Massachusetts Consumer Data Privacy Bill Could Dramatically Expand Class Action Litigation Risk

Earlier this year, Massachusetts state senators introduced a consumer data privacy bill with a private right of action that could become the broadest in the country. The proposed law, An Act Relative to Consumer Data Privacy (S.120) would create a new category of litigation in local, state, and federal courts against businesses that collect personal information from Massachusetts consumers.

The bill was recently referred to the Joint Committee on Consumer Protection and Professional Licensure. If enacted, S.120 would follow in the wake of a series of data privacy laws in Europe, California, and Illinois that have dramatically increased data privacy litigation risks for companies that collect consumer data, potentially bringing a potential surge of data privacy class actions to Massachusetts courthouses.

The proposed Massachusetts bill follows other legislation aimed at protecting consumer data privacy, including the General Data Protection Regulation (EU Regulation 2016/679) (GDPR), the California Consumer Privacy Act (AB-375) (CCPA) and the Illinois Biometric Information Privacy Act (740 ILCS/14) (BIPA). The bill adopts many key features from CCPA and BIPA, with important distinctions.

Key features of S.120 include:

• Application to for-profit businesses that collect personal information from Massachusetts consumers if they have either annual gross revenues over $10 million or derive more than 50% of annual revenues from third-party disclosures of consumer information.
• Expansive definitions of Personal Information and Biometric Information.
• Consumer rights to notice about the collection of personal information, to disclosure of the business purpose of personal information collection, to request copies of collected personal information, to direct the deletion of personal information, to opt-out of third-party disclosures, and to non-discrimination.
• Exceptions for aggregated data, employee information, First Amendment news gathering, clinical trials, and scientific research.
• A non-waivable private right of action for statutory damages of $750 per violation of any provision of the law (plus attorney’s fees and costs) that might be recoverable in class actions without a requirement that plaintiffs demonstrate actual injury to establish standing. There is no requirement that violations be negligent, reckless, or intentional, and any contractual provision that would waive or limit a right under the law would be deemed unenforceable.

Based on these key provisions, it is difficult to overstate the magnitude of class action litigation risk the proposed law may create for businesses collecting data from Massachusetts consumers. These businesses and their advisors should follow closely the progress of S.120, and be prepared to creatively formulate litigation risk strategies to confront a potential new tidal wave of consumer class actions in Massachusetts. If the bill, or one like it, is enacted, business litigators will need to evaluate potential defenses to class-wide liability under existing precedent and constitutional limitations.