MA H1754

Creates Chapter 93M of Massachusetts General Laws establishing comprehensive personal data protection rights, including rights to access, correct, delete, and port personal data, as well as the right to object to automated decision-making and profiling

Requires data controllers to obtain explicit consent before processing sensitive personal data including racial/ethnic origin, political opinions, religious beliefs, genetic data, biometric data, and health information

Mandates data breach notification to the Attorney General within 72 hours and requires controllers to notify affected individuals when breaches pose high risk to their rights and freedoms

Establishes administrative fines up to $10 million or 2% of global annual revenue for certain violations, and up to $20 million or 4% of global annual revenue for more serious violations including violations of basic processing principles and data subject rights

Grants the Attorney General enforcement authority including power to conduct audits, issue warnings and reprimands, order compliance, impose processing bans, and approve codes of conduct and certification mechanisms for data protection