An Act relative to protecting sensitive information from security breaches

HD 707 defines new categories of sensitive personal information requiring protection, including biometric data (like fingerprints), genetic information, health insurance details, medical history, and precise geolocation data. It updates the definition of "breach of security" to cover unauthorized access to unencrypted data or encrypted data where keys were compromised, with exceptions for legitimate employee actions. The bill requires organizations experiencing a breach to notify both the Attorney General and Consumer Affairs agency, detailing the compromised data types (e.g., biometric or medical information), and to certify credit monitoring services meet new standards - though medical or geolocation data breaches may exempt the notification requirement. This directly affects businesses, government agencies, and healthcare providers handling residents' personal data in Massachusetts.