An Act relative to updating the security of personal information

H 4807 updates Massachusetts' data security laws by defining key terms and strengthening protections for personal information. It directly affects Massachusetts government agencies, departments, and businesses (called "service providers") that handle residents' data, including new categories like biometric data (e.g., fingerprints) and neural data (e.g., brain activity measurements). The bill expands what counts as "personal information" to include sensitive details like health history, precise location data, and financial account numbers, and requires clearer breach notifications - such as free security freeze options - within 30 days of discovering a breach. It also mandates that organizations implement security programs to protect data and comply with federal standards.