Massachusetts lawmakers weighing online data privacy bill | Technology

The bill would require companies obtain consent for most sales of sensitive information — such as geolocation, biometric or racial data — and when selling the personal information of children under 16.

It would also give internet users the right to delete and correct the personal information a company maintains about them.

Under the proposed law, companies would be required to provide easy-to-understand privacy notices that specify how personal information is being collected and sold and how residents can opt out. Businesses would have to conduct regular risk assessments for high-risk practices such as the sale of personal information and minimize the amount of personal information collected and retained.

The legislation would also allow the attorney general’s office to impose penalties of up to $7,500 per violation, ensure the state’s privacy laws adapt with the times and require those who buy and sell internet data register with the attorney general’s office.

Setting rules for the internet on a state-by-state basis makes little sense according to Chris Gilrein of TechNet, a technology industry group.

“It’s not the internet of Massachusetts or the internet of New Hampshire or Connecticut. Ultimately, a federal privacy law is the only way to end the costly patchwork of state laws,” Gilrein said in a statement. “A federal law would give consumers assurances their data is protected no matter where they live while offering businesses, especially small businesses, certainty about their responsibilities.”