on February 16, 2023. The bill closely tracks the GDPR and provides for enforcement by the attorney general and a “right to receive compensation” for individuals who “suffered material or non-material damage.”

In the current session, the Massachusetts Legislature has introduced more than 100 other bills related to data privacy, including:

• An Act to Protect Biometric Information, H.63, introduced on January 20, 2023, and most recently referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
• An Act to Protect Personal Biometric Data, S.195, introduced on January 20, 2023, and most recently referred to the committee on Advanced Information Technology, the Internet and Cybersecurity on April 6, 2023.
• An Act Relative to Protecting Biometric Information under the Security Breach Law, S.140, introduced on January 19, 2023 and most recently referred to the Joint Committee on Consumer Protection and Professional Licensure on February 16, 2023.
• An Act Relative to Internet Privacy Rights for Children, H.80, introduced on January 19, 2023 and most recently referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on February 16, 2023.
• An Act Relative to Consumer Health Data, S.184, introduced on January 20, 2023 and most recently referred to the Joint Committee on Consumer Protection and Professional Licensure on February 16, 2023.
• An Act Relative to Student and Educator Data Privacy, S.280, introduced on January 19, 2023 and most recently referred to the Committee on Education on February 16, 2023.

NEW HAMPSHIRE

A comprehensive consumer data privacy bill is making progress in both houses of the state legislature.

• A bill Relative to the Expectation of Privacy, SB255, was introduced on January 19, 2023 and favorably reported out by the Senate Committee on Judiciary on March 16, 2023 with a unanimous vote as amended, and then introduced in the House and referred to the House Committee on Judiciary, which was retained in Committee following an executive session on May 3, 2023. The bill is scheduled to be considered in Committee sessions in October and November 2023. SB255 does not create a private right of action and contemplates enforcement by the attorney general.

RHODE ISLAND

In the current legislative session, all consumer data privacy bills proposed to date have stalled, with committee recommendations to hold pending further study.

• A comprehensive consumer data privacy bill, S754 was introduced on March 23, 2023 and referred to the Senate Commerce Committee on the same date. A companion bill, H6236, was also referred to the House Innovation, Internet, and Technology Committee on March 30, 2023, and on April 4, 2023 the committee recommended holding for further study.
• Two other bills faced a similar fate. The Rhode Island Personal Data and Online Privacy Protection Act, H5745, was introduced on February 21, 2023 and was referred to the House Innovation, Internet, and Technology Committee on February 21, 2023, which on March 2, 2023 recommended the measure be held for further study. The Rhode Island Data Transparency And Privacy Protection Act, H5354, was introduced on February 3, 2023 and was referred to the House Innovation, Internet, & Technology, which also recommended holding the measure for further study on March 2, 2023.

VERMONT

• An act relating to enhancing consumer privacy, H121, was introduced on January 26, 2023 and referred to the House Committee on Commerce and Economic Development. The bill addresses the collection and use of biometric information and provides for both government enforcement and a private right of action with $1,000 in statutory damages and $5,000 for willful or reckless violations, and a $10,000 per day penalty for failing to delete biometric information or obtain consent for collection within 180 days of the law’s effective date. The bill remains in Committee.

As legislative deadlines approach, and the proposed laws make their way through state legislatures in New England, we will continue to monitor the progress of each bill and share news of major developments.