Massachusetts 2025-2026 Regular Session

Massachusetts House Bill H93 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	1 of 1
2	2	HOUSE DOCKET, NO. 707 FILED ON: 1/11/2025
3	3	HOUSE . . . . . . . . . . . . . . . No. 93
4	4	The Commonwealth of Massachusetts
5	5	_________________
6	6	PRESENTED BY:
7	7	Tram T. Nguyen
8	8	_________________
9	9	To the Honorable Senate and House of Representatives of the Commonwealth of Massachusetts in General
10	10	Court assembled:
11	11	The undersigned legislators and/or citizens respectfully petition for the adoption of the accompanying bill:
12	12	An Act relative to protecting sensitive information from security breaches.
13	13	_______________
14	14	PETITION OF:
15	15	NAME:DISTRICT/ADDRESS :DATE ADDED:Tram T. Nguyen18th Essex1/11/2025 1 of 7
16	16	HOUSE DOCKET, NO. 707 FILED ON: 1/11/2025
17	17	HOUSE . . . . . . . . . . . . . . . No. 93
18	18	By Representative Nguyen of Andover, a petition (accompanied by bill, House, No. 93) of Tram
19	19	T. Nguyen relative to protecting sensitive information from security breaches. Advanced
20	20	Information Technology, the Internet and Cybersecurity.
21	21	[SIMILAR MATTER FILED IN PREVIOUS SESSION
22	22	SEE HOUSE, NO. 76 OF 2023-2024.]
23	23	The Commonwealth of Massachusetts
24	24	_______________
25	25	In the One Hundred and Ninety-Fourth General Court
26	26	(2025-2026)
27	27	_______________
28	28	An Act relative to protecting sensitive information from security breaches.
29	29	Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority
30	30	of the same, as follows:
31	31	1 SECTION 1. Section 1 of chapter 93H of the General Laws is hereby amended by
32	32	2inserting after the definition of “Agency” the following definition:-
33	33	3 “Biometric information”, a retina or iris scan, fingerprint, voiceprint, map or scan of hand
34	34	4or face geometry, vein pattern, gait pattern, or other data generated from the specific technical
35	35	5processing of an individual’s unique biological or physiological patterns or characteristics used
36	36	6to authenticate or identify a specific individual; provided, however, that “biometric information”
37	37	7shall not include:
38	38	8 (i) a digital or physical photograph;
39	39	9 (ii) an audio or video recording; or 2 of 7
40	40	10 (iii) data generated from a digital or physical photograph, or an audio or video recording,
41	41	11unless such data is generated to authenticate or identify a specific individual.
42	42	12 SECTION 2. Said section 1 of said chapter 93H is hereby further amended by striking out
43	43	13the definition of “Breach of security” and inserting in place thereof the following definition:-
44	44	14 “Breach of security”, the unauthorized acquisition or use of unencrypted electronic data,
45	45	15or encrypted electronic data when the encryption key or security credential has been acquired;
46	46	16provided, however, that such unauthorized acquisition or use compromises the security,
47	47	17confidentiality, or integrity of personal information maintained by a person or agency; and
48	48	18provided further, that a good faith but unauthorized acquisition of personal information by an
49	49	19employee or agent of a person or agency for the lawful purposes of such person or agency is not
50	50	20a breach of security unless the personal information is used in an unauthorized manner or subject
51	51	21to further unauthorized disclosure.
52	52	22 SECTION 3. Said section 1 of said chapter 93H is hereby further amended by inserting
53	53	23after the definition of “Encrypted” the following definitions:-
54	54	24 “Genetic information”, information, regardless of format, that:
55	55	25 (i) results from the analysis of a biological sample of an individual, or from another
56	56	26source enabling equivalent information to be obtained; and
57	57	27 (ii) concerns an individual’s genetic material, including, but not limited to,
58	58	28deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes,
59	59	29alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), 3 of 7
60	60	30uninterpreted data that results from analysis of the biological sample or other source, and any
61	61	31information extrapolated, derived, or inferred therefrom.
62	62	32 "Health insurance information”, an individual’s health insurance policy number,
63	63	33subscriber identification number, or any identifier used by a health insurer to identify the
64	64	34individual.
65	65	35 “Medical information”, information regarding an individual’s medical history, mental or
66	66	36physical condition, or medical treatment or diagnosis by a healthcare professional.
67	67	37 SECTION 4. Said section 1 of said chapter 93H is hereby further amended by striking out
68	68	38the definition of “Personal information” and inserting in place thereof the following definition:-
69	69	39 “Personal information” shall mean either of the following:
70	70	40 (i) a resident’s first name and last name or first initial and last name in combination with
71	71	41any 1 or more of the following data elements that relate to such resident:
72	72	42 (A) social security number;
73	73	43 (B) taxpayer identification number or identity protection personal identification number
74	74	44issued by the Internal Revenue Service;
75	75	45 (C) driver’s license number, passport number, military identification number, state-issued
76	76	46identification card number, or other unique identification number issued by the government that
77	77	47is commonly used to verify the identity of a specific individual; 4 of 7
78	78	48 (D) financial account number, or credit or debit card number, with or without any
79	79	49required security code, access code, personal identification number or password, that would
80	80	50permit access to a resident's financial account;
81	81	51 (E) biometric information;
82	82	52 (F) date of birth;
83	83	53 (G) genetic information;
84	84	54 (H) health insurance information;
85	85	55 (I) medical information; or
86	86	56 (J) specific geolocation information; or
87	87	57 (ii) a username or electronic mail address, in combination with a password or security
88	88	58question and answer that would permit access to an online account.
