Massachusetts businesses could have liability risk from Location Shield Act

Businesses could be exposed to liability if the Massachusetts Legislature enacts measures banning the sale of cellular location data.

Introduced in both the Senate and the House earlier this year, the Location Shield Act is billed as an act “protecting reproductive health access, LGBTQ lives, religious liberty, and freedom of movement.”

The American Civil Liberties Union of Massachusetts has come out in support of the legislation.

“Every day, unregulated data brokers buy and sell personal location data from apps on our cellphones, revealing where we live, work, play, and more,” the ACLU said in a position statement. “To protect our privacy, safety, access to abortion and other essential health care, Massachusetts needs to ban this practice now by passing the Location Shield Act.”

The measure would be the first legislation of its kind in the nation. Companies are advised to review their own data collection practices in advance of the bill moving forward.

The legislation proposes amending the General Laws with the addition of G.L.c. 93L, “Privacy Protections for Location Information Derived from Electronic Devices.”

Proposed G.L.c. 93L, §2(a) provides that, absent appropriate consent, it “shall be unlawful for a covered entity to collect or process an individual’s location information except for a permissible purpose.”

The legislation defines a “covered entity” as “any individual, partnership, corporation, limited liability company, association, or other group, however organized.” The definition excludes governmental entities and individuals acting in a “non-commercial” context.

In addition to complying with state or federal law or reporting an emergency involving an “imminent threat” to human life, the legislation defines “permissible purpose” as including the use of location information for the provision of a product or service or for the completion of a commercial or financial transaction.

However, the measure provides that it “shall be unlawful for a covered entity or service provider that lawfully collects and processes location information” to collect more precise location information than is necessary, retain such information longer than necessary, or sell, rent, trade, or lease location information to third parties.

The legislation’s enforcement provision, G.L.c. 93L, §5, provides a private right of action in Superior Court for consumers, in addition to authorizing an enforcement action by the attorney general. That could lead to double or triple damages for willful violations by employers.

Section 5(f) specifically renders unenforceable contract provisions such as arbitration clauses limiting an individual’s right to sue.

The statute authorizes an individual plaintiff to recover actual damages, which includes damages for emotional distress, as well as $5,000 per violation.