89	89	59 SECTION 5. Said section 1 of said chapter 93H is hereby further amended by inserting
90	90	60after the definition of “Personal information” the following definition:-
91	91	61 “Specific geolocation information”, information derived from technology including, but
92	92	62not limited to, global positioning system level latitude and longitude coordinates or other
93	93	63mechanisms that directly identify the specific location of an individual within a geographic area
94	94	64that is equal to or less than the area of a circle with a radius of 1,850 feet; provided, however,
95	95	65that “geolocation information” shall exclude the content of communications or any information
96	96	66generated by or connected to advanced utility metering infrastructure systems or equipment for
97	97	67use by a utility. 5 of 7
98	98	68 SECTION 6. Section 2 of said chapter 93H is hereby amended by inserting the following
99	99	69subsection:-
100	100	70 (d) The rules and regulations adopted pursuant to this section shall be updated from time
101	101	71to time to reflect any changes to the definitions of “breach of security” or “personal information”
102	102	72in section 1.
103	103	73 SECTION 7. Section 3 of said chapter 93H is hereby amended by inserting after the
104	104	74words “unauthorized purpose” in subsection (b) the following words:- and such use or
105	105	75acquisition presents a reasonably foreseeable risk of financial, physical, reputational or other
106	106	76cognizable harm to the resident.
107	107	77 SECTION 8. Said section 3 of said chapter 93H is hereby further amended by striking out
108	108	78clause (vii) of subsection (b) and inserting in place thereof the following clause:- (vii) the type of
109	109	79personal information compromised, including, but not limited to, any of the categories of
110	110	80personal information set forth in subclauses (A) through (J) of clause (i) or in clause (ii) of the
111	111	81definition of “personal information” in section 1.
112	112	82 SECTION 9. Said section 3 of said chapter 93H is hereby further amended by inserting
113	113	83after the words “attorney general” in subsection (b), the first two times they appear, the
114	114	84following words each time so appearing:- , Federal Bureau of Investigation.
115	115	85 SECTION 10. Said section 3 of said chapter 93H is hereby further amended by striking
116	116	86out the last sentence of the first paragraph of subsection (b) and inserting in place thereof the
117	117	87following sentence:- A person who experienced a breach of security shall file a report with the
118	118	88attorney general and the director of consumer affairs and business regulation certifying their
119	119	89credit monitoring services comply with section 3A; provided, however, that such a report shall 6 of 7
120	120	90not be required if the personal information compromised by the breach of security is medical
121	121	91information or specific geolocation information.
122	122	92 SECTION 11. Said section 3 of said chapter 93H is hereby further amended by striking
123	123	93out the third paragraph of subsection (b) and inserting in place thereof the following paragraphs:-
124	124	94 The notice to be provided to the resident shall include, but shall not be limited to: (i) the
125	125	95date, estimated date, or estimated date range of the breach of security; (ii) the type of personal
126	126	96information compromised, including, but not limited to, any of the categories of personal
127	127	97information set forth in subclauses (A) through (J) of clause (i) or in clause (ii) of the definition
128	128	98of “personal information” in section 1; (iii) a general description of the breach of security; (iv)
129	129	99information that the resident can use to contact the person or agency reporting the breach of
130	130	100security; (v) the resident’s right to obtain a police report; (vi) how a resident may request a
131	131	101security freeze and the necessary information to be provided when requesting the security freeze;
132	132	102(vii) a statement that there shall be no charge for a security freeze; (viii) mitigation services to be
133	133	103provided pursuant to this chapter; and (ix) the toll-free number, address, and website for the
134	134	104federal trade commission. The notice shall not be required to include information pursuant to
135	135	105clauses (vi) and (vii) if the personal information compromised by the breach of security is
136	136	106medical information or specific geolocation information.
137	137	107 The person or agency that experienced the breach of security shall provide a sample copy
138	138	108of the notice it sent to consumers to the attorney general and the office of consumer affairs and
139	139	109business regulation. A notice provided pursuant to this section shall not be delayed on grounds
140	140	110that the total number of residents affected is not yet ascertained. In such case, and where
141	141	111otherwise necessary to update or correct the information required, a person or agency shall 7 of 7
142	142	112provide additional notice as soon as practicable and without unreasonable delay upon learning
143	143	113such additional information.
144	144	114 If the breach of security involves log-in credentials, pursuant to clause (ii) of the
145	145	115definition of “personal information” in section 1, for an online account and no other personal
146	146	116information, the person or agency may comply with this chapter by providing notice in electronic
147	147	117or other form; provided, however, that such notice shall direct the resident whose personal
148	148	118information has been breached to: (i) promptly change the resident’s password and security
149	149	119question or answer, as applicable; or (ii) take other steps appropriate to protect the affected
150	150	120online account with the person or agency and all other online accounts for which the resident
151	151	121whose personal information has been breached uses the same username or electronic mail
152	152	122address and password or security question or answer.
153	153	123 If the breach of security involves the log-in credentials, pursuant to clause (ii) of the
154	154	124definition of “personal information” in section 1, of an electronic mail account furnished by a
155	155	125person or agency, the person or agency shall not comply with this chapter by providing notice of
156	156	126the breach of security to such electronic mail address but shall instead provide notice by another
157	157	127acceptable method of notice pursuant to this chapter or by clear and conspicuous notice delivered
158	158	128to the resident online when the resident is connected to the online account from an internet
159	159	129protocol address or online location from which the person or agency knows the resident
160	160	130customarily accesses the account